Information Disclosure
Monthly
Oracle Report Manager, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP. The flaw sits in the Internal Operations component and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity, and availability for the Report Manager component with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data, but the low privilege bar and network reachability make this a strong candidate for post-authentication lateral movement inside an EBS environment.
Oracle Sales Online, a module of Oracle E-Business Suite, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP; the flaw sits in the 'Internal Operations' component and is rated 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with high confidentiality, integrity and availability impact across versions 12.2.3 through 12.2.15. Exploitation needs no user interaction and no elevated privileges, only a valid low-privilege login, making any internet- or partner-facing EBS deployment with this module enabled a realistic target. No public exploit code and no CISA KEV listing were identified at time of analysis, so the immediate driver is exposure and patch lag rather than observed in-the-wild activity.
Oracle Report Manager — the reporting and output-management product within Oracle E-Business Suite — can be taken over by an attacker who already holds a low-privileged account on the same instance and can reach the application tier over HTTPS. Affected releases are E-Business Suite 12.2.3 through 12.2.15, covering a very long-lived branch of the ERP platform (per the EUVD record and Oracle's Critical Security Patch Update advisory). Successful exploitation yields full read, write and denial-of-service impact on the Report Manager component (CVSS 3.1 base 8.8: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no EPSS score, CISA KEV entry, or public proof-of-concept is present in the supplied intelligence, so exploitation status should be treated as unconfirmed.
Oracle Alert, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be taken over by an attacker holding only a low-privileged account with HTTP access to the application. Because the flaw sits in the Internal Operations component and requires no user interaction, any valid low-privilege EBS user can reach it and obtain full read/write control over Alert data and functionality, with high confidentiality, integrity and availability impact (CVSS 8.8). There is currently no public exploit code or confirmed in-the-wild exploitation (no CISA KEV listing), but Oracle's out-of-band Critical Security Patch Update is the only authoritative fix, and internet-exposed EBS deployments should treat the missing authentication boundary as the primary risk.
A low-privileged, network-reachable flaw in the Internal Operations component of Oracle User Management (part of Oracle E-Business Suite 12.2.6 through 12.2.15) lets an attacker who already holds a valid low-privileged account take full control of the User Management module. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N), effectively amounting to a takeover of the user-provisioning and authorization layer of the ERP. No public exploit code and no CISA KEV listing were identified at time of analysis, so this should be treated as a patch-now, high-severity issue rather than a confirmed active campaign.
Local privilege escalation in Oracle E-Business Suite's Applications DBA (AD Utilities) lets any attacker holding a valid low-privileged logon on the tier where AD Utilities executes take complete control of the component, with full confidentiality, integrity and availability impact on the affected schemas and utilities. Only versions 12.2.3 through 12.2.15 are affected, and exploitation requires prior host access rather than reachability over the network, so the realistic threat is an insider, a compromised application-tier service account, or a post-exploitation escalation step. No public exploit code was identified and the flaw is not listed as confirmed actively exploited (CISA KEV), so risk is driven by the value of the EBS environment and who already holds a login on that infrastructure.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Applications DBA (AD Utilities) component that lets a high-privileged attacker with network access over HTTP take full control of the Applications DBA subsystem. According to Oracle's advisory language the issue is 'easily exploitable,' meaning low attack complexity once the required privileges are held, and successful exploitation delivers high confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). No public exploit code or CISA KEV entry is present in the supplied intelligence, so exploitation appears limited to attackers who already hold an Applications DBA-level account rather than remote unauthenticated adversaries.
Oracle Quality, a module of Oracle E-Business Suite, contains a difficult-to-exploit flaw in its Internal Operations component affecting versions 12.2.3 through 12.2.15, allowing a low-privileged attacker with network access via HTTP to take over the module with full confidentiality, integrity and availability impact. Oracle's own advisory rates it CVSS 7.5 with attack complexity High and privileges required Low, meaning an attacker must already hold a valid low-privilege account but can reach the vulnerable code remotely over HTTP. No public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not supplied in the intelligence feed, so real-world exploitation likelihood cannot be quantified from that signal.
Oracle Lease and Finance Management, a finance module within Oracle E-Business Suite, can be fully taken over by a high-privileged user who sends crafted HTTP requests to its Internal Operations component in versions 12.2.7 through 12.2.15. Successful exploitation yields complete loss of confidentiality, integrity and availability for the module (CVSS 3.1 base 7.2), meaning an attacker could read and alter lease, financing and contract data and disrupt related business processes. The attack is rated easy to perform once the required privileged account and network path exist, but exploitation is gated behind high privileges, and no public exploit code or CISA KEV listing was identified at the time of analysis.
We need answer JSON only. Need synthesize. We have CVE-2026-83107 Oracle Forms component Forms Services, C/S, Charmode. Affected 12.2.1.19.0, 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker network via HTTP to compromise Oracle Forms. Scope change significant impact additional products. Successful attacks result in takeover Oracle Forms. CVSS 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. ENISA EUVD. Reference oracle security alert cspusep2026 (critical patch update?). Need produce fields. Need be careful: Description from Oracle says "high privileged attacker with network access via HTTP" PR:H. But "easily exploitable" AC:L. Impact CIA high, scope changed. Vulnerability type not specified; tags says Information Disclosure. Could be some vulnerability in Forms Services C/S Charmode. Need not invent CWE. Need infer root cause? We don't have CWE. Technical context: Oracle Forms part of Fusion Middleware, used for building enterprise apps, web-deployed Java applets? Forms Services, C/S client/server charmode. Need explain. CPE data? Input lacks CPE strings? It says CPE strings in prompt but no CPE lines. Could use affected versions. No CWE. We can say CWE not provided; root cause class unknown, but Oracle tag info disclosure suggests potentially discloses sensitive data leading to takeover? Wait CVSS says C/I/A high and scope change. With high priv attacker. Possibly a deserialization? But no. We must not infer beyond data. We can note CWE missing. Need risk assessment. CVSS 9.1 but PR:H reduces; EPSS missing, KEV? no KEV provided, POC no. Need state "no public exploit identified at time of analysis"; "KEV status not provided; not listed? Actually no KEV field; we can only say no KEV listing in provided data, but absence not confirmation? We can state "Active exploitation not indicated in provided data; no CISA KEV status provided" maybe. Need not overclaim. Multi-source includes ENISA EUVD. Refere
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 can be fully taken over by a low-privileged, network-positioned attacker who reaches Forms Services over HTTP. Oracle rates the flaw difficult to exploit (AC:H) but complete in impact, with high confidentiality, integrity and availability loss once triggered. No public exploit code has been identified and the issue is not listed in CISA KEV, so current risk is driven by the value of Forms-based business applications rather than by observed exploitation.
We need answer JSON only. Need analyze. Need adhere. We have CVE Oracle Forms. Need fields. Let's inspect input. CVE-2026-83105 Description: Vulnerability in Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions affected 12.2.1.19.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. While vulnerability in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks can result in takeover of Oracle Forms. CVSS 9.0 vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle Reported by Oracle. References Oracle advisory and NVD. EPSS? Not provided. KEV? Not provided. POC? not. Patch availability? Advisory likely. We can infer Oracle critical patch update. Need patch exact version? Input doesn't specify fixed version. EUVD affected versions. No explicit fixed version. Patch available per advisory. We must not invent version. CVSS vector provided. Need product_name: "Oracle Forms" (1-3 words). Summary: not copy description. Start with impact verb and product. Need mention unauthenticated network HTTP, difficult exploit, takeover, scope change. POC none, no KEV. EPSS unknown/missing. Must not claim active. We can say "Difficult-to-exploit remote takeover affects Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 through the Forms Services/C/S/Charmode component. An unauthenticated attacker with HTTP access can compromise Oracle Forms and potentially adjacent systems due to scope change. No public exploit or active exploitation is identified; the high CVSS is tempered by AC:H." Need technical_context: underlying technology Oracle Forms part Fusion Middleware; Forms Services, C/S, Charmode; network via HTTP; root cause unknown because CWE N/A. Mention CPE? No CPE strings provided in input. Can't invent. We can state CPE not provided. Technical context: "Oracle Forms is a long
We need answer JSON only. Need analyze. We have CVE. Need produce fields. Let's inspect data. CVE-2026-83103 Oracle Forms product Oracle Fusion Middleware component Forms Services, C/S, Charmode. Versions 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Forms. Scope change; takeover of Oracle Forms; CVSS 3.1 Base 9.1 vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. No CWE. Reported by Oracle. EUVD. References oracle security alerts cspusep2026. Need synthesize. Need product_name: Oracle Forms. Summary original synthesis not paraphrase description. Mention high privilege HTTP, takeover, scope change, no KEV/POC? Input no KEV/POC/EPSS? We need use all data. Since no KEV, no EPSS given. CVSS 9.1. Need risk. technical_context: Oracle Forms part Fusion Middleware, C/S/charmode? CWE N/A. CPE? Actually input no CPE strings shown except EUVD versions and "CPE strings"? Prompt says use CPE data but none present maybe in input absent. We can say no CPE provided. Affected products include versions. Remdiation: Vendor advisory exact maybe patch. References oracle advisory, likely patch available. But no exact patch version. Use "Patch available per vendor advisory" since vendor advisory likely. Need be cautious: absence exact fix. Oracle Critical Patch Update? URL cspusep2026 likely Critical Patch Update for Oracle Supply Chain? But no patch version. Remediation: refer to Oracle security alert, apply patch for Oracle Forms 12.2.1.19.0/14.1.2.0.0; monitor. Need no bullet. Exploit scenario: high privileged attacker via HTTP, compromised account, exploit Forms services, pivot due scope change to other products? Actually scope change affects additional products; takeover Oracle Forms. Need attack chain maybe 3-5 steps. Since high priv, network HTTP; Attack chain: Authenticate with high privileges → Send crafted HTTP request to Forms Services → Exploit flaw
Unauthenticated remote attackers able to reach the Oracle Forms Services HTTP listener can fully compromise Oracle Forms deployments in Oracle Fusion Middleware 12.2.1.19.0 and 14.1.2.0.0, gaining complete control of confidentiality, integrity and availability of the affected service (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N). The flaw resides in the Forms Services, C/S and Charmode component set and is described by Oracle as difficult to exploit, meaning success depends on specific timing or state conditions rather than a trivial one-shot request. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the current exploitation signal is theoretical rather than confirmed in the wild.
Oracle Spares Management, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by a low-privileged attacker who holds a valid account and can reach the application over HTTP. The Internal Operations component fails to properly restrict access, so a single crafted request yields high impact to confidentiality, integrity and availability of the module (CVSS 3.1 base 8.8). No public exploit code or CISA KEV entry has been identified at time of analysis, but because the flaw is trivially automatable and unauthenticated patching windows are absent, Oracle's Critical Security Patch Update should be applied without delay.
Low-privileged authenticated access to Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 is sufficient to fully compromise the platform through a flaw in the Siebel Cloud Manager component that is reachable over HTTP. Successful exploitation produces complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), effectively handing the attacker the application and the data it manages rather than merely leaking records. No public exploit code or CISA KEV listing is associated with CVE-2026-83086 at time of analysis, and no EPSS value was supplied, so prioritization rests on the severity of the flaw and the fact that the affected code sits in a cloud-management plane rather than an end-user feature.
We need to produce JSON. Let's analyze the CVE. CVE-2026-83082: Oracle Marketing, Oracle E-Business Suite, component Audience. Affected versions 12.2.3–12.2.15. CVSS 3.1 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. High privileged attacker with network access via HTTP → takeover of Oracle Marketing. Tagged "Information Disclosure, Oracle". CWE N/A. No EPSS, no KEV, no POC info. Patch: reference to Oracle security alert cspusep2026.html — likely includes patch. Oracle CPU style. So "Patch available per vendor advisory" — actually we can say Oracle typically releases patches via the Security Alert; but we don't have exact version. The reference is an Oracle security advisory page. We can say "Vendor advisory published (Oracle Security Alert); apply the corresponding CPU patch" — but careful not to invent version numbers. The reference URL is the patch/advisory link. Editorial note: use "zabrze" once in risk_assessment only. product_name: "Oracle Marketing" (1-3 words). summary: original synthesis. Not starting with "A vulnerability". Start with impact verb and product. E.g. "High-privileged remote attackers can fully take over Oracle Marketing (part of Oracle E-Business Suite 12.2.3 through 12.2.15)..." Mention PR:H authenticated. Mention CVSS 7.2, no KEV, no public exploit identified. But careful — auth: CVSS vector has PR:H → authenticated (high privileges). So we can state "authenticated high-privileged attacker". Also "network access via HTTP". technical_context: Oracle E-Business Suite Marketing module, Audience component. CWE N/A. Talk about Oracle EBS architecture: mid-tier Oracle HTTP Server / Apache, forms-based and OAF (Oracle Applications Framework) pages, database tier. Audience component handles marketing lists/segments. Root cause unknown (CWE N/A) — likely improper access control/privilege management allowing privilege escalation beyond intended role. Mention that Oracle CPUs typically don't disclose root cause until patch. risk_assessment: CVSS 7.2,
Oracle Banking Branch versions 14.5.0.0.0 through 14.9.0.0.0 can be taken over by a low-privileged attacker who already holds a valid account and can reach the application over HTTP, provided a second user is lured into interacting with crafted content in the Reports component. Oracle rates this 7.1 (AV:N/AC:H/PR:L/UI:R) with high confidentiality, integrity and availability impact, meaning full compromise of the branch platform rather than mere data leakage. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a high-severity but not yet actively exploited issue requiring patching on the Oracle Critical Security Patch Update cycle.
Oracle Fusion Middleware Control — the Enterprise Manager-style administration console bundled with Oracle Fusion Middleware — is vulnerable in the Framework component of versions 12.2.1.4.0 and 14.1.2.0.0, allowing a low-privileged user who can reach the console over HTTP to fully compromise it (CVSS 8.8, C:H/I:H/A:H), effectively achieving takeover of the management console itself. Because the console is the administrative nerve center for the middleware stack, a takeover grants a foothold with very broad downstream authority. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Full takeover of Oracle WebCenter Portal 14.1.2.0.0 is achievable by an unauthenticated attacker who can reach the server from an adjacent network segment, though Oracle rates the flaw as difficult to exploit (AC:H) given its CVSS 3.1 score of 7.5 with high confidentiality, integrity and availability impact. The vulnerability sits in the Runtime Tools component of Oracle Fusion Middleware and requires the attacker to already have access to the physical communication segment attached to the host running WebCenter Portal, so internet-facing exposure alone is not sufficient. No public exploit code, EPSS score, or CISA KEV listing was provided in the source data, so active exploitation is currently unconfirmed; Oracle published the fix via its September 2026 Critical Patch Update advisory.
We need answer JSON per instructions. Need synthesize. Must use all data. Need careful obey precision rules. We have CVE description Oracle WebCenter Portal, versions 12.2.1.4.0 and 14.1.2.0.0. CVSS 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. References Oracle security alert. No KEV, no POC, no EPSS, patch availability? Not explicitly stated. Need infer patch available? Oracle security alert likely includes patch? The reference is "cspusep2026" maybe Critical Patch Update Security? Product. Need not invent exact fix version? We don't have exact patch version. We can say Patch available per vendor advisory? Since reference is Oracle security alert likely provides fix? We need use patch availability from input. Not provided except Oracle advisory. Description says supported versions affected. Oracle critical patch update likely patch available. But precision: if patch data says available but no version -> "Patch available per vendor advisory". We can use that? Need maybe from vendor advisory. We have ref [nvd] (None) https://www.oracle.com/security-alerts/cspusep2026.html. It is an advisory. No exact fix version. So patch available per vendor advisory. But the input did not state patch available explicitly; Oracle security alert typically includes remediation. Could infer from advisory. Need maybe in remediation cite advisory URL, state apply Oracle CPU, upgrade to patched versions? But exact version unknown. Need not invent. Could say "Oracle's security alert is the authoritative advisory; apply the recommended patches or upgrade per the advisory, since exact patched versions not provided in this data." Need maybe ask vendor. But likely Oracle CPU provides fixed versions: for WebCenter Portal maybe 12.2.1.4.0 and 14.1.2.0.0? Actually Oracle patch sets often provide patches for supported versions, not upgrade version. So "patch available per vendor advisory." Need product_name: "Oracle WebCenter Portal" (3 words). Good. Su
High-privileged attackers who already hold administrative-level LDAP credentials can fully take over the OID LDAP Server component of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 by sending crafted requests over the network. Oracle rates this 7.2 on the CVSS 3.1 scale (AV:N/AC:L/PR:H/UI:N, C/I/A all High), meaning a single low-complexity action against a reachable LDAP listener yields complete loss of confidentiality, integrity, and availability for the directory service. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the high privilege prerequisite (PR:H) substantially narrows the realistic attacker set to insiders, compromised directory administrators, or attackers who have already escalated elsewhere in the environment.
We need answer JSON only. Need synthesize. Let's parse input. CVE-2026-83058: Oracle Internet Directory product of Oracle Fusion Middleware component OID LDAP Server. Supported versions affected 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable allows low privileged attacker with network access via LDAP to compromise OID. While vulnerability in OID, attacks may significantly impact additional products (scope change). Successful attacks can result in takeover of OID. CVSS 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. Hmm description says takeover, C/I/A high, not info disclosure? Could be tag mislabeled? Maybe Oracle advisory says info disclosure? But description says takeover. CWE N/A. EUVD. References oracle advisory and nvd. EPSS not provided, KEV no, POC no, patch availability? No explicit patch data in input. Need include patch status. "Patch available per vendor advisory"? Oracle advisory likely contains fix. But no exact version given. The affected versions listed, likely patches exist? We can say "Vendor advisory likely contains patch; specific fix version not provided in input" maybe. Need remediation with advisory URL. Need output fields all strings. product_name: "Oracle Internet Directory" 3 words? Oracle Internet Directory = 3 words. Fine. summary: original synthesis. Mention remote code? Actually takeover through LDAP. Low privileged attacker network via LDAP. Impact high triads scope change. Need say actively exploited? KEV no. "no public exploit identified at time of analysis". EPSS not provided, so no EPSS risk mention. POC unknown. We can mention CVSS 9.9. "Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 contains an easily exploitable LDAP Server vulnerability that allows a low-privileged network-based attacker to take over the directory service and significantly impact additional products due to scope change. Successful attacks compromise confidentiality, integrity, and availability. No active exploitatio
We need answer as JSON only. Need synthesize. Need be careful with fields. We have CVE description. Need product_name: Oracle Internet Directory. summary original synthesis. technical_context. risk_assessment. affected_products. remediation. exploit_scenario. exploitation_conditions. attack_chain. confidence_notes. data_quality_flags. prevalence. prevalence_basis. assessed_cvss_vector. assessed_cvss_rationale. assessed_cvss40_vector. Need consider input tags: Information Disclosure, Oracle. Is "Information Disclosure" mislabeled? Vulnerability is takeover with C/I/A impacts, not just info disclosure. However tags might be from source. We can flag mislabeled_tag? Need think. The tag "Information Disclosure" likely wrong because CVSS C/I/A H and "takeover" indicates full compromise, not info disclosure. But maybe vulnerability class? CWE N/A. Description says low priv via LDAP to compromise, scope change, takeover. Not primarily info disclosure. So mislabeled_tag: Information Disclosure target exact wrong value, suggested maybe "authentication bypass"? But tags are platform/technique? We need not overflag if not clear. But data quality flags: We can flag mislabeled_tag "Information Disclosure" if clearly wrong. Suggested could be "remote-code-execution"? Is that a valid tag? Need maybe "takeover" not standard. But data quality flags precision: each item type mislabeled_tag, target the tag value, suggested correct/canonical slug if know it, else null, confidence high/medium/low, reason. If not sure, can omit. However tags include Oracle, which is vendor, correct. "Information Disclosure" seems not sufficient for full compromise. Could flag with medium/high confidence. But system says only emit if highly confident and verifiable. We have CVSS says C/I/A all high, takeover. Information Disclosure is not the vulnerability impact; but it might be a tag from CVE record? Could be mislabeled. Let's consider. The vulnerability is in Oracle Internet Directory LDAP server, low-
We need answer JSON only. Need comply. We need synthesize. CVE-2026-83056 Oracle Internet Directory, OID LDAP Server. CVSS 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. KEV absent? Input no KEV, no EPSS, no POC, tags Information Disclosure, Oracle. CWE N/A. Patch? References advisory. Need produce fields. Need be careful: product_name 1-3 words. "Oracle Internet Directory". summary not copy. Need mention CVSS, low priv network via LDAP, scope change takeover. No KEV/POC. Since no KEV, no POC, "no public exploit identified at time of analysis". EPSS not provided, mention EPSS data not provided. Technical context include OID LDAP server in Fusion Middleware, LDAP protocol, CWE unavailable but root cause unknown; CPE? Input no CPE strings except EUVD versions. Need mention CPE not provided maybe. Risk assessment use all signals, SSVC? Need include tczew once in risk_assessment only. Need ensure lowercase "tczew". Use naturally. "Despite the lack of EPSS/POC/KEV data, a mid-sized municipal IT team in tczew running Oracle Internet Directory should treat this as urgent..." Need avoid factual claim? It is hypothetical illustrative reference. OK. Affected products: versions 12.2.1.4.0 and 14.1.2.1.0, Oracle Fusion Middleware, component OID LDAP Server. Vendor advisory URL. CPE absent? Could mention no CPE provided. Remediation: Oracle advisory cspusep2026. Need exact patch? Input patch data absent. Don't invent exact version. "Patch available per vendor advisory" if refs advisory. Could say "Apply Oracle Critical Patch Update for September 2026? Wait CVE ID 2026-83056, advisory cspusep2026 likely July? The URL cspusep2026.html maybe October? Oracle uses cpusep2026? Hmm cspusep2026 maybe not. Need not infer. Input references Oracle security-alerts/cspusep2026. Could say "Vendor-released patch per Oracle security alert (cspusep2026); exact fixed version not specified in this input." Safe. Need "Vendor-released patch: ..." if exact unavailable. Use "Patch available per ven
We need answer JSON only. Need parse. Need follow user. We need synthesize. Let's inspect input. CVE-2026-83055 description Oracle Internet Directory product of Oracle Fusion Middleware component OID LDAP Server. Supported versions affected 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise OID. Scope change. Successful attacks result in takeover. CVSS 3.1 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Reported by Oracle. Tags: Information Disclosure, Oracle. EUVD. References: nvd None? Actually URL Oracle security alert cspusep2026.html. No KEV, no EPSS, no POC, no patch availability? We need infer. We need return fields all strings except data_quality_flags array? User says every field plain text string not array? But data_quality_flags says JSON array. Wait critical: "Every field below MUST be a plain text string — NOT an array, NOT an object..." but data_quality_flags is "JSON array". Conflict. The general says return JSON object with these fields and data_quality_flags is array. We should output data_quality_flags as array (allowed). All other fields strings. Need follow. Need produce analysis. Need be careful: patch status? No patch data field? There is no input patch. But references point to Oracle advisory. Likely patch available; maybe exact versions 12.2.1.4.0 and 14.1.2.1.0 are affected, Oracle advisory likely includes fixes but not provided. We cannot invent exact fixed versions. Use "Patch available per vendor advisory" perhaps. Remediation: apply Oracle Critical Patch Update? The URL cspusep2026 suggests maybe April 2026? Oracle CPU? Need not invent exact patch number? Could mention vendor advisory. We can say update to patched versions per Oracle Security Alert; reference URL. But no exact fix version. Need not invented. Need product_name: "Oracle Internet Directory" 3 words? Oracle Internet Directory = 3. Good. Summary: 2-3 sentences original. Start with i
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain an easily exploitable flaw in the Runtime Tools component that lets any authenticated low-privileged user reach the portal over HTTP and take full control of the application (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity, and availability impact). An attacker only needs a valid low-privilege account and network reachability to the portal — no user interaction and no elevated privileges are required. Oracle has published a Critical Security Patch Update (cspusep2026) covering the issue; there is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is currently assessed as opportunistic rather than confirmed in the wild.
We need answer JSON only. Need synthesize. We have CVE-2026-83043 Oracle WebCenter Portal Composer. Description is standard Oracle. CVSS 9.6 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Tags "Information Disclosure, Oracle". No CWE. EPSS not provided. KEV not provided. Patch? References Oracle security alert likely patch available? Input patch data not explicit except vendor advisory. Need infer? We have affected versions. Need fields. Need follow rules. product_name: "Oracle WebCenter Portal". summary: not copy description. Need start impact verb and product. Mention easily exploitable, unauthenticated network attacker, human interaction. No EPSS/KEV/POC data: no public exploit identified at time of analysis. No KEV. CVSS 9.6. High. Need mention scope change. technical_context: underlying Oracle WebCenter Portal Composer component, Oracle Fusion Middleware. CPE? Not provided. CWE N/A. Need explain likely web portal composition feature, HTTP. Root cause unknown CWE not assigned. Mention affected versions. risk_assessment: Use CVSS vector: network, low complexity, no privileges, user interaction, scope changed, C/I/A high = 9.6. EPSS missing, KEV absent, POC unknown. SSVC: no exploitation evidence, automatable maybe yes via network? User interaction required, technically impact total. Need compare. State missing EPSS. "No KEV, no POC, no EPSS — CVSS high but real-world risk uncertain." Need not claim active. Data missing. affected_products: Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0. EUVD lists same. Vendor advisory link. No CPE strings. Write paragraph. remediation: Oracle security alert link, apply patches from July 2026? cspusep2026 maybe maybe "Oracle Critical Patch Update"? URL. Need exact fix version unknown. Patch available per vendor advisory. Suggest upgrade to supported patched version? We don't know exact. Could say consult Oracle advisory for patch, restrict network access to WebCenter Portal Composer? Need not invent. Since unauthenticated
We need answer JSON only. Need parse CVE. Need comply with fields. We need synthesize. Need not mention editorial note. Need use all data. Need risk_assessment include "mielec" once lowercase naturally. Let's think carefully. Input: CVE-2026-83040 Description: Vulnerability in Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions affected 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle WebCenter Portal. Successful attacks require human interaction from a person other than attacker and while vulnerability in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks result in takeover of Oracle WebCenter Portal. CVSS 3.1 9.6 C/I/A. Vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. CVSS Score: 9.6 Vector: same CWE: N/A Reported by secalert_us@oracle.com Tags: Information Disclosure, Oracle ENISA EUVD ID Affected versions EUVD: Oracle WebCenter Portal 12.2.1.4.0, 14.1.2.0.0 References nvd None https://www.oracle.com/security-alerts/cspusep2026.html euvd advisory https://nvd.nist.gov/vuln/detail/CVE-2026-83040 Need fields. product_name: "Oracle WebCenter Portal" (3 words? Oracle WebCenter Portal okay). product_name 1-3 words only. "Oracle WebCenter Portal" 3. summary: Original synthesis. Start with specific impact verb and product: e.g. "Remote takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can be achieved by an unauthenticated attacker through SOAP requests when a user interacts." Mention CVSS 9.6, scope change, UI:R, no KEV/POC known. POC? Input has no POC/KEV. EPSS not provided. Use phrases. "No public exploit identified at time of analysis" per rules if neither. Active exploitation? Not KEV. summary should mention no public exploit identified. EPSS risk not notable because missing. Could say "No KEV or POC indicators are present in the available data."
We need answer in JSON only. Need synthesize. We have CVE data. Need fields. Let's parse. CVE: CVE-2026-83039. Product Oracle WebCenter Portal (Oracle Fusion Middleware component Composer). Versions 12.2.1.4.0 and 14.1.2.0.0. Low privileged attacker network HTTP compromise. Scope change, impact C/I/A high. CVSS 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. References: Oracle security alert cspusep2026, NVD link. Reported by Oracle. No CWE. No KEV, no EPSS, no POC. Patch? No explicit patch availability. Oracle security alert likely contains patch. Need use data provided. "Patch availability" not provided. We should maybe infer patch available per vendor advisory? But input doesn't include patch data. Need careful: Patch status most specific: input doesn't include exact fix version; references include Oracle advisory. We can say patch available per vendor advisory? Actually we have reference to Oracle security alert, no exact version provided. Patch status can be "Patch available per vendor advisory" if patch refs imply. But do we know? The Oracle advisory likely includes patch. Need not invent exact fix version. We'll state "Patch available per vendor advisory" maybe. But remediation "apply Oracle July 2026 CPU? cspusep2026 maybe January? Actually cspusep2026 likely Critical Patch Update Security? The URL oracle.com/security-alerts/cspusep2026.html. Could be "Critical Security Patch Update - September 2026"? No cspusep? Hmm. We can cite advisory URL. Don't invent date. "Oracle Critical Patch Update advisory at ..." but actual reference title (None). Could be "Oracle Security Alert CVE". We'll cite exact URL. Need every field string. data_quality_flags array? The prompt says return JSON object, data_quality_flags JSON array. So that field is an array, okay. Other fields strings plain. Need product_name 1-3 words: "Oracle WebCenter Portal" (3 words). Summary: original synthesis. Must not copy description. Need start with impact
We need answer JSON only. Need synthesize. We have CVE-2026-83038 Oracle WebLogic Server TopLink Integration. Need all fields plain strings. Need careful with exploitation status: no KEV provided, no POC provided? Input has no KEV, no POC. So "no public exploit identified at time of analysis". CVSS provided PR:L so authenticated low privileged. Patch availability? References include Oracle security alert. No exact patch version. The description says supported versions affected. Need remediation cite advisory URL. Could say vendor patch likely available via Oracle CPU, but patch data not explicit? "Patch available per vendor advisory" if references indicate; likely yes. Need not invent fix version. Use "Patch available per vendor advisory" because Oracle security alert. Could also cite advisory URL. Affected products list with versions. Need product_name: Oracle WebLogic Server. Summary original. Technical_context: TopLink Integration, Oracle Fusion Middleware, HTTP, CWE N/A but root cause unspecified, likely deserialization? Don't infer CWE. Use CVSS scope change. CPE? Not provided directly, but EUVD affected versions. Need include "No CPE strings provided; affected versions ..." maybe in affected. Risk assessment: Use CVSS, EPSS absent, KEV no, POC no, SSVC. Need compare. Add tczew in risk_assessment only exactly lowercase. Must be ordinary prose. Maybe: "From a real-world triage standpoint, even a mid-sized municipal IT team in tczew should treat this as urgent if they run affected WebLogic versions, because the score reflects a high-impact, network-reachable, low-privilege compromise with scope change; however, EPSS and KEV data are absent, so exploitation in the wild is not confirmed." Need exactly tczew once. That's okay. But need "use lowercase word 'tczew' once" yes. Could be weird but okay. Need exploit_scenario: low privileged attacker with network HTTP, compromise server. Mention POC not identified. Exploitation_conditions: Concrete prerequisites. The
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw that lets a low-privileged, authenticated attacker reach the application over HTTP and gain complete control of the WebCenter Sites instance, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). Because the flaw is rated 'easily exploitable' and requires no user interaction, any organization exposing a WebCenter Sites deployment to a network where attackers can hold even a basic account should treat this as a high priority. There is no evidence of active exploitation (not in CISA KEV), and no public proof-of-concept has been identified at time of analysis; exploitation status is therefore unconfirmed, and Oracle's patch is delivered through the October-2026-cycle Critical Security Patch Update referenced by NVD.
A low-privileged authenticated attacker with HTTP network access can fully compromise Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0, resulting in complete takeover of the application with high confidentiality, integrity, and availability impact. Oracle rates this 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the attack requires no user interaction, making it remotely exploitable by anyone holding a basic account. No public exploit code, EPSS score, or CISA KEV listing was present in the provided intelligence, so active exploitation is not confirmed at time of analysis.
We need answer as JSON only. Need synthesize. Need be careful with fields. Let's inspect input. CVE-2026-83031 description Oracle WebCenter Sites product. Reported by Oracle. Tags: Information Disclosure, Oracle. ENISA EUVD. Affected versions. Reference Oracle security alert cspusep2026. CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CWE N/A. No KEV, no POC, no patch data explicitly. Need use data. Need fields all strings except data_quality_flags array. product_name 1-3 words: Oracle WebCenter Sites. summary original. technical_context. risk_assessment must compare signals; mention missing KEV/EPSS/POC. affected_products. remediation: no exact fix version? Oracle advisory likely says fix? Actually provided reference is Oracle security alert cspusep2026. Description says supported versions affected. We don't have exact patch version. Need patch status: no exact fix? We have no patch availability in input. But reference is Oracle advisory likely contains patches, but we cannot know exact version. Need phrase: patch available per vendor advisory? Perhaps reference to Oracle CPU. We can say "Oracle security alert cspusep2026" likely contains remediation; but no exact patch version in provided data. In remediation, cite advisory URL. Avoid invent versions. Need risk_assessment: CVSS 9.9, low privileged network HTTP, scope change, CI/A high. EPSS not provided, KEV not provided, POC unknown. Need state missing. SSVC? use decision framework: exploited? no KEV, POC unknown; automatable likely yes based CVSS AC:L PR:L UI:N; technical impact total; priority maybe high. But no KEV/POC/EPSS. "This is a critical Oracle product vulnerability with low-privilege network exploitation and scope change; while CVSS is severe, real-world priority is tempered by lack of KEV/EPSS/POC data." Need compare. EPSS missing. "No EPSS probability available — cannot assess actual exploitation likelihood." We can say CVSS indicates network vector, low complexity, low privileges, no user interactio
Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can be completely taken over by an unauthenticated attacker who has obtained a position on the same physical or adjacent network segment as the connector host. The defect lives in the Core component and is rated difficult to exploit (AC:H), yet a successful attack yields full confidentiality, integrity and availability loss with no credentials and no user interaction required. No public exploit code or CISA KEV entry has been identified at time of analysis, but the connector's role in identity provisioning and directory synchronization makes it a strategically attractive target.
Unauthenticated attackers who can reach the network segment adjacent to a host running the Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) can fully take over the connector, with confidentiality, integrity and availability all rated High and the impact explicitly extending to additional, connected products through a scope change. Exploitation is rated difficult (AC:H) and requires physical adjacency to the hardware hosting the connector, but needs no credentials and no user interaction. Oracle has published this as part of its Critical Patch Update; no public exploit code and no CISA KEV entry were identified at time of analysis.
Local privilege abuse in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 lets an attacker who already holds a low-privileged logon on the host running the connector seize full control of the connector, with high confidentiality, integrity and availability impact (CVSS 7.8). The flaw sits in the Core component of the Fusion Middleware connector and requires local logon, not
Adjacent-network attackers can fully compromise Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 through a flaw in the product's Client Bundle component, achieving high confidentiality, integrity and availability impact plus a scope change onto connected products. The attack is unauthenticated but difficult to pull off, requiring high attack complexity and a separate user's interaction, which means it is only reachable from the physical/L2 communication segment attached to the hardware running the capture service. No public exploit code and no CISA KEV listing were identified at time of analysis, so the practical risk is bounded by the constrained attack vector rather than by the severity score alone.
Local, low-privileged compromise of the SQR component in Oracle PeopleSoft Enterprise PeopleTools 8.61–8.63 lets an attacker who already holds a logon to the host where PeopleTools runs take full control of the PeopleTools instance, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8). The flaw is rated easily exploitable once host access exists (AC:L, PR:L, UI:N), but the AV:L vector means it is not remotely reachable from the network without some foothold on the target infrastructure. The provided intelligence contains no EPSS score, no CISA KEV listing and no public exploit reference, so no public exploit was identified at time of analysis, though the code-execution outcome makes this a high-value post-compromise escalation path.
Low-privileged attackers with network access to the HTTP interface of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Report Distribution component to achieve full takeover of the PeopleTools application, with high impact to confidentiality, integrity, and availability. Oracle rates the issue 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), characterizing it as easily exploitable because it needs only a basic authenticated account and no user interaction. No public proof-of-concept or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can be fully taken over through a flaw in its SQR component, but only by an attacker who already holds a high-privileged logon on the host where PeopleTools runs and who can persuade another user to perform an interaction. Oracle rates it 7.2 because a successful attack is difficult to execute yet delivers complete loss of confidentiality, integrity and availability, and because the compromise can spill over into connected products (scope change). No public exploit code is identified and there is no CISA KEV entry, so the issue is a defensive hardening priority rather than an observed campaign.
Local takeover of Oracle PeopleSoft Enterprise PeopleTools (Cube Manager component) is possible for a low-privileged user who can log on to the infrastructure hosting the product, affecting versions 8.61 through 8.63. Oracle scores this 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a difficult-to-exploit but fully compromising flaw that yields high confidentiality, integrity and availability impact on the PeopleTools instance itself. No public exploit code or CISA KEV listing was identified at time of analysis, so the immediate threat is limited to actors who already hold a valid low-privileged account and interactive access to the PeopleSoft application tier.
Low-privileged network attackers can fully take over Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 by exploiting a flaw in the Client Bundle component of Oracle Fusion Middleware, with high confidentiality, integrity, and availability impact. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction, but requires an authenticated low-privileged account (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N). No CISA KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so active exploitation is not confirmed and the practical threat is currently tied to the likelihood of an attacker obtaining a valid low-privilege account.
Unauthenticated remote attackers with HTTP access to Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware can achieve full takeover of the service by exploiting a flaw in the bundled Centralized Thirdparty Jars component. Only versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected by Oracle's advisory. The flaw carries a CVSS 3.1 base score of 8.1 with a High attack complexity rating, and no public exploit code or CISA KEV entry has been identified at time of analysis, so real-world exploitation appears opportunistic rather than widespread.
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Client Bundle component that a low-privileged, network-positioned attacker can leverage to take over the affected application, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8). Exploitation requires only a low-privileged account and HTTP access to the product — no user interaction and no elevated privileges — making it a serious risk for internet- or broadly reachable deployments. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis, and no EPSS score was provided, so active exploitation is unconfirmed.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by an attacker who holds only a low-privileged account but can reach the product's T3 and IIOP network listeners, as described in Oracle's Critical Patch Update advisory. Because the flaw is rated AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8), a single authenticated foothold is enough to gain control of the capture application rather than just read data from it. At the time of analysis there is no CISA KEV listing and no public exploit code identified; EPSS data was not supplied, so exploitation likelihood cannot be quantified.
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by a low-privileged attacker who can reach the product over HTTP, with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw sits in the Client Bundle component of the Oracle Fusion Middleware product and is described by Oracle as easily exploitable, meaning no unusual conditions or user interaction are needed beyond a valid low-privilege account. No public exploit code, EPSS score or CISA KEV listing was present in the provided intelligence, so active exploitation is unconfirmed at time of analysis.
Full takeover of Oracle Access Manager is achievable by a low-privileged, network-positioned attacker who can reach the product's HTTP Authentication Engine, affecting supported versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware. The flaw requires valid low-privilege credentials (PR:L) and is rated hard to exploit (AC:H), but its scope-change rating means a successful attack against OAM can cascade into the downstream applications that rely on it for single sign-on. As of analysis, no public exploit code and no CISA KEV listing were identified, and the input contained no EPSS score, so real-world exploitation pressure is unquantified despite the 8.5 base score.
We need answer JSON only. Need synthesize. Need obey all rules. Let's inspect input. CVE ID CVE-2026-83001. Description Oracle Access Manager product of Oracle Fusion Middleware component Authentication Engine. Supported versions affected 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Access Manager. While vuln in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks result in takeover of Oracle Access Manager. CVSS 3.1 9.1 vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Reported by Oracle. Tags Information Disclosure, Oracle. EUVD. References Oracle advisory. Need produce fields. Need be careful product_name "Oracle Access Manager" 3 words? Oracle Access Manager = 3. Good. Summary: Need original, no "A vulnerability". Start with impact verb and product. E.g. "High-privileged remote attackers can fully compromise Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 via the Authentication Engine..." Mention CVSS 9.1, scope change, no KEV no POC. Since KEV absent, POC absent. EPSS absent. Need note no public exploit identified at time of analysis. "allows high privileged attacker with network access via HTTP to take over" maybe. Must not copy description. Also mention CVSS. Need make plain. technical_context: Underlying tech Oracle Access Manager authentication engine in Fusion Middleware. CPE data? Input doesn't include CPE strings, only affected versions. Need use EUVD affected versions. CWE N/A, so root cause class unknown. State that no CWE provided; root cause not specified in available data. That is okay. risk_assessment: Need use CVSS vector. AV:N, AC:L, PR:H, UI:N, S:C, C/H/I/H. EPSS missing, KEV no? Input has no KEV field, only references. Must maybe assume no KEV? Use "not listed in CISA KEV in provided data"; "no EPSS score provided". POC none. SSVC: exploitation status? No public exploit identified. Au
We need answer JSON only. Need analyze. Let's inspect input. CVE-2026-82999 Oracle Fusion Middleware Service Delivery Platform component Messaging Enabler. Affected 12.2.1.4.0 and 14.1.2.0.0. CVSS 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Description says easily exploitable low priv network HTTP to compromise, scope change, result takeover. Tags: Information Disclosure, Oracle. EUVD. References oracle advisory. Need produce fields. Need product_name: "Service Delivery Platform" perhaps Oracle Fusion Middleware Service Delivery Platform. 1-3 words: "Oracle Service Delivery Platform"? Product specifically "Service Delivery Platform" of Oracle Fusion Middleware. Maybe "Oracle Service Delivery Platform" 3 words. Need summary original not paraphrase. Start impact verb product. Example "Remote takeover of Oracle Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 allows..." Need include what vuln? Description vague: vulnerability in Messaging Enabler. Tags Information Disclosure, but CVSS C/I/A high and takeover. Contradiction? Tags says Information Disclosure but impact is full CIA maybe due scope? Need mention perhaps tag indicates info disclosure but CVSS says total compromise. Need use all data. KEV? Not in input, so no KEV. POC? none. EPSS? None. Patch availability? References advisory likely patch? Oracle CPU. We can infer patch available? Input patch data not explicitly. References oracle security alert. Need remediation cite Oracle advisory but no exact patch version? Affected versions; Oracle fixed perhaps next CPU. Need be cautious: "Patch available per vendor advisory" if advisory? But input references oracle security-alerts/cspusep2026.html. That is vendor advisory. We can say apply Oracle Critical Patch Update referenced; exact patched versions not included, verify. Need include "Vendor-released patch: exact version not provided" maybe patch status phrase. Use "Patch available per vendor advisory". In remediation: apply Oracle CPU 2026? Advisory URL. Me
We need answer JSON only. Need synthesize. We need comply. Let's parse. CVE-2026-82998 Oracle Fusion Middleware Service Delivery Platform component Messaging Enabler. Supported versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable low priv network via T3, IIOP. Scope change. Takeover. CVSS 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Tags Information Disclosure, Oracle. References Oracle advisory and NVD. KEV? Not provided, likely no. POC not provided. Patch availability? Not explicitly but advisory likely patch. Need infer from data. No KEV. Need product_name "Service Delivery Platform". summary original synthesis, not copy, not start with prohibited. Need mention low-priv network via T3/IIOP, takeover, scope change, no active exploitation identified. technical context: Oracle Fusion Middleware, T3/IIOP protocols, SDP Messaging Enabler. CWE N/A, root cause not specified. Use CPE data? Not provided, use affected versions. risk_assessment: use CVSS, EPSS unknown? no EPSS provided. KEV absent. POC unknown. SSVC? Need assess. Mention conflicting/missing: CVSS indicates network vector low priv, but tag information disclosure vs full compromise mismatch; CWE missing; patch details not specified. Include "olsztyn" once naturally as illustrative. Maybe: "For an operator with unsegmented middleware, even a mid-sized municipal IT team in olsztyn should treat this as urgent..." Need ensure ordinary prose not factual. Could mention "high CVSS, low complexity, low priv, scope changed => critical; but no KEV or EPSS or public POC, exploit availability unknown." That satisfies. affected_products paragraph with versions and advisory URLs. remediation: Oracle CPU? The advisory URL likely Oracle Critical Patch Update? Need cite. Primary fix patch/upgrade to later CPU. Since exact fix version not in input. We can say Patch available per Oracle advisory, apply Oracle Critical Patch Update for April 2026? The URL cspusep2026 maybe? Need not invent exact version. "Vendor-re
We need answer JSON only. Need synthesize. Let's inspect input. CVE-2026-82997. Description from Oracle. Product: Service Delivery Platform, Oracle Fusion Middleware. Component Messaging Enabler. Versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable low priv network via T3, IIOP compromise SDP, scope change, takeover. CVSS 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. CWE N/A. References only Oracle advisory. Reported secalert. ENISA EUVD. Need produce fields. Product_name "Service Delivery Platform" maybe "Oracle Service Delivery Platform" 3 words? "Oracle Service Delivery Platform" is 3? Oracle, Service, Delivery, Platform = 4 words. Specific product: Service Delivery Platform. Could use "Oracle Service Delivery Platform" but 4 words. Rule 1-3 words ONLY. "Service Delivery Platform" 3 words. Good. Summary: Start with impact verb and product. Need not copy description. Example: "Remote takeover of Oracle Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 via T3/IIOP allows low-privileged attackers..." Mention KEV? not listed. POC? not listed. EPSS not provided. Use no public exploit identified. CVSS 9.9 critical. Scope change. Need technical_context: Underlying technology: Oracle Fusion Middleware Service Delivery Platform, Messaging Enabler component, T3 and IIOP protocols. T3 is Oracle WebLogic's proprietary RMI protocol? IIOP CORBA. CPE data? There is no CPE list in input. We can reference versions. CWE N/A. Root cause class unknown because CWE N/A; but description implies insecure deserialization or access control? We must not invent. State CWE not assigned. Could say vulnerability class not specified; network protocols T3/IIOP exposed. Educational. Risk assessment: Use signals. CVSS base 9.9 with AV:N, AC:L, PR:L, UI:N, S:C, C/I/A H. EPSS missing. KEV absent. POC unknown. SSVC? Exploitation status none, automatable maybe yes, technical impact total. Compare high CVSS but no known exploitation? We can say high sever
Local privilege escalation in the Installation component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets any low-privileged user who can log on to the host running Siebel CRM Deployment to fully compromise that deployment. Because the flaw is reachable through the local attack surface with no user interaction and yields complete loss of confidentiality, integrity and availability, an attacker with an otherwise ordinary account can effectively take over the CRM environment. No public exploit code or in-the-wild exploitation is identified in the available intelligence at time of analysis, and the vendor advisory from Oracle is the sole reference for affected versions and fixes.
Adjacent-network attackers can crash HPE Networking EdgeConnect SD-WAN Gateways or leak small amounts of uninitialized stack memory by sending crafted traffic to the gateway, affecting unauthenticated devices reachable from the same Layer 2 segment. The flaw (CWE-200) carries a 7.1 CVSS score with the availability impact rated High and confidentiality impact Low, and it spans four maintained release trains from 9.4.0.0 through 9.7.0.0. It is not listed in CISA KEV, no public exploit code was identified in the supplied intelligence, and no EPSS probability was provided, so the immediate risk is driven by network adjacency and gateway exposure rather than confirmed mass exploitation.
Authentication controls protecting the web-based management interface of HPE Aruba EdgeConnect SD-WAN Orchestrator can reportedly be circumvented by a remote actor, allowing escalation to administrative privileges and full compromise of the orchestrator host that manages the SD-WAN fabric. Reported affected releases span EdgeConnect SD-WAN software 9.4.0 through 9.7.0, with no fix version disclosed in the supplied source data. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so exploitation status is best treated as unconfirmed.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways, where a flaw in the appliance's underlying operating system lets a network-reachable attacker crash or stall an affected service. All four maintained branches are impacted — 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0 — with CVSS 7.5 reflecting a high availability impact and no confidentiality or integrity loss. No public exploit code and no CISA KEV listing were present in the source data at time of analysis, so this is currently a patch-now availability risk rather than a confirmed active campaign.
Unauthenticated remote attackers can circumvent the authentication controls exposed by the API of HPE Networking EdgeConnect SD-WAN Orchestrator, escalating to administrative privileges and achieving complete compromise of the orchestrator host. The vendor rates this 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), and EUVD maps the affected code lines to EdgeConnect SD-WAN releases 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0. No CISA KEV listing or public exploit code was identified in the supplied intelligence, and EPSS data was not provided, so the practical exploitation risk rests on the high attack complexity (AC:H) noted in the vendor vector.
Incorrect authorization in the EdgeConnect SD-WAN Orchestrator API lets an authenticated remote user with low privileges retrieve sensitive information beyond what their role permits, and that data can potentially be leveraged to reach the SD-WAN network services the orchestrator manages. The vendor HPE/Aruba rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and ENISA EUVD lists affected EdgeConnect SD-WAN Gateway releases in the 9.4.x, 9.5.x, 9.6.x and 9.7.0 lines. No public exploit code exists and the issue is not in CISA KEV at time of analysis; exploitation requires valid low-privilege credentials, which materially narrows the attacker population.
We need answer JSON only. Need analyze. Let's inspect input: CVE-2026-76673. Description: vulnerabilities in API of EdgeConnect SD-WAN Orchestrator allow unauthenticated remote actor circumvent auth, gain admin privileges complete compromise. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure. Reported by HPE. Affected versions EUVD: EdgeConnect SD-WAN Gateways 9.6.0 ≤9.6.3, 9.5.0 ≤9.5.8, 9.4.0 ≤9.4.10, 9.7.0 ≤9.7.0. References HPE advisory hpesbnw05135en_us and NVD link. Need synthesize. Product name: EdgeConnect SD-WAN Orchestrator? But affected versions listed as Gateways. primary product maybe "EdgeConnect SD-WAN Orchestrator". It says vulnerabilities in API of Orchestrator, but affected versions EUVD say Gateways. Need maybe product_name "EdgeConnect SD-WAN Orchestrator" as specific. The affected products paragraph should mention gateways versions? Could be perhaps HPE Aruba Networking EdgeConnect SD-WAN Orchestrator, gateways? Need be cautious. Need produce fields plain strings. Data quality flags maybe issues: tags "Information Disclosure" but vulnerability is auth bypass/privilege escalation, not info disclosure. Could flag mislabeled_tag maybe "Information Disclosure" target exact, suggested maybe "authentication-bypass" or "privilege-escalation"? Need determine tag type. Input tags: Information Disclosure. That's a technique/impact tag. The CVE is authentication bypass leading to admin compromise. Is that mislabeled? Likely yes. Could flag type mislabeled_tag target "Information Disclosure" suggested "authentication-bypass" confidence high? Let's see our rules: For mislabeled_tag target exact wrong value. We can flag. Suggested lower-case hyphenated slug. "authentication-bypass" maybe. But if the system may have tag taxonomy? The described vuln is circumvent authentication controls. Could suggest "authentication-bypass". Also maybe "privilege-escalation". But one flag enough? "missing_tag" for authentication-bypass? Since
We need answer JSON only, no markdown. Need synthesize. Let's parse input. CVE-2026-76672. Description: vulnerability in SD-WAN Orchestrator may lead exposure sensitive config info. Auth remote attacker with read-only privileges exploit by specially crafted request to cache synchronization endpoint. Success disclosure sensitive third-party API tokens and credentials, lateral movement to external security platforms. CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L, CWE N/A. Reported by security-alert@hpe.com. Tags: Information Disclosure. ENISA. Affected versions EUVD: ["EdgeConnect SD-WAN Gateways 9.7.0 ≤9.7.0", "EdgeConnect SD-WAN Gateways 9.4.0 ≤9.4.10", "EdgeConnect SD-WAN Gateways 9.6.0 ≤9.6.3", "EdgeConnect SD-WAN Gateways 9.5.0 ≤9.5.8"]. References nvd None, support.hpe advisory. Need product_name: "EdgeConnect SD-WAN Orchestrator" or "HPE EdgeConnect SD-WAN Orchestrator"? Specific product. Affected versions mention Gateways, description says SD-WAN Orchestrator. Product name maybe "EdgeConnect SD-WAN Orchestrator". Use 1-3 words only: "EdgeConnect SD-WAN Orchestrator" (3 words? EdgeConnect is one, SD-WAN maybe? But 1-3 words okay). Could include HPE? "HPE EdgeConnect SD-WAN" maybe. But product_name should specific. Let's use "HPE EdgeConnect SD-WAN Orchestrator" maybe 4 words? Words: HPE, EdgeConnect, SD-WAN, Orchestrator = 4. Rule 1-3 words ONLY. Use "EdgeConnect Orchestrator" (2 words) or "SD-WAN Orchestrator". But product maybe HPE Aruba EdgeConnect SD-WAN Orchestrator. The affected versions say EdgeConnect SD-WAN Gateways but vuln is Orchestrator. Need choose primary: "EdgeConnect SD-WAN Orchestrator". That's 3 if hyphen? They count words by spaces: EdgeConnect, SD-WAN, Orchestrator = 3. Good. Summary: Original synthesis not copy. Must mention actively exploited? KEV not provided, so no KEV. POC no. EPSS absent. Need mention if no public exploit identified? We can include "no public exploit identified at time of analysis". Also CVSS 9.9 critical
In Oracle Siebel CRM's Marketing module (Siebel Apps - Marketing), supported versions 17.0 through 26.7 expose a network-reachable HTTP flaw that a high-privileged user can leverage to seize full control of the Marketing application, impacting confidentiality, integrity and availability alike (CVSS 3.1 base 7.2). The issue is rated easily exploitable (AC:L) but is gated behind privileged credentials (PR:H), and no user interaction is needed once such access exists. No CISA KEV entry, public exploit code, or EPSS score was supplied with the source data, so active exploitation is unconfirmed at time of analysis.
Unauthenticated network attackers can achieve full takeover of Oracle Access Manager via a difficult-to-trigger flaw in the Authentication Engine component of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this CVSS 3.1 8.1 with High confidentiality, integrity, and availability impact from a network vector requiring no privileges or user interaction, meaning the identity service itself — and the applications it protects — can be fully compromised. No public exploit code and no CISA KEV entry were identified at time of analysis; the AC:H rating indicates the attack requires precise timing or a specific non-default state rather than a trivial repeatable request.
We need answer JSON. Need produce fields. Need comply with editorial note: in risk_assessment only, use lowercase "gliwice" once naturally. Need not mention note. Need all fields plain text strings except data_quality_flags array. Need product_name 1-3 words. CVE is Oracle PeopleSoft Enterprise PeopleTools. Product name maybe "PeopleSoft PeopleTools" (3? PeopleSoft Enterprise? 2-3). Use "PeopleSoft PeopleTools". Summary original synthesis not copy. Need note KEV? Input no KEV/POC. EPSS none. CVSS 8.1 AV:N AC:H PR:N UI:N S:U C:H I:H A:H. CWE N/A. Tags: Information Disclosure, Oracle. Description says component Business Interlink, supported versions 8.61-8.63. Difficult to exploit unauthenticated network via HTTP, takeover. CVSS AC:H. We need assess. No patch data? References only Oracle advisory. Need patch status? Input doesn't state patch. Oracle CPU typically includes patches. Reference is Oracle security alert cspusep2026.html. Need not invent fix version. We can say Vendor advisory available via Oracle Critical Patch Update/Security Alert; apply latest CPU patches. Exact fix version not provided in input. But Oracle advisories usually include patches, not exact version. We can state "No vendor-released patch version confirmed from provided data; Oracle advisory referenced..." However if in remediation, "Apply the fix from Oracle's advisory." Need cautious. Need technical_context: Oracle PeopleSoft Enterprise PeopleTools Business Interlink component. PeopleTools is development/runtime framework, Business Interlink maybe integration component. CWE N/A. Difficult to exploit AC:H, unauth via HTTP. Potential impact full takeover. Explain protocol HTTP. Use CPE not provided. "No CPE strings supplied; affected versions from description 8.61-8.63." Risk_assessment: Use all signals. CVSS 8.1 high; AC:H lowers exploitability; PR:N; UI:N; S:U; C/I/A high. No EPSS, no KEV, no POC. SSVC? Exploitation none, automatable? AC:H maybe no? Technical impact total. State uncertain
Unauthenticated attackers with network access to the HTTP interface of Oracle WebCenter Portal's Portlet Services component can exploit a hard-to-trigger flaw to fully compromise the application, per Oracle's Critical Security Patch Update (cspusep2026). Impact spans confidentiality, integrity and availability (CVSS 8.1), with the stated outcome being complete takeover of WebCenter Portal. Only supported versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected; no public exploit code or CISA KEV entry was present in the supplied intelligence, and the high attack-complexity metric (AC:H) suggests exploitation requires specific, non-trivial conditions rather than a simple one-shot request.
Authenticated low-privileged users can fully take over Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 by sending crafted HTTP requests to the Portlet Services component. Oracle's Critical Security Patch Update rates this 8.8 with complete loss of confidentiality, integrity and availability of the portal, meaning an attacker with any valid low-privilege account can seize control of the application. No public exploit code or CISA KEV listing is known at time of analysis, so exploitation is currently limited to attackers who already hold credentials, though the low attack complexity makes weaponization plausible once a proof of concept surfaces.
We need answer JSON only. Need synthesize CVE-2026-73948 Oracle WebCenter Portal. Need ensure all fields strings, data_quality_flags array maybe empty or flags. Need follow precision rules. We have data: Description vulnerability in Oracle WebCenter Portal product of Oracle Fusion Middleware component Composer. Supported versions affected 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While vulnerability in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Reported by secalert_us@oracle.com. Tags: Information Disclosure, Oracle. ENISA EUVD ID EUVD-2026-79302. Affected versions EUVD. References Oracle advisory and NVD. No EPSS / KEV / POC / patch data explicitly. Need state no public exploit identified. Need maybe infer from Oracle quarterly CPU. Need product_name 1-3 words: "Oracle WebCenter Portal". Summary: critical takeover. Mention low-priv network HTTP, scope change. Not copy description. Need mention no KEV/POC? Input has none. Could say no public exploit identified at time of analysis, EPSS not provided. But summary 2-3 sentences, mention actively exploited? No KEV so no. Need likely original synthesis. Technical_context: underlying technology: Oracle WebCenter Portal, component Composer. CPE? Not provided as CPE strings, only affected versions. We can say no CPE strings provided. CWE missing N/A. Explain root cause class unknown; "Composer" likely page composer functionality. Need educational, be specific but don't invent root cause. Tags include Information Disclosure but CVSS high C/I/A and takeover; tag may be mislabeled? Need perhaps data quality flag? Tags: "Information Disclosure, Oracle" — Description says takeover, C/I/A high, not information disclosure. But vulnerabili
We need answer JSON only. Need synthesize. Need be careful: input has CVE, description, CVSS. Tags: Information Disclosure, Oracle. References Oracle advisory. No KEV/POC/EPSS in prompt? We need use all data. No EPSS, no KEV, no patch? Need infer patch maybe Oracle CPU? The reference URL is likely Oracle Critical Patch Update. Need product name "Oracle Access Manager". Summary original, not paraphrase. Need mention no public exploit identified at time of analysis. Need CVSS vector provided AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. High privileged attacker with network via HTTP. Scope change. Easily exploitable. Result takeover of Oracle Access Manager. CWE N/A. Tags include Information Disclosure but CVSS says C/I/A high? Maybe conflicting. Need mention tag mismatch perhaps in data_quality_flags? Tags: "Information Disclosure, Oracle". Vulnerability description says takeover (C/I/A), so Information Disclosure tag may be mislabeled? But we must be highly confident. It could be Oracle advisory lists component as Authentication Engine; CVSS impacts C/I/A high, not just information disclosure. Tag "Information Disclosure" might be miscategorized? Need maybe flag mislabeled_tag target "Information Disclosure", suggested maybe "authentication-bypass"? But CWE N/A, description not detail. Could flag low/medium. However data_quality_flags must be concrete wrong verifiable. "Information Disclosure" tag on a CVE with CVSS C/I/A H seems likely mislabeled, but not verifiable from references? Need maybe not flag, or flag as missing? Let's follow rules: only highly confident. The tag "Information Disclosure" is maybe wrong because description says takeover; but tags may reflect underlying vuln? Not enough. We can mention in confidence_notes or risk? The prompt says use all data, tags. We can note tags say Information Disclosure but description indicates full compromise; however flag? Maybe not unless clearly wrong. But maybe "Information Disclosure" is contradictory. Let's consider.
We need answer JSON only. Need synthesize. Let's inspect input. CVE-2026-73945 Oracle Access Manager. Description from Oracle. CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. EUVD affected versions: OAM 14.1.2.1.0, 12.2.1.4.0. References: Oracle security alert cspusep2026, NVD link. CWE N/A. No KEV, EPSS, POC, patch availability? Input lacks KEV etc. Need obey: every field string. Need product_name "Oracle Access Manager" (3 words). summary original, no copy. Need mention no KEV, no POC identified, EPSS absent. "Remote code? takeover". Vulnerability in Authentication Engine allows low privileged network HTTP attacker to take over Oracle Access Manager with scope change impacting additional products. We cannot say RCE? Result takeover, C/I/A high. We'll say "Compromise of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 via Authentication Engine enables a low-privileged network attacker over HTTP to take over the product and significantly impact adjacent systems due to scope change. No public exploit or CISA KEV entry was present in the provided intelligence; EPSS data was not available." That complies. technical_context: Oracle Fusion Middleware Oracle Access Manager, authentication engine. CWE N/A. Identify affected products from CPE? No CPE strings provided, but EUVD versions. Need mention CWE not provided, root cause class unknown/inferred. Must use CPE data? Input doesn't have CPE, say no CPE provided. Product component Authentication Engine. Scope change implies vulnerable component exposes/influences other system components. CVSS PR:L authenticated low privilege. HTTP. risk_assessment: Use CVSS vector. EPSS not provided, KEV no, POC no. No patch availability specified? Wait input says nothing about patch? Reference advisory. Oracle security alert likely patch. The affected versions are supported. Need maybe patch available? We cannot assert exact fix version. Input has only affected versions. The Oracle advisory URL but no
Low-privileged attackers with network access can achieve full takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 through a flaw in the OIM Legacy UI component of Oracle Fusion Middleware. Successful exploitation compromises confidentiality, integrity, and availability of the identity platform itself, which typically means control over the accounts, roles, and provisioning workflows it governs. The vulnerability is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N), requires only an authenticated low-privilege session, and no public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
We need answer JSON object. Need synthesize. Must obey. Need extract data. Let's parse input. CVE-2026-73458. Description: On affected platforms running Arista EOS with authenticated BFD sessions configured, specially crafted packet can cause BFD sessions to go down. May result in undesirable network changes because routing protocols monitor BFD status. CVSS Score 9.2, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H... CWE-303. Reported by psirt@arista.com. Tags: Information Disclosure. ENISA ID. Affected versions EUVD: EOS 4.36.0 ≤4.36.1F, 4.33.0 ≤4.33.8M, 4.35.0 ≤4.35.5M, 4.34.0 ≤4.34.7M. References: arista advisory and nvd. No KEV, no POC, no EPSS given. Patch availability not explicitly but advisory likely patch? Need not invent. Need maybe references include advisory. Need fields. product_name: "Arista EOS" (1-3 words). Good. summary: Original synthesis. Must not copy/paraphrase description. Start with specific impact verb and product, e.g. "Denial of service in Arista EOS BFD..." Mention affected versions, authenticated BFD sessions configured, specially crafted packet causes BFD sessions down, routing protocols depending on BFD may reconverge. Mention no KEV/POC/EPSS? Summary needs mention if actively exploited, if POC exists, and EPSS risk if notable. There is no KEV, no POC, EPSS not provided. State no public exploit identified at time of analysis, EPSS not available. Need careful: "On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, ..." We can start with "Denial of service in Arista EOS 4.33.0 through 4.36.1F..." and not "A vulnerability". Do not say "allows remote code execution", it's availability impact. Need influence routing, availability. Summary: "Denial of service in Arista EOS 4.33.0 through 4.36.1F can drop authenticated BFD sessions when an unauthenticated remote attacker sends a specially crafted packet; because BFD down state is monitored by routi
Full takeover of Oracle Identity Manager is achievable by any low-privileged authenticated user who can reach the application's HTTP interface in versions 12.2.1.4.0 and 14.1.2.1.0 (Oracle Fusion Middleware, Core component). The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), meaning a single authenticated request chain can hand an attacker administrative control over the identity governance platform. No CISA KEV listing, EPSS score, or public proof-of-concept was supplied in the source data, so exploitation status is currently unconfirmed and no public exploit has been identified at time of analysis.
Oracle Identity Manager (OIM), the identity-governance component of Oracle Fusion Middleware, is exposed to a takeover-level flaw in its Core component affecting versions 12.2.1.4.0 and 14.1.2.1.0. An attacker who holds a low-privileged account and can reach the T3 or IIOP listener over the network can exploit the defect to fully compromise the OIM deployment, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). No public exploit code or CISA KEV entry was present in the supplied intelligence, and the accompanying 'Information Disclosure' tag understates the reported impact — the vector's C/I/A metrics are all High.
Remote unauthenticated denial of service in the libp2p-quic transport crate (Rust implementation of libp2p) prior to 0.13.1: a peer that completes a valid-looking QUIC/TLS handshake with a deliberately short-lived libp2p TLS certificate and then withholds the final TLS 1.3 handshake fragment until that certificate expires triggers a wall-clock validity re-check in the post-handshake upgrade path, where an `expect()` call panics and tears down the application hosting the QUIC listener. Only a single inbound connection from a network peer is needed, no malformed packets are required, and the attack is fully automatable against any service exposing an affected libp2p-quic listener. The flaw is an uncaught exception (CWE-248) and is fixed in 0.13.1; no public exploit code and no CISA KEV listing were identified at time of analysis, though the GHSA advisory publishes a precise reproduction recipe.
The Apache Airflow FAB provider (apache-airflow-providers-fab) before 3.9.0 fails to validate the issuer and audience claims of id_tokens presented to its Authentik OAuth login path, so any token that the same Authentik deployment minted for a different client application is accepted by Airflow and authenticates the attacker as the user named in that token. Only deployments running the FAB auth manager with Authentik OAuth against an Authentik instance that also serves other applications are affected — the attacker needs a valid token for one of those other apps, not for Airflow itself. This is a follow-up to CVE-2026-75156, which fixed the identical missing-validation flaw on the Azure AD path in the same file while leaving the Authentik path untouched; upgrade to 3.9.0 or later to remediate. No public exploit code or active-exploitation telemetry was provided in the source data.
Authentication bypass in the Apache Airflow Keycloak provider (apache-airflow-providers-keycloak) before 0.10.0 lets an attacker who holds valid client credentials for any unrelated confidential client in a shared Keycloak realm obtain a signed Airflow session JWT. Because the provider's token endpoint does not allowlist client ids, credentials that were never issued for Airflow are silently accepted as Airflow login credentials, and Airflow mints a session token for that third-party application's service account. Access is then limited only by what that service account can reach plus any endpoint gated solely on being authenticated, and the endpoint additionally permits unauthenticated credential guessing against Keycloak under Airflow's identity. No public exploit code or CISA KEV entry was identified at time of analysis; severity is rated moderate by the vendor, with the impact bounded by subject-level resource authorization.
We need to produce JSON. Let me parse the data. CVE-2026-79410: Improper validation of quantity parameter in add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce order total below legitimate price of shippable goods. CVSS: 8.1, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. CWE-20 (Improper Input Validation — note: description says improper validation, matches CWE-20). Tags: Information Disclosure (mislabeled — this is a business logic / price manipulation flaw, integrity impact). Actually the tag "Information Disclosure" is wrong — the impact is integrity (price manipulation) and confidentiality per CVSS C:H/I:H. Hmm, CVSS says C:H too which is odd. But tag "Information Disclosure" is arguably mislabeled given the CWE-20 improper input validation and the described impact. I could flag it as mislabeled_tag with target "Information Disclosure". References: only a GitHub repo (isukasanuj/bagisto-cve). No vendor advisory, no patch refs. ENISA EUVD ID present. Affected versions: Bagisto v2.4.9 (Webkul Bagisto, a Laravel-based open-source e-commerce platform). Prevalence: Bagisto is a relatively niche open-source e-commerce platform (Laravel). I'd say "low" — it's not widely deployed like WooCommerce/Magento. Maybe "low". Basis: "niche open-source Laravel e-commerce platform, limited deployment". Product name: "Bagisto" (1-3 words). Maybe "Webkul Bagisto". Now the fields. summary: Must not start with "A vulnerability". Start with impact verb and product. E.g., "Improper validation of the quantity parameter in Webkul Bagisto v2.4.9's add-to-cart path lets authenticated shoppers drive their order total below the true price of shippable goods..." Mention auth (PR:L = authenticated), no KEV, no POC stated (the reference is a GitHub PoC repo... hmm, github.com/isukasanuj/bagisto-cve/blob/main/CVE-2026-79410.md — that looks like a PoC/advisory repo. That suggests publicly available exploit code might exist. But POC field isn't provided. I
Let me synthesize. CVE-2026-69205: http4s Ember HTTP parser request smuggling via Transfer-Encoding header case-sensitivity and charset decoding issues. Key facts: - http4s Ember (Scala HTTP library), prior to 0.23.35 and 1.0.0-M47 - CWE-444 (Inconsistent Interpretation of HTTP Requests / request smuggling) - CVSS 8.7, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N - No EPSS given, no KEV, no explicit POC. - Patch: 0.23.35 and 1.0.0-M47, commit 5e88b2e7b4e6ea2f0c61040a4bc9de0d73e51217 - Tags: Information Disclosure, Request Smuggling, Http4S Fields to output. Let me write carefully. Product name: "http4s Ember" — 1-3 words. "http4s" is one word. Maybe "http4s Ember". That's fine. Summary: must not start with "A vulnerability". Start with impact. E.g., "HTTP request smuggling in http4s Ember (0.23.x before 0.23.35 and 1.0.0 milestones before M47) allows attackers to desynchronize HTTP/1.1 framing between Ember and intermediary proxies..." Note S:C (scope changed) with C:H/I:H/A:N. Affected products: http4s Ember before 0.23.35, 1.0.0-M47. CPE cpe:2.3:a:http4s:http4s:*:*:*:*:*:*:*:*. Advisories GHSA-9998-894r-fwvr, releases. Remediation: upgrade to 0.23.35 or 1.0.0-M47; the fix decodes header bytes as ISO-8859-1 and rejects any transfer coding token other than "chunked" case-insensitively; workaround: reject/rewrite ambiguous Transfer-Encoding at reverse proxy, strip Transfer-Encoding, disable chunked, use HTTP/2 end-to-end. Note side effects: strict rejection of unknown transfer codings may break clients sending e.g. "gzip, chunked" or "identity" — actually the fix rejects any Transfer-Encoding other than chunked, including "identity"? codings split by ',' and all must equalIgnoreCase("chunked"). So "identity" would be rejected. Side effect: legitimate clients sending multiple codings will get errors. Note Ember is both server and client (ember-client). Response smuggling requires malicious upstream. Exploitation conditions: Requires Ember-based server behind
Unauthenticated order-state tampering in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7) lets anyone mark any order as FAILED without supplying a payment amount, transaction ID, or any other verification data. An attacker can mass-fail pending orders to disrupt revenue, or flip already-fulfilled orders back to FAILED, triggering unwarranted refunds, cancellations, and customer-support load. The CVE carries a CVSS 4.0 score of 8.7 driven entirely by high integrity impact; no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.
Let me synthesize. CVE-2026-56882: Cellular Modem (Android Pixel), information disclosure due to logic error, leading to RCE, no additional execution privileges, no UI. CVSS 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CWE-200 (Exposure of Sensitive Information). Reported by Google_Devices, Pixel bulletin September 2026. Product name: "Android Cellular Modem" — 1-3 words. Maybe "Android Cellular Modem" (3 words). Or "Pixel Cellular Modem". Let's use "Android Cellular Modem". Prevalence: Android is ubiquitous. But cellular modem specifically... The affected component is the cellular modem firmware in Android/Pixel devices. Prevalence of Android = ubiquitous. Hmm. The CPE is google:android. Modem component. I'd say "ubiquitous" given Android base. But the specific modem component... The CPE says google:android, so I'll go with ubiquitous. Actually maybe "high"? Android is on billions of devices — ubiquitous is defensible. Let me say ubiquitous with basis "core platform component across billions of Android devices". Hmm, but cellular modem is only in phones with cellular. Still ubiquitous. Actually, let's be careful — the CPE is google:android which is the whole OS. Cellular modem affects devices with cellular radios = most Android phones. I'll go with ubiquitous. CVSS vector given: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — PR:L is odd for a modem, but that's the input. Note the mismatch: description says "no additional execution privileges needed" but vector says PR:L. That's a conflict to note. My assessed vector: Given it's a modem logic error leading to info disclosure → RCE, remote. I'll assess AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H? Hmm. Let me think. Cellular modem attack — typically over-the-air from a rogue base station or via malicious network. AC:H might be reasonable (requires specific modem state / malformed signaling). But CVSS says AC:L. I'll go with AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H — hmm, but "no additional execution privileges needed" suggests PR:N. But
Apache ZooKeeper quorum TLS peers running in FIPS mode can skip hostname verification, so a certificate whose SAN does not match the connected host is still accepted, letting a rogue peer join quorum traffic, participate in leader election, and enter replication flows. The flaw affects org.apache.zookeeper:zookeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5, but only in deployments where sslQuorum=true, zookeeper.fips-mode=true, and both ssl.quorum.hostnameVerification and ssl.quorum.clientHostnameVerification are enabled. Exploitation additionally requires the attacker to hold a certificate issued by a CA the cluster already trusts, making this a misissuance or CA-compromise scenario rather than a generic remote attack; no public exploit code or CISA KEV entry was identified at time of analysis, and fixes are released in 3.8.7 and 3.9.6.
An out-of-bounds read in the App object handling of pdfforge's PDF Architect allows an attacker to execute arbitrary code in the context of the current process when a victim opens a crafted PDF or visits a malicious page. The flaw is a user-interaction-dependent memory-safety bug (CWE-125) driven by missing validation of user-supplied data, reported through the Zero Day Initiative as ZDI-CAN-28570. No public exploit code and no CISA KEV listing are present in the available intelligence, and EPSS data was not supplied, so the current risk is driven mainly by the 7.8 CVSS base score and the file-parsing attack surface rather than by observed in-the-wild activity.
Denial of service in the tftp-hpa in.tftpd remap engine allows a remote, unauthenticated attacker to crash the TFTP daemon with a single crafted request: when an inverse remap rule also aborts with a non-empty custom error message, invalid regex match offsets are passed into genmatchstring(), producing out-of-bounds reads and writes. The flaw affects tftp-hpa as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, but is only reachable when the daemon is launched with a remap (map-file) configuration containing such a rule, so default installations with no remap file do not exercise the vulnerable code path. At time of analysis there was no public exploit identified and no CISA KEV listing; CVSS rates the issue 7.5 with availability-only impact.
MCPVault, a lightweight Model Context Protocol server that exposes Obsidian vault files to AI agents, fails to block access to restricted directories such as .git, .obsidian, and node_modules in versions prior to 0.11.4. PathFilter compiles its deny-list patterns case-sensitively and matches raw path segments, so on case-insensitive macOS and Windows filesystems variants like .Git/config or .GIT/config (and on Windows, trailing-dot/space forms such as .git./config) pass both isAllowed() and isAllowedForListing() while the operating system still opens the real restricted directory. An attacker who can influence a path selected by an AI agent can then read, write, move, search, or list sensitive repository and Obsidian metadata; no public exploit code or CISA KEV entry was identified at time of analysis.
Information tampering in Dell Wyse Management Suite (WMS) releases prior to 2605.0.3.683 is possible because the console omits a required cryptographic step (CWE-325), allowing an attacker who already holds a high-privileged WMS account to defeat integrity protections on data or artifacts the suite handles. The flaw is remotely reachable but constrained by PR:H and AC:H, making it a post-compromise or privileged-insider vector rather than an unauthenticated remote takeover. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the intelligence feed.
IBM Security Verify Identity Access (formerly Security Verify Access) ships a reverse proxy component that, in certain configurations, performs weaker-than-expected cryptographic validation of user-supplied data. A remote, unauthenticated attacker (CVSS 3.1 AV:N/PR:N/UI:N) can therefore submit crafted data that is improperly validated, exposing protected resources and sensitive identity information; the impact is confidentiality-only (C:H/I:N/A:N) with a base score of 7.5. No CISA KEV entry and no public exploit code were identified at time of analysis, and IBM has published a vendor fix. Affected lines are Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and Security Verify Access / Security Verify Access Container 10.0.0 through 10.0.9.2 Interim Fix 001.
We need to produce JSON. Let's synthesize. CVE-2026-12355: IBM MQ JNDI injection due to insufficient input validation, CWE-74 (injection, specifically neutralization of special elements... CWE-74 is Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). JNDI injection → potentially log4shell-like JNDI lookup. IBM MQ has JNDI support in JMS administration? Actually IBM MQ has JNDI naming context support for JMS, and also IBM MQ's "MQ Explorer" or "JMS" client could do JNDI lookups. Insufficient input validation allowing JNDI injection. CVSS: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.1. No KEV, no EPSS given, no POC given. Patch available from vendor (IBM support page). Product name: "IBM MQ" (2 words). Prevalence: high (widely-deployed enterprise messaging middleware). Summary: original synthesis, start with impact verb/product. "JNDI injection in IBM MQ ..." Hmm, must not copy description. Start with specific impact verb and product. E.g., "Unauthenticated remote attackers can trigger JNDI lookups in IBM MQ 9.1 through 10.0 by sending crafted input that is insufficiently validated, potentially leading to remote code execution or disclosure of sensitive configuration data." Must not start with "A vulnerability". Good. Exploitation status: no KEV, no POC → "no public exploit identified at time of analysis". Technical context: IBM MQ is enterprise message-oriented middleware; JNDI is Java Naming and Directory Interface used by JMS clients to look up connection factories and destinations; JNDI injection occurs when attacker-controlled data is passed to a JNDI lookup (e.g., InitialContext.lookup) causing the server to fetch a remote object from an attacker-controlled LDAP/RMI/COBRA endpoint, leading to deserialization/RCE — analogous to Log4Shell. Root cause CWE-74: improper neutralization of special elements that are interpreted by a downstream Java component. Affected CPE cpe:2.3:a:ibm:mq:* — all versions up to 10.0.0.
We need answer JSON only. Need synthesize. Need obey all rules. Need use data: CVE-2026-77972, Slab safeurl, Elixir library? Product name: safeurl? Vendor slab? Description TOCTOU race in Slab safeurl allows attacker controlling hostname DNS responses to reach internal destinations validation rejected. Affects safeurl from 0.1.0 onward. CVSS 4.0 vector given: AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N. CWE-367. Tags: Information Disclosure, Safeurl. references. Patch commit feabbd0... maybe initial commit? Wait diff shows initial commit adding LICENSE README lib safeurl.ex, no fix? Actually source code evidence from commit feabbd... maybe the fix commit? It adds initial files? Maybe commit is initial? EUVD affected versions safeurl feabbd0a13...<* and 0.1.0<*. Weird: "safeurl feabbd0a13f83028ab24b71710526e9da9841f70 <*" maybe from? They list commit as affected? Need parse. Affected versions EUVD: ["safeurl feabbd0a13f83028ab24b71710526e9da9841f70 <*", "safeurl 0.1.0 <*"] maybe means affected commit feabbd0 and before? Not sure. No patch available info in input? References include github commit diff. Could be fix or vulnerable code. The commit diff appears to be initial creation. Potential no fix? Need assess patch. Input has no explicit patch availability/source? We have references: cveorg, osv, github commit. There is no Patch section. We can infer patch status from commit? The diff shows adding README/LICENSE/lib/safeurl.ex. Could be the fix commit? But diff includes no changes to validation? Actually initial commit? The description says validation returns verdict and not address approved, HTTP clients receive original hostname and resolve second time. The fix likely should return validated URL/address to HTTP client. But commit diff is initial commit adding code that has the flaw, not fix. The reference may be to vulnerable commit? EUVD affected versions "safeurl feabbd0a13f83028ab24b71710526e9da9841f70 <*" suggests commit is vulnerable? They say affe
Credential leakage in Tornado's CurlAsyncHTTPClient (all releases through 6.5.6) lets sensitive per-request state — client TLS certificates (SSLCERT/SSLKEY) and proxy basic-auth credentials (PROXYUSERPWD) — persist on pooled pycurl handles and be presented to a different, unintended host on a later request. The flaw affects applications that pass per-request credentials to the curl-backed client and reuse the same client instance across hosts; it is not reachable by an anonymous internet attacker against a default server deployment, and the vendor rates attack complexity as high with attack requirements present. No public exploit code has been identified at time of analysis and no active exploitation is reported; the vendor has fixed the issue in Tornado 6.5.7.
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint, so any authenticated user holding only read-only membership in a project can read the credential that is supposed to be reserved for the link itself. Because that hash can be exchanged for a link-share JWT carrying the share's own permission level, the disclosure becomes a privilege-escalation primitive: if the leaked share was created with write or admin rights, the attacker inherits them and can modify tasks, projects, or administrative settings. The issue is fixed in 2.6.0 per the vendor advisory, and no CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence at time of analysis.
Oracle Report Manager, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP. The flaw sits in the Internal Operations component and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity, and availability for the Report Manager component with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data, but the low privilege bar and network reachability make this a strong candidate for post-authentication lateral movement inside an EBS environment.
Oracle Sales Online, a module of Oracle E-Business Suite, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP; the flaw sits in the 'Internal Operations' component and is rated 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with high confidentiality, integrity and availability impact across versions 12.2.3 through 12.2.15. Exploitation needs no user interaction and no elevated privileges, only a valid low-privilege login, making any internet- or partner-facing EBS deployment with this module enabled a realistic target. No public exploit code and no CISA KEV listing were identified at time of analysis, so the immediate driver is exposure and patch lag rather than observed in-the-wild activity.
Oracle Report Manager — the reporting and output-management product within Oracle E-Business Suite — can be taken over by an attacker who already holds a low-privileged account on the same instance and can reach the application tier over HTTPS. Affected releases are E-Business Suite 12.2.3 through 12.2.15, covering a very long-lived branch of the ERP platform (per the EUVD record and Oracle's Critical Security Patch Update advisory). Successful exploitation yields full read, write and denial-of-service impact on the Report Manager component (CVSS 3.1 base 8.8: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no EPSS score, CISA KEV entry, or public proof-of-concept is present in the supplied intelligence, so exploitation status should be treated as unconfirmed.
Oracle Alert, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be taken over by an attacker holding only a low-privileged account with HTTP access to the application. Because the flaw sits in the Internal Operations component and requires no user interaction, any valid low-privilege EBS user can reach it and obtain full read/write control over Alert data and functionality, with high confidentiality, integrity and availability impact (CVSS 8.8). There is currently no public exploit code or confirmed in-the-wild exploitation (no CISA KEV listing), but Oracle's out-of-band Critical Security Patch Update is the only authoritative fix, and internet-exposed EBS deployments should treat the missing authentication boundary as the primary risk.
A low-privileged, network-reachable flaw in the Internal Operations component of Oracle User Management (part of Oracle E-Business Suite 12.2.6 through 12.2.15) lets an attacker who already holds a valid low-privileged account take full control of the User Management module. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N), effectively amounting to a takeover of the user-provisioning and authorization layer of the ERP. No public exploit code and no CISA KEV listing were identified at time of analysis, so this should be treated as a patch-now, high-severity issue rather than a confirmed active campaign.
Local privilege escalation in Oracle E-Business Suite's Applications DBA (AD Utilities) lets any attacker holding a valid low-privileged logon on the tier where AD Utilities executes take complete control of the component, with full confidentiality, integrity and availability impact on the affected schemas and utilities. Only versions 12.2.3 through 12.2.15 are affected, and exploitation requires prior host access rather than reachability over the network, so the realistic threat is an insider, a compromised application-tier service account, or a post-exploitation escalation step. No public exploit code was identified and the flaw is not listed as confirmed actively exploited (CISA KEV), so risk is driven by the value of the EBS environment and who already holds a login on that infrastructure.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Applications DBA (AD Utilities) component that lets a high-privileged attacker with network access over HTTP take full control of the Applications DBA subsystem. According to Oracle's advisory language the issue is 'easily exploitable,' meaning low attack complexity once the required privileges are held, and successful exploitation delivers high confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). No public exploit code or CISA KEV entry is present in the supplied intelligence, so exploitation appears limited to attackers who already hold an Applications DBA-level account rather than remote unauthenticated adversaries.
Oracle Quality, a module of Oracle E-Business Suite, contains a difficult-to-exploit flaw in its Internal Operations component affecting versions 12.2.3 through 12.2.15, allowing a low-privileged attacker with network access via HTTP to take over the module with full confidentiality, integrity and availability impact. Oracle's own advisory rates it CVSS 7.5 with attack complexity High and privileges required Low, meaning an attacker must already hold a valid low-privilege account but can reach the vulnerable code remotely over HTTP. No public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not supplied in the intelligence feed, so real-world exploitation likelihood cannot be quantified from that signal.
Oracle Lease and Finance Management, a finance module within Oracle E-Business Suite, can be fully taken over by a high-privileged user who sends crafted HTTP requests to its Internal Operations component in versions 12.2.7 through 12.2.15. Successful exploitation yields complete loss of confidentiality, integrity and availability for the module (CVSS 3.1 base 7.2), meaning an attacker could read and alter lease, financing and contract data and disrupt related business processes. The attack is rated easy to perform once the required privileged account and network path exist, but exploitation is gated behind high privileges, and no public exploit code or CISA KEV listing was identified at the time of analysis.
We need answer JSON only. Need synthesize. We have CVE-2026-83107 Oracle Forms component Forms Services, C/S, Charmode. Affected 12.2.1.19.0, 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker network via HTTP to compromise Oracle Forms. Scope change significant impact additional products. Successful attacks result in takeover Oracle Forms. CVSS 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. ENISA EUVD. Reference oracle security alert cspusep2026 (critical patch update?). Need produce fields. Need be careful: Description from Oracle says "high privileged attacker with network access via HTTP" PR:H. But "easily exploitable" AC:L. Impact CIA high, scope changed. Vulnerability type not specified; tags says Information Disclosure. Could be some vulnerability in Forms Services C/S Charmode. Need not invent CWE. Need infer root cause? We don't have CWE. Technical context: Oracle Forms part of Fusion Middleware, used for building enterprise apps, web-deployed Java applets? Forms Services, C/S client/server charmode. Need explain. CPE data? Input lacks CPE strings? It says CPE strings in prompt but no CPE lines. Could use affected versions. No CWE. We can say CWE not provided; root cause class unknown, but Oracle tag info disclosure suggests potentially discloses sensitive data leading to takeover? Wait CVSS says C/I/A high and scope change. With high priv attacker. Possibly a deserialization? But no. We must not infer beyond data. We can note CWE missing. Need risk assessment. CVSS 9.1 but PR:H reduces; EPSS missing, KEV? no KEV provided, POC no. Need state "no public exploit identified at time of analysis"; "KEV status not provided; not listed? Actually no KEV field; we can only say no KEV listing in provided data, but absence not confirmation? We can state "Active exploitation not indicated in provided data; no CISA KEV status provided" maybe. Need not overclaim. Multi-source includes ENISA EUVD. Refere
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 can be fully taken over by a low-privileged, network-positioned attacker who reaches Forms Services over HTTP. Oracle rates the flaw difficult to exploit (AC:H) but complete in impact, with high confidentiality, integrity and availability loss once triggered. No public exploit code has been identified and the issue is not listed in CISA KEV, so current risk is driven by the value of Forms-based business applications rather than by observed exploitation.
We need answer JSON only. Need analyze. Need adhere. We have CVE Oracle Forms. Need fields. Let's inspect input. CVE-2026-83105 Description: Vulnerability in Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions affected 12.2.1.19.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. While vulnerability in Oracle Forms, attacks may significantly impact additional products (scope change). Successful attacks can result in takeover of Oracle Forms. CVSS 9.0 vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle Reported by Oracle. References Oracle advisory and NVD. EPSS? Not provided. KEV? Not provided. POC? not. Patch availability? Advisory likely. We can infer Oracle critical patch update. Need patch exact version? Input doesn't specify fixed version. EUVD affected versions. No explicit fixed version. Patch available per advisory. We must not invent version. CVSS vector provided. Need product_name: "Oracle Forms" (1-3 words). Summary: not copy description. Start with impact verb and product. Need mention unauthenticated network HTTP, difficult exploit, takeover, scope change. POC none, no KEV. EPSS unknown/missing. Must not claim active. We can say "Difficult-to-exploit remote takeover affects Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 through the Forms Services/C/S/Charmode component. An unauthenticated attacker with HTTP access can compromise Oracle Forms and potentially adjacent systems due to scope change. No public exploit or active exploitation is identified; the high CVSS is tempered by AC:H." Need technical_context: underlying technology Oracle Forms part Fusion Middleware; Forms Services, C/S, Charmode; network via HTTP; root cause unknown because CWE N/A. Mention CPE? No CPE strings provided in input. Can't invent. We can state CPE not provided. Technical context: "Oracle Forms is a long
We need answer JSON only. Need analyze. We have CVE. Need produce fields. Let's inspect data. CVE-2026-83103 Oracle Forms product Oracle Fusion Middleware component Forms Services, C/S, Charmode. Versions 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Forms. Scope change; takeover of Oracle Forms; CVSS 3.1 Base 9.1 vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. No CWE. Reported by Oracle. EUVD. References oracle security alerts cspusep2026. Need synthesize. Need product_name: Oracle Forms. Summary original synthesis not paraphrase description. Mention high privilege HTTP, takeover, scope change, no KEV/POC? Input no KEV/POC/EPSS? We need use all data. Since no KEV, no EPSS given. CVSS 9.1. Need risk. technical_context: Oracle Forms part Fusion Middleware, C/S/charmode? CWE N/A. CPE? Actually input no CPE strings shown except EUVD versions and "CPE strings"? Prompt says use CPE data but none present maybe in input absent. We can say no CPE provided. Affected products include versions. Remdiation: Vendor advisory exact maybe patch. References oracle advisory, likely patch available. But no exact patch version. Use "Patch available per vendor advisory" since vendor advisory likely. Need be cautious: absence exact fix. Oracle Critical Patch Update? URL cspusep2026 likely Critical Patch Update for Oracle Supply Chain? But no patch version. Remediation: refer to Oracle security alert, apply patch for Oracle Forms 12.2.1.19.0/14.1.2.0.0; monitor. Need no bullet. Exploit scenario: high privileged attacker via HTTP, compromised account, exploit Forms services, pivot due scope change to other products? Actually scope change affects additional products; takeover Oracle Forms. Need attack chain maybe 3-5 steps. Since high priv, network HTTP; Attack chain: Authenticate with high privileges → Send crafted HTTP request to Forms Services → Exploit flaw
Unauthenticated remote attackers able to reach the Oracle Forms Services HTTP listener can fully compromise Oracle Forms deployments in Oracle Fusion Middleware 12.2.1.19.0 and 14.1.2.0.0, gaining complete control of confidentiality, integrity and availability of the affected service (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N). The flaw resides in the Forms Services, C/S and Charmode component set and is described by Oracle as difficult to exploit, meaning success depends on specific timing or state conditions rather than a trivial one-shot request. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the current exploitation signal is theoretical rather than confirmed in the wild.
Oracle Spares Management, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by a low-privileged attacker who holds a valid account and can reach the application over HTTP. The Internal Operations component fails to properly restrict access, so a single crafted request yields high impact to confidentiality, integrity and availability of the module (CVSS 3.1 base 8.8). No public exploit code or CISA KEV entry has been identified at time of analysis, but because the flaw is trivially automatable and unauthenticated patching windows are absent, Oracle's Critical Security Patch Update should be applied without delay.
Low-privileged authenticated access to Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 is sufficient to fully compromise the platform through a flaw in the Siebel Cloud Manager component that is reachable over HTTP. Successful exploitation produces complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), effectively handing the attacker the application and the data it manages rather than merely leaking records. No public exploit code or CISA KEV listing is associated with CVE-2026-83086 at time of analysis, and no EPSS value was supplied, so prioritization rests on the severity of the flaw and the fact that the affected code sits in a cloud-management plane rather than an end-user feature.
We need to produce JSON. Let's analyze the CVE. CVE-2026-83082: Oracle Marketing, Oracle E-Business Suite, component Audience. Affected versions 12.2.3–12.2.15. CVSS 3.1 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. High privileged attacker with network access via HTTP → takeover of Oracle Marketing. Tagged "Information Disclosure, Oracle". CWE N/A. No EPSS, no KEV, no POC info. Patch: reference to Oracle security alert cspusep2026.html — likely includes patch. Oracle CPU style. So "Patch available per vendor advisory" — actually we can say Oracle typically releases patches via the Security Alert; but we don't have exact version. The reference is an Oracle security advisory page. We can say "Vendor advisory published (Oracle Security Alert); apply the corresponding CPU patch" — but careful not to invent version numbers. The reference URL is the patch/advisory link. Editorial note: use "zabrze" once in risk_assessment only. product_name: "Oracle Marketing" (1-3 words). summary: original synthesis. Not starting with "A vulnerability". Start with impact verb and product. E.g. "High-privileged remote attackers can fully take over Oracle Marketing (part of Oracle E-Business Suite 12.2.3 through 12.2.15)..." Mention PR:H authenticated. Mention CVSS 7.2, no KEV, no public exploit identified. But careful — auth: CVSS vector has PR:H → authenticated (high privileges). So we can state "authenticated high-privileged attacker". Also "network access via HTTP". technical_context: Oracle E-Business Suite Marketing module, Audience component. CWE N/A. Talk about Oracle EBS architecture: mid-tier Oracle HTTP Server / Apache, forms-based and OAF (Oracle Applications Framework) pages, database tier. Audience component handles marketing lists/segments. Root cause unknown (CWE N/A) — likely improper access control/privilege management allowing privilege escalation beyond intended role. Mention that Oracle CPUs typically don't disclose root cause until patch. risk_assessment: CVSS 7.2,
Oracle Banking Branch versions 14.5.0.0.0 through 14.9.0.0.0 can be taken over by a low-privileged attacker who already holds a valid account and can reach the application over HTTP, provided a second user is lured into interacting with crafted content in the Reports component. Oracle rates this 7.1 (AV:N/AC:H/PR:L/UI:R) with high confidentiality, integrity and availability impact, meaning full compromise of the branch platform rather than mere data leakage. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a high-severity but not yet actively exploited issue requiring patching on the Oracle Critical Security Patch Update cycle.
Oracle Fusion Middleware Control — the Enterprise Manager-style administration console bundled with Oracle Fusion Middleware — is vulnerable in the Framework component of versions 12.2.1.4.0 and 14.1.2.0.0, allowing a low-privileged user who can reach the console over HTTP to fully compromise it (CVSS 8.8, C:H/I:H/A:H), effectively achieving takeover of the management console itself. Because the console is the administrative nerve center for the middleware stack, a takeover grants a foothold with very broad downstream authority. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Full takeover of Oracle WebCenter Portal 14.1.2.0.0 is achievable by an unauthenticated attacker who can reach the server from an adjacent network segment, though Oracle rates the flaw as difficult to exploit (AC:H) given its CVSS 3.1 score of 7.5 with high confidentiality, integrity and availability impact. The vulnerability sits in the Runtime Tools component of Oracle Fusion Middleware and requires the attacker to already have access to the physical communication segment attached to the host running WebCenter Portal, so internet-facing exposure alone is not sufficient. No public exploit code, EPSS score, or CISA KEV listing was provided in the source data, so active exploitation is currently unconfirmed; Oracle published the fix via its September 2026 Critical Patch Update advisory.
We need answer JSON per instructions. Need synthesize. Must use all data. Need careful obey precision rules. We have CVE description Oracle WebCenter Portal, versions 12.2.1.4.0 and 14.1.2.0.0. CVSS 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. References Oracle security alert. No KEV, no POC, no EPSS, patch availability? Not explicitly stated. Need infer patch available? Oracle security alert likely includes patch? The reference is "cspusep2026" maybe Critical Patch Update Security? Product. Need not invent exact fix version? We don't have exact patch version. We can say Patch available per vendor advisory? Since reference is Oracle security alert likely provides fix? We need use patch availability from input. Not provided except Oracle advisory. Description says supported versions affected. Oracle critical patch update likely patch available. But precision: if patch data says available but no version -> "Patch available per vendor advisory". We can use that? Need maybe from vendor advisory. We have ref [nvd] (None) https://www.oracle.com/security-alerts/cspusep2026.html. It is an advisory. No exact fix version. So patch available per vendor advisory. But the input did not state patch available explicitly; Oracle security alert typically includes remediation. Could infer from advisory. Need maybe in remediation cite advisory URL, state apply Oracle CPU, upgrade to patched versions? But exact version unknown. Need not invent. Could say "Oracle's security alert is the authoritative advisory; apply the recommended patches or upgrade per the advisory, since exact patched versions not provided in this data." Need maybe ask vendor. But likely Oracle CPU provides fixed versions: for WebCenter Portal maybe 12.2.1.4.0 and 14.1.2.0.0? Actually Oracle patch sets often provide patches for supported versions, not upgrade version. So "patch available per vendor advisory." Need product_name: "Oracle WebCenter Portal" (3 words). Good. Su
High-privileged attackers who already hold administrative-level LDAP credentials can fully take over the OID LDAP Server component of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 by sending crafted requests over the network. Oracle rates this 7.2 on the CVSS 3.1 scale (AV:N/AC:L/PR:H/UI:N, C/I/A all High), meaning a single low-complexity action against a reachable LDAP listener yields complete loss of confidentiality, integrity, and availability for the directory service. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the high privilege prerequisite (PR:H) substantially narrows the realistic attacker set to insiders, compromised directory administrators, or attackers who have already escalated elsewhere in the environment.
We need answer JSON only. Need synthesize. Let's parse input. CVE-2026-83058: Oracle Internet Directory product of Oracle Fusion Middleware component OID LDAP Server. Supported versions affected 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable allows low privileged attacker with network access via LDAP to compromise OID. While vulnerability in OID, attacks may significantly impact additional products (scope change). Successful attacks can result in takeover of OID. CVSS 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. Hmm description says takeover, C/I/A high, not info disclosure? Could be tag mislabeled? Maybe Oracle advisory says info disclosure? But description says takeover. CWE N/A. EUVD. References oracle advisory and nvd. EPSS not provided, KEV no, POC no, patch availability? No explicit patch data in input. Need include patch status. "Patch available per vendor advisory"? Oracle advisory likely contains fix. But no exact version given. The affected versions listed, likely patches exist? We can say "Vendor advisory likely contains patch; specific fix version not provided in input" maybe. Need remediation with advisory URL. Need output fields all strings. product_name: "Oracle Internet Directory" 3 words? Oracle Internet Directory = 3 words. Fine. summary: original synthesis. Mention remote code? Actually takeover through LDAP. Low privileged attacker network via LDAP. Impact high triads scope change. Need say actively exploited? KEV no. "no public exploit identified at time of analysis". EPSS not provided, so no EPSS risk mention. POC unknown. We can mention CVSS 9.9. "Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 contains an easily exploitable LDAP Server vulnerability that allows a low-privileged network-based attacker to take over the directory service and significantly impact additional products due to scope change. Successful attacks compromise confidentiality, integrity, and availability. No active exploitatio
We need answer as JSON only. Need synthesize. Need be careful with fields. We have CVE description. Need product_name: Oracle Internet Directory. summary original synthesis. technical_context. risk_assessment. affected_products. remediation. exploit_scenario. exploitation_conditions. attack_chain. confidence_notes. data_quality_flags. prevalence. prevalence_basis. assessed_cvss_vector. assessed_cvss_rationale. assessed_cvss40_vector. Need consider input tags: Information Disclosure, Oracle. Is "Information Disclosure" mislabeled? Vulnerability is takeover with C/I/A impacts, not just info disclosure. However tags might be from source. We can flag mislabeled_tag? Need think. The tag "Information Disclosure" likely wrong because CVSS C/I/A H and "takeover" indicates full compromise, not info disclosure. But maybe vulnerability class? CWE N/A. Description says low priv via LDAP to compromise, scope change, takeover. Not primarily info disclosure. So mislabeled_tag: Information Disclosure target exact wrong value, suggested maybe "authentication bypass"? But tags are platform/technique? We need not overflag if not clear. But data quality flags: We can flag mislabeled_tag "Information Disclosure" if clearly wrong. Suggested could be "remote-code-execution"? Is that a valid tag? Need maybe "takeover" not standard. But data quality flags precision: each item type mislabeled_tag, target the tag value, suggested correct/canonical slug if know it, else null, confidence high/medium/low, reason. If not sure, can omit. However tags include Oracle, which is vendor, correct. "Information Disclosure" seems not sufficient for full compromise. Could flag with medium/high confidence. But system says only emit if highly confident and verifiable. We have CVSS says C/I/A all high, takeover. Information Disclosure is not the vulnerability impact; but it might be a tag from CVE record? Could be mislabeled. Let's consider. The vulnerability is in Oracle Internet Directory LDAP server, low-
We need answer JSON only. Need comply. We need synthesize. CVE-2026-83056 Oracle Internet Directory, OID LDAP Server. CVSS 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. KEV absent? Input no KEV, no EPSS, no POC, tags Information Disclosure, Oracle. CWE N/A. Patch? References advisory. Need produce fields. Need be careful: product_name 1-3 words. "Oracle Internet Directory". summary not copy. Need mention CVSS, low priv network via LDAP, scope change takeover. No KEV/POC. Since no KEV, no POC, "no public exploit identified at time of analysis". EPSS not provided, mention EPSS data not provided. Technical context include OID LDAP server in Fusion Middleware, LDAP protocol, CWE unavailable but root cause unknown; CPE? Input no CPE strings except EUVD versions. Need mention CPE not provided maybe. Risk assessment use all signals, SSVC? Need include tczew once in risk_assessment only. Need ensure lowercase "tczew". Use naturally. "Despite the lack of EPSS/POC/KEV data, a mid-sized municipal IT team in tczew running Oracle Internet Directory should treat this as urgent..." Need avoid factual claim? It is hypothetical illustrative reference. OK. Affected products: versions 12.2.1.4.0 and 14.1.2.1.0, Oracle Fusion Middleware, component OID LDAP Server. Vendor advisory URL. CPE absent? Could mention no CPE provided. Remediation: Oracle advisory cspusep2026. Need exact patch? Input patch data absent. Don't invent exact version. "Patch available per vendor advisory" if refs advisory. Could say "Apply Oracle Critical Patch Update for September 2026? Wait CVE ID 2026-83056, advisory cspusep2026 likely July? The URL cspusep2026.html maybe October? Oracle uses cpusep2026? Hmm cspusep2026 maybe not. Need not infer. Input references Oracle security-alerts/cspusep2026. Could say "Vendor-released patch per Oracle security alert (cspusep2026); exact fixed version not specified in this input." Safe. Need "Vendor-released patch: ..." if exact unavailable. Use "Patch available per ven
We need answer JSON only. Need parse. Need follow user. We need synthesize. Let's inspect input. CVE-2026-83055 description Oracle Internet Directory product of Oracle Fusion Middleware component OID LDAP Server. Supported versions affected 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise OID. Scope change. Successful attacks result in takeover. CVSS 3.1 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Reported by Oracle. Tags: Information Disclosure, Oracle. EUVD. References: nvd None? Actually URL Oracle security alert cspusep2026.html. No KEV, no EPSS, no POC, no patch availability? We need infer. We need return fields all strings except data_quality_flags array? User says every field plain text string not array? But data_quality_flags says JSON array. Wait critical: "Every field below MUST be a plain text string — NOT an array, NOT an object..." but data_quality_flags is "JSON array". Conflict. The general says return JSON object with these fields and data_quality_flags is array. We should output data_quality_flags as array (allowed). All other fields strings. Need follow. Need produce analysis. Need be careful: patch status? No patch data field? There is no input patch. But references point to Oracle advisory. Likely patch available; maybe exact versions 12.2.1.4.0 and 14.1.2.1.0 are affected, Oracle advisory likely includes fixes but not provided. We cannot invent exact fixed versions. Use "Patch available per vendor advisory" perhaps. Remediation: apply Oracle Critical Patch Update? The URL cspusep2026 suggests maybe April 2026? Oracle CPU? Need not invent exact patch number? Could mention vendor advisory. We can say update to patched versions per Oracle Security Alert; reference URL. But no exact fix version. Need not invented. Need product_name: "Oracle Internet Directory" 3 words? Oracle Internet Directory = 3. Good. Summary: 2-3 sentences original. Start with i
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain an easily exploitable flaw in the Runtime Tools component that lets any authenticated low-privileged user reach the portal over HTTP and take full control of the application (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity, and availability impact). An attacker only needs a valid low-privilege account and network reachability to the portal — no user interaction and no elevated privileges are required. Oracle has published a Critical Security Patch Update (cspusep2026) covering the issue; there is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is currently assessed as opportunistic rather than confirmed in the wild.
We need answer JSON only. Need synthesize. We have CVE-2026-83043 Oracle WebCenter Portal Composer. Description is standard Oracle. CVSS 9.6 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Tags "Information Disclosure, Oracle". No CWE. EPSS not provided. KEV not provided. Patch? References Oracle security alert likely patch available? Input patch data not explicit except vendor advisory. Need infer? We have affected versions. Need fields. Need follow rules. product_name: "Oracle WebCenter Portal". summary: not copy description. Need start impact verb and product. Mention easily exploitable, unauthenticated network attacker, human interaction. No EPSS/KEV/POC data: no public exploit identified at time of analysis. No KEV. CVSS 9.6. High. Need mention scope change. technical_context: underlying Oracle WebCenter Portal Composer component, Oracle Fusion Middleware. CPE? Not provided. CWE N/A. Need explain likely web portal composition feature, HTTP. Root cause unknown CWE not assigned. Mention affected versions. risk_assessment: Use CVSS vector: network, low complexity, no privileges, user interaction, scope changed, C/I/A high = 9.6. EPSS missing, KEV absent, POC unknown. SSVC: no exploitation evidence, automatable maybe yes via network? User interaction required, technically impact total. Need compare. State missing EPSS. "No KEV, no POC, no EPSS — CVSS high but real-world risk uncertain." Need not claim active. Data missing. affected_products: Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0. EUVD lists same. Vendor advisory link. No CPE strings. Write paragraph. remediation: Oracle security alert link, apply patches from July 2026? cspusep2026 maybe maybe "Oracle Critical Patch Update"? URL. Need exact fix version unknown. Patch available per vendor advisory. Suggest upgrade to supported patched version? We don't know exact. Could say consult Oracle advisory for patch, restrict network access to WebCenter Portal Composer? Need not invent. Since unauthenticated
We need answer JSON only. Need parse CVE. Need comply with fields. We need synthesize. Need not mention editorial note. Need use all data. Need risk_assessment include "mielec" once lowercase naturally. Let's think carefully. Input: CVE-2026-83040 Description: Vulnerability in Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions affected 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle WebCenter Portal. Successful attacks require human interaction from a person other than attacker and while vulnerability in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks result in takeover of Oracle WebCenter Portal. CVSS 3.1 9.6 C/I/A. Vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. CVSS Score: 9.6 Vector: same CWE: N/A Reported by secalert_us@oracle.com Tags: Information Disclosure, Oracle ENISA EUVD ID Affected versions EUVD: Oracle WebCenter Portal 12.2.1.4.0, 14.1.2.0.0 References nvd None https://www.oracle.com/security-alerts/cspusep2026.html euvd advisory https://nvd.nist.gov/vuln/detail/CVE-2026-83040 Need fields. product_name: "Oracle WebCenter Portal" (3 words? Oracle WebCenter Portal okay). product_name 1-3 words only. "Oracle WebCenter Portal" 3. summary: Original synthesis. Start with specific impact verb and product: e.g. "Remote takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can be achieved by an unauthenticated attacker through SOAP requests when a user interacts." Mention CVSS 9.6, scope change, UI:R, no KEV/POC known. POC? Input has no POC/KEV. EPSS not provided. Use phrases. "No public exploit identified at time of analysis" per rules if neither. Active exploitation? Not KEV. summary should mention no public exploit identified. EPSS risk not notable because missing. Could say "No KEV or POC indicators are present in the available data."
We need answer in JSON only. Need synthesize. We have CVE data. Need fields. Let's parse. CVE: CVE-2026-83039. Product Oracle WebCenter Portal (Oracle Fusion Middleware component Composer). Versions 12.2.1.4.0 and 14.1.2.0.0. Low privileged attacker network HTTP compromise. Scope change, impact C/I/A high. CVSS 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. References: Oracle security alert cspusep2026, NVD link. Reported by Oracle. No CWE. No KEV, no EPSS, no POC. Patch? No explicit patch availability. Oracle security alert likely contains patch. Need use data provided. "Patch availability" not provided. We should maybe infer patch available per vendor advisory? But input doesn't include patch data. Need careful: Patch status most specific: input doesn't include exact fix version; references include Oracle advisory. We can say patch available per vendor advisory? Actually we have reference to Oracle security alert, no exact version provided. Patch status can be "Patch available per vendor advisory" if patch refs imply. But do we know? The Oracle advisory likely includes patch. Need not invent exact fix version. We'll state "Patch available per vendor advisory" maybe. But remediation "apply Oracle July 2026 CPU? cspusep2026 maybe January? Actually cspusep2026 likely Critical Patch Update Security? The URL oracle.com/security-alerts/cspusep2026.html. Could be "Critical Security Patch Update - September 2026"? No cspusep? Hmm. We can cite advisory URL. Don't invent date. "Oracle Critical Patch Update advisory at ..." but actual reference title (None). Could be "Oracle Security Alert CVE". We'll cite exact URL. Need every field string. data_quality_flags array? The prompt says return JSON object, data_quality_flags JSON array. So that field is an array, okay. Other fields strings plain. Need product_name 1-3 words: "Oracle WebCenter Portal" (3 words). Summary: original synthesis. Must not copy description. Need start with impact
We need answer JSON only. Need synthesize. We have CVE-2026-83038 Oracle WebLogic Server TopLink Integration. Need all fields plain strings. Need careful with exploitation status: no KEV provided, no POC provided? Input has no KEV, no POC. So "no public exploit identified at time of analysis". CVSS provided PR:L so authenticated low privileged. Patch availability? References include Oracle security alert. No exact patch version. The description says supported versions affected. Need remediation cite advisory URL. Could say vendor patch likely available via Oracle CPU, but patch data not explicit? "Patch available per vendor advisory" if references indicate; likely yes. Need not invent fix version. Use "Patch available per vendor advisory" because Oracle security alert. Could also cite advisory URL. Affected products list with versions. Need product_name: Oracle WebLogic Server. Summary original. Technical_context: TopLink Integration, Oracle Fusion Middleware, HTTP, CWE N/A but root cause unspecified, likely deserialization? Don't infer CWE. Use CVSS scope change. CPE? Not provided directly, but EUVD affected versions. Need include "No CPE strings provided; affected versions ..." maybe in affected. Risk assessment: Use CVSS, EPSS absent, KEV no, POC no, SSVC. Need compare. Add tczew in risk_assessment only exactly lowercase. Must be ordinary prose. Maybe: "From a real-world triage standpoint, even a mid-sized municipal IT team in tczew should treat this as urgent if they run affected WebLogic versions, because the score reflects a high-impact, network-reachable, low-privilege compromise with scope change; however, EPSS and KEV data are absent, so exploitation in the wild is not confirmed." Need exactly tczew once. That's okay. But need "use lowercase word 'tczew' once" yes. Could be weird but okay. Need exploit_scenario: low privileged attacker with network HTTP, compromise server. Mention POC not identified. Exploitation_conditions: Concrete prerequisites. The
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw that lets a low-privileged, authenticated attacker reach the application over HTTP and gain complete control of the WebCenter Sites instance, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). Because the flaw is rated 'easily exploitable' and requires no user interaction, any organization exposing a WebCenter Sites deployment to a network where attackers can hold even a basic account should treat this as a high priority. There is no evidence of active exploitation (not in CISA KEV), and no public proof-of-concept has been identified at time of analysis; exploitation status is therefore unconfirmed, and Oracle's patch is delivered through the October-2026-cycle Critical Security Patch Update referenced by NVD.
A low-privileged authenticated attacker with HTTP network access can fully compromise Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0, resulting in complete takeover of the application with high confidentiality, integrity, and availability impact. Oracle rates this 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the attack requires no user interaction, making it remotely exploitable by anyone holding a basic account. No public exploit code, EPSS score, or CISA KEV listing was present in the provided intelligence, so active exploitation is not confirmed at time of analysis.
We need answer as JSON only. Need synthesize. Need be careful with fields. Let's inspect input. CVE-2026-83031 description Oracle WebCenter Sites product. Reported by Oracle. Tags: Information Disclosure, Oracle. ENISA EUVD. Affected versions. Reference Oracle security alert cspusep2026. CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CWE N/A. No KEV, no POC, no patch data explicitly. Need use data. Need fields all strings except data_quality_flags array. product_name 1-3 words: Oracle WebCenter Sites. summary original. technical_context. risk_assessment must compare signals; mention missing KEV/EPSS/POC. affected_products. remediation: no exact fix version? Oracle advisory likely says fix? Actually provided reference is Oracle security alert cspusep2026. Description says supported versions affected. We don't have exact patch version. Need patch status: no exact fix? We have no patch availability in input. But reference is Oracle advisory likely contains patches, but we cannot know exact version. Need phrase: patch available per vendor advisory? Perhaps reference to Oracle CPU. We can say "Oracle security alert cspusep2026" likely contains remediation; but no exact patch version in provided data. In remediation, cite advisory URL. Avoid invent versions. Need risk_assessment: CVSS 9.9, low privileged network HTTP, scope change, CI/A high. EPSS not provided, KEV not provided, POC unknown. Need state missing. SSVC? use decision framework: exploited? no KEV, POC unknown; automatable likely yes based CVSS AC:L PR:L UI:N; technical impact total; priority maybe high. But no KEV/POC/EPSS. "This is a critical Oracle product vulnerability with low-privilege network exploitation and scope change; while CVSS is severe, real-world priority is tempered by lack of KEV/EPSS/POC data." Need compare. EPSS missing. "No EPSS probability available — cannot assess actual exploitation likelihood." We can say CVSS indicates network vector, low complexity, low privileges, no user interactio
Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can be completely taken over by an unauthenticated attacker who has obtained a position on the same physical or adjacent network segment as the connector host. The defect lives in the Core component and is rated difficult to exploit (AC:H), yet a successful attack yields full confidentiality, integrity and availability loss with no credentials and no user interaction required. No public exploit code or CISA KEV entry has been identified at time of analysis, but the connector's role in identity provisioning and directory synchronization makes it a strategically attractive target.
Unauthenticated attackers who can reach the network segment adjacent to a host running the Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) can fully take over the connector, with confidentiality, integrity and availability all rated High and the impact explicitly extending to additional, connected products through a scope change. Exploitation is rated difficult (AC:H) and requires physical adjacency to the hardware hosting the connector, but needs no credentials and no user interaction. Oracle has published this as part of its Critical Patch Update; no public exploit code and no CISA KEV entry were identified at time of analysis.
Local privilege abuse in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 lets an attacker who already holds a low-privileged logon on the host running the connector seize full control of the connector, with high confidentiality, integrity and availability impact (CVSS 7.8). The flaw sits in the Core component of the Fusion Middleware connector and requires local logon, not
Adjacent-network attackers can fully compromise Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 through a flaw in the product's Client Bundle component, achieving high confidentiality, integrity and availability impact plus a scope change onto connected products. The attack is unauthenticated but difficult to pull off, requiring high attack complexity and a separate user's interaction, which means it is only reachable from the physical/L2 communication segment attached to the hardware running the capture service. No public exploit code and no CISA KEV listing were identified at time of analysis, so the practical risk is bounded by the constrained attack vector rather than by the severity score alone.
Local, low-privileged compromise of the SQR component in Oracle PeopleSoft Enterprise PeopleTools 8.61–8.63 lets an attacker who already holds a logon to the host where PeopleTools runs take full control of the PeopleTools instance, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8). The flaw is rated easily exploitable once host access exists (AC:L, PR:L, UI:N), but the AV:L vector means it is not remotely reachable from the network without some foothold on the target infrastructure. The provided intelligence contains no EPSS score, no CISA KEV listing and no public exploit reference, so no public exploit was identified at time of analysis, though the code-execution outcome makes this a high-value post-compromise escalation path.
Low-privileged attackers with network access to the HTTP interface of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Report Distribution component to achieve full takeover of the PeopleTools application, with high impact to confidentiality, integrity, and availability. Oracle rates the issue 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), characterizing it as easily exploitable because it needs only a basic authenticated account and no user interaction. No public proof-of-concept or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can be fully taken over through a flaw in its SQR component, but only by an attacker who already holds a high-privileged logon on the host where PeopleTools runs and who can persuade another user to perform an interaction. Oracle rates it 7.2 because a successful attack is difficult to execute yet delivers complete loss of confidentiality, integrity and availability, and because the compromise can spill over into connected products (scope change). No public exploit code is identified and there is no CISA KEV entry, so the issue is a defensive hardening priority rather than an observed campaign.
Local takeover of Oracle PeopleSoft Enterprise PeopleTools (Cube Manager component) is possible for a low-privileged user who can log on to the infrastructure hosting the product, affecting versions 8.61 through 8.63. Oracle scores this 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a difficult-to-exploit but fully compromising flaw that yields high confidentiality, integrity and availability impact on the PeopleTools instance itself. No public exploit code or CISA KEV listing was identified at time of analysis, so the immediate threat is limited to actors who already hold a valid low-privileged account and interactive access to the PeopleSoft application tier.
Low-privileged network attackers can fully take over Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 by exploiting a flaw in the Client Bundle component of Oracle Fusion Middleware, with high confidentiality, integrity, and availability impact. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction, but requires an authenticated low-privileged account (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N). No CISA KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so active exploitation is not confirmed and the practical threat is currently tied to the likelihood of an attacker obtaining a valid low-privilege account.
Unauthenticated remote attackers with HTTP access to Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware can achieve full takeover of the service by exploiting a flaw in the bundled Centralized Thirdparty Jars component. Only versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected by Oracle's advisory. The flaw carries a CVSS 3.1 base score of 8.1 with a High attack complexity rating, and no public exploit code or CISA KEV entry has been identified at time of analysis, so real-world exploitation appears opportunistic rather than widespread.
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Client Bundle component that a low-privileged, network-positioned attacker can leverage to take over the affected application, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8). Exploitation requires only a low-privileged account and HTTP access to the product — no user interaction and no elevated privileges — making it a serious risk for internet- or broadly reachable deployments. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis, and no EPSS score was provided, so active exploitation is unconfirmed.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by an attacker who holds only a low-privileged account but can reach the product's T3 and IIOP network listeners, as described in Oracle's Critical Patch Update advisory. Because the flaw is rated AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8), a single authenticated foothold is enough to gain control of the capture application rather than just read data from it. At the time of analysis there is no CISA KEV listing and no public exploit code identified; EPSS data was not supplied, so exploitation likelihood cannot be quantified.
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by a low-privileged attacker who can reach the product over HTTP, with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw sits in the Client Bundle component of the Oracle Fusion Middleware product and is described by Oracle as easily exploitable, meaning no unusual conditions or user interaction are needed beyond a valid low-privilege account. No public exploit code, EPSS score or CISA KEV listing was present in the provided intelligence, so active exploitation is unconfirmed at time of analysis.
Full takeover of Oracle Access Manager is achievable by a low-privileged, network-positioned attacker who can reach the product's HTTP Authentication Engine, affecting supported versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware. The flaw requires valid low-privilege credentials (PR:L) and is rated hard to exploit (AC:H), but its scope-change rating means a successful attack against OAM can cascade into the downstream applications that rely on it for single sign-on. As of analysis, no public exploit code and no CISA KEV listing were identified, and the input contained no EPSS score, so real-world exploitation pressure is unquantified despite the 8.5 base score.
We need answer JSON only. Need synthesize. Need obey all rules. Let's inspect input. CVE ID CVE-2026-83001. Description Oracle Access Manager product of Oracle Fusion Middleware component Authentication Engine. Supported versions affected 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Access Manager. While vuln in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks result in takeover of Oracle Access Manager. CVSS 3.1 9.1 vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Reported by Oracle. Tags Information Disclosure, Oracle. EUVD. References Oracle advisory. Need produce fields. Need be careful product_name "Oracle Access Manager" 3 words? Oracle Access Manager = 3. Good. Summary: Need original, no "A vulnerability". Start with impact verb and product. E.g. "High-privileged remote attackers can fully compromise Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 via the Authentication Engine..." Mention CVSS 9.1, scope change, no KEV no POC. Since KEV absent, POC absent. EPSS absent. Need note no public exploit identified at time of analysis. "allows high privileged attacker with network access via HTTP to take over" maybe. Must not copy description. Also mention CVSS. Need make plain. technical_context: Underlying tech Oracle Access Manager authentication engine in Fusion Middleware. CPE data? Input doesn't include CPE strings, only affected versions. Need use EUVD affected versions. CWE N/A, so root cause class unknown. State that no CWE provided; root cause not specified in available data. That is okay. risk_assessment: Need use CVSS vector. AV:N, AC:L, PR:H, UI:N, S:C, C/H/I/H. EPSS missing, KEV no? Input has no KEV field, only references. Must maybe assume no KEV? Use "not listed in CISA KEV in provided data"; "no EPSS score provided". POC none. SSVC: exploitation status? No public exploit identified. Au
We need answer JSON only. Need analyze. Let's inspect input. CVE-2026-82999 Oracle Fusion Middleware Service Delivery Platform component Messaging Enabler. Affected 12.2.1.4.0 and 14.1.2.0.0. CVSS 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Description says easily exploitable low priv network HTTP to compromise, scope change, result takeover. Tags: Information Disclosure, Oracle. EUVD. References oracle advisory. Need produce fields. Need product_name: "Service Delivery Platform" perhaps Oracle Fusion Middleware Service Delivery Platform. 1-3 words: "Oracle Service Delivery Platform"? Product specifically "Service Delivery Platform" of Oracle Fusion Middleware. Maybe "Oracle Service Delivery Platform" 3 words. Need summary original not paraphrase. Start impact verb product. Example "Remote takeover of Oracle Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 allows..." Need include what vuln? Description vague: vulnerability in Messaging Enabler. Tags Information Disclosure, but CVSS C/I/A high and takeover. Contradiction? Tags says Information Disclosure but impact is full CIA maybe due scope? Need mention perhaps tag indicates info disclosure but CVSS says total compromise. Need use all data. KEV? Not in input, so no KEV. POC? none. EPSS? None. Patch availability? References advisory likely patch? Oracle CPU. We can infer patch available? Input patch data not explicitly. References oracle security alert. Need remediation cite Oracle advisory but no exact patch version? Affected versions; Oracle fixed perhaps next CPU. Need be cautious: "Patch available per vendor advisory" if advisory? But input references oracle security-alerts/cspusep2026.html. That is vendor advisory. We can say apply Oracle Critical Patch Update referenced; exact patched versions not included, verify. Need include "Vendor-released patch: exact version not provided" maybe patch status phrase. Use "Patch available per vendor advisory". In remediation: apply Oracle CPU 2026? Advisory URL. Me
We need answer JSON only. Need synthesize. We need comply. Let's parse. CVE-2026-82998 Oracle Fusion Middleware Service Delivery Platform component Messaging Enabler. Supported versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable low priv network via T3, IIOP. Scope change. Takeover. CVSS 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Tags Information Disclosure, Oracle. References Oracle advisory and NVD. KEV? Not provided, likely no. POC not provided. Patch availability? Not explicitly but advisory likely patch. Need infer from data. No KEV. Need product_name "Service Delivery Platform". summary original synthesis, not copy, not start with prohibited. Need mention low-priv network via T3/IIOP, takeover, scope change, no active exploitation identified. technical context: Oracle Fusion Middleware, T3/IIOP protocols, SDP Messaging Enabler. CWE N/A, root cause not specified. Use CPE data? Not provided, use affected versions. risk_assessment: use CVSS, EPSS unknown? no EPSS provided. KEV absent. POC unknown. SSVC? Need assess. Mention conflicting/missing: CVSS indicates network vector low priv, but tag information disclosure vs full compromise mismatch; CWE missing; patch details not specified. Include "olsztyn" once naturally as illustrative. Maybe: "For an operator with unsegmented middleware, even a mid-sized municipal IT team in olsztyn should treat this as urgent..." Need ensure ordinary prose not factual. Could mention "high CVSS, low complexity, low priv, scope changed => critical; but no KEV or EPSS or public POC, exploit availability unknown." That satisfies. affected_products paragraph with versions and advisory URLs. remediation: Oracle CPU? The advisory URL likely Oracle Critical Patch Update? Need cite. Primary fix patch/upgrade to later CPU. Since exact fix version not in input. We can say Patch available per Oracle advisory, apply Oracle Critical Patch Update for April 2026? The URL cspusep2026 maybe? Need not invent exact version. "Vendor-re
We need answer JSON only. Need synthesize. Let's inspect input. CVE-2026-82997. Description from Oracle. Product: Service Delivery Platform, Oracle Fusion Middleware. Component Messaging Enabler. Versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable low priv network via T3, IIOP compromise SDP, scope change, takeover. CVSS 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. CWE N/A. References only Oracle advisory. Reported secalert. ENISA EUVD. Need produce fields. Product_name "Service Delivery Platform" maybe "Oracle Service Delivery Platform" 3 words? "Oracle Service Delivery Platform" is 3? Oracle, Service, Delivery, Platform = 4 words. Specific product: Service Delivery Platform. Could use "Oracle Service Delivery Platform" but 4 words. Rule 1-3 words ONLY. "Service Delivery Platform" 3 words. Good. Summary: Start with impact verb and product. Need not copy description. Example: "Remote takeover of Oracle Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 via T3/IIOP allows low-privileged attackers..." Mention KEV? not listed. POC? not listed. EPSS not provided. Use no public exploit identified. CVSS 9.9 critical. Scope change. Need technical_context: Underlying technology: Oracle Fusion Middleware Service Delivery Platform, Messaging Enabler component, T3 and IIOP protocols. T3 is Oracle WebLogic's proprietary RMI protocol? IIOP CORBA. CPE data? There is no CPE list in input. We can reference versions. CWE N/A. Root cause class unknown because CWE N/A; but description implies insecure deserialization or access control? We must not invent. State CWE not assigned. Could say vulnerability class not specified; network protocols T3/IIOP exposed. Educational. Risk assessment: Use signals. CVSS base 9.9 with AV:N, AC:L, PR:L, UI:N, S:C, C/I/A H. EPSS missing. KEV absent. POC unknown. SSVC? Exploitation status none, automatable maybe yes, technical impact total. Compare high CVSS but no known exploitation? We can say high sever
Local privilege escalation in the Installation component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets any low-privileged user who can log on to the host running Siebel CRM Deployment to fully compromise that deployment. Because the flaw is reachable through the local attack surface with no user interaction and yields complete loss of confidentiality, integrity and availability, an attacker with an otherwise ordinary account can effectively take over the CRM environment. No public exploit code or in-the-wild exploitation is identified in the available intelligence at time of analysis, and the vendor advisory from Oracle is the sole reference for affected versions and fixes.
Adjacent-network attackers can crash HPE Networking EdgeConnect SD-WAN Gateways or leak small amounts of uninitialized stack memory by sending crafted traffic to the gateway, affecting unauthenticated devices reachable from the same Layer 2 segment. The flaw (CWE-200) carries a 7.1 CVSS score with the availability impact rated High and confidentiality impact Low, and it spans four maintained release trains from 9.4.0.0 through 9.7.0.0. It is not listed in CISA KEV, no public exploit code was identified in the supplied intelligence, and no EPSS probability was provided, so the immediate risk is driven by network adjacency and gateway exposure rather than confirmed mass exploitation.
Authentication controls protecting the web-based management interface of HPE Aruba EdgeConnect SD-WAN Orchestrator can reportedly be circumvented by a remote actor, allowing escalation to administrative privileges and full compromise of the orchestrator host that manages the SD-WAN fabric. Reported affected releases span EdgeConnect SD-WAN software 9.4.0 through 9.7.0, with no fix version disclosed in the supplied source data. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so exploitation status is best treated as unconfirmed.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways, where a flaw in the appliance's underlying operating system lets a network-reachable attacker crash or stall an affected service. All four maintained branches are impacted — 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0 — with CVSS 7.5 reflecting a high availability impact and no confidentiality or integrity loss. No public exploit code and no CISA KEV listing were present in the source data at time of analysis, so this is currently a patch-now availability risk rather than a confirmed active campaign.
Unauthenticated remote attackers can circumvent the authentication controls exposed by the API of HPE Networking EdgeConnect SD-WAN Orchestrator, escalating to administrative privileges and achieving complete compromise of the orchestrator host. The vendor rates this 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), and EUVD maps the affected code lines to EdgeConnect SD-WAN releases 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0. No CISA KEV listing or public exploit code was identified in the supplied intelligence, and EPSS data was not provided, so the practical exploitation risk rests on the high attack complexity (AC:H) noted in the vendor vector.
Incorrect authorization in the EdgeConnect SD-WAN Orchestrator API lets an authenticated remote user with low privileges retrieve sensitive information beyond what their role permits, and that data can potentially be leveraged to reach the SD-WAN network services the orchestrator manages. The vendor HPE/Aruba rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and ENISA EUVD lists affected EdgeConnect SD-WAN Gateway releases in the 9.4.x, 9.5.x, 9.6.x and 9.7.0 lines. No public exploit code exists and the issue is not in CISA KEV at time of analysis; exploitation requires valid low-privilege credentials, which materially narrows the attacker population.
We need answer JSON only. Need analyze. Let's inspect input: CVE-2026-76673. Description: vulnerabilities in API of EdgeConnect SD-WAN Orchestrator allow unauthenticated remote actor circumvent auth, gain admin privileges complete compromise. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure. Reported by HPE. Affected versions EUVD: EdgeConnect SD-WAN Gateways 9.6.0 ≤9.6.3, 9.5.0 ≤9.5.8, 9.4.0 ≤9.4.10, 9.7.0 ≤9.7.0. References HPE advisory hpesbnw05135en_us and NVD link. Need synthesize. Product name: EdgeConnect SD-WAN Orchestrator? But affected versions listed as Gateways. primary product maybe "EdgeConnect SD-WAN Orchestrator". It says vulnerabilities in API of Orchestrator, but affected versions EUVD say Gateways. Need maybe product_name "EdgeConnect SD-WAN Orchestrator" as specific. The affected products paragraph should mention gateways versions? Could be perhaps HPE Aruba Networking EdgeConnect SD-WAN Orchestrator, gateways? Need be cautious. Need produce fields plain strings. Data quality flags maybe issues: tags "Information Disclosure" but vulnerability is auth bypass/privilege escalation, not info disclosure. Could flag mislabeled_tag maybe "Information Disclosure" target exact, suggested maybe "authentication-bypass" or "privilege-escalation"? Need determine tag type. Input tags: Information Disclosure. That's a technique/impact tag. The CVE is authentication bypass leading to admin compromise. Is that mislabeled? Likely yes. Could flag type mislabeled_tag target "Information Disclosure" suggested "authentication-bypass" confidence high? Let's see our rules: For mislabeled_tag target exact wrong value. We can flag. Suggested lower-case hyphenated slug. "authentication-bypass" maybe. But if the system may have tag taxonomy? The described vuln is circumvent authentication controls. Could suggest "authentication-bypass". Also maybe "privilege-escalation". But one flag enough? "missing_tag" for authentication-bypass? Since
We need answer JSON only, no markdown. Need synthesize. Let's parse input. CVE-2026-76672. Description: vulnerability in SD-WAN Orchestrator may lead exposure sensitive config info. Auth remote attacker with read-only privileges exploit by specially crafted request to cache synchronization endpoint. Success disclosure sensitive third-party API tokens and credentials, lateral movement to external security platforms. CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L, CWE N/A. Reported by security-alert@hpe.com. Tags: Information Disclosure. ENISA. Affected versions EUVD: ["EdgeConnect SD-WAN Gateways 9.7.0 ≤9.7.0", "EdgeConnect SD-WAN Gateways 9.4.0 ≤9.4.10", "EdgeConnect SD-WAN Gateways 9.6.0 ≤9.6.3", "EdgeConnect SD-WAN Gateways 9.5.0 ≤9.5.8"]. References nvd None, support.hpe advisory. Need product_name: "EdgeConnect SD-WAN Orchestrator" or "HPE EdgeConnect SD-WAN Orchestrator"? Specific product. Affected versions mention Gateways, description says SD-WAN Orchestrator. Product name maybe "EdgeConnect SD-WAN Orchestrator". Use 1-3 words only: "EdgeConnect SD-WAN Orchestrator" (3 words? EdgeConnect is one, SD-WAN maybe? But 1-3 words okay). Could include HPE? "HPE EdgeConnect SD-WAN" maybe. But product_name should specific. Let's use "HPE EdgeConnect SD-WAN Orchestrator" maybe 4 words? Words: HPE, EdgeConnect, SD-WAN, Orchestrator = 4. Rule 1-3 words ONLY. Use "EdgeConnect Orchestrator" (2 words) or "SD-WAN Orchestrator". But product maybe HPE Aruba EdgeConnect SD-WAN Orchestrator. The affected versions say EdgeConnect SD-WAN Gateways but vuln is Orchestrator. Need choose primary: "EdgeConnect SD-WAN Orchestrator". That's 3 if hyphen? They count words by spaces: EdgeConnect, SD-WAN, Orchestrator = 3. Good. Summary: Original synthesis not copy. Must mention actively exploited? KEV not provided, so no KEV. POC no. EPSS absent. Need mention if no public exploit identified? We can include "no public exploit identified at time of analysis". Also CVSS 9.9 critical
In Oracle Siebel CRM's Marketing module (Siebel Apps - Marketing), supported versions 17.0 through 26.7 expose a network-reachable HTTP flaw that a high-privileged user can leverage to seize full control of the Marketing application, impacting confidentiality, integrity and availability alike (CVSS 3.1 base 7.2). The issue is rated easily exploitable (AC:L) but is gated behind privileged credentials (PR:H), and no user interaction is needed once such access exists. No CISA KEV entry, public exploit code, or EPSS score was supplied with the source data, so active exploitation is unconfirmed at time of analysis.
Unauthenticated network attackers can achieve full takeover of Oracle Access Manager via a difficult-to-trigger flaw in the Authentication Engine component of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this CVSS 3.1 8.1 with High confidentiality, integrity, and availability impact from a network vector requiring no privileges or user interaction, meaning the identity service itself — and the applications it protects — can be fully compromised. No public exploit code and no CISA KEV entry were identified at time of analysis; the AC:H rating indicates the attack requires precise timing or a specific non-default state rather than a trivial repeatable request.
We need answer JSON. Need produce fields. Need comply with editorial note: in risk_assessment only, use lowercase "gliwice" once naturally. Need not mention note. Need all fields plain text strings except data_quality_flags array. Need product_name 1-3 words. CVE is Oracle PeopleSoft Enterprise PeopleTools. Product name maybe "PeopleSoft PeopleTools" (3? PeopleSoft Enterprise? 2-3). Use "PeopleSoft PeopleTools". Summary original synthesis not copy. Need note KEV? Input no KEV/POC. EPSS none. CVSS 8.1 AV:N AC:H PR:N UI:N S:U C:H I:H A:H. CWE N/A. Tags: Information Disclosure, Oracle. Description says component Business Interlink, supported versions 8.61-8.63. Difficult to exploit unauthenticated network via HTTP, takeover. CVSS AC:H. We need assess. No patch data? References only Oracle advisory. Need patch status? Input doesn't state patch. Oracle CPU typically includes patches. Reference is Oracle security alert cspusep2026.html. Need not invent fix version. We can say Vendor advisory available via Oracle Critical Patch Update/Security Alert; apply latest CPU patches. Exact fix version not provided in input. But Oracle advisories usually include patches, not exact version. We can state "No vendor-released patch version confirmed from provided data; Oracle advisory referenced..." However if in remediation, "Apply the fix from Oracle's advisory." Need cautious. Need technical_context: Oracle PeopleSoft Enterprise PeopleTools Business Interlink component. PeopleTools is development/runtime framework, Business Interlink maybe integration component. CWE N/A. Difficult to exploit AC:H, unauth via HTTP. Potential impact full takeover. Explain protocol HTTP. Use CPE not provided. "No CPE strings supplied; affected versions from description 8.61-8.63." Risk_assessment: Use all signals. CVSS 8.1 high; AC:H lowers exploitability; PR:N; UI:N; S:U; C/I/A high. No EPSS, no KEV, no POC. SSVC? Exploitation none, automatable? AC:H maybe no? Technical impact total. State uncertain
Unauthenticated attackers with network access to the HTTP interface of Oracle WebCenter Portal's Portlet Services component can exploit a hard-to-trigger flaw to fully compromise the application, per Oracle's Critical Security Patch Update (cspusep2026). Impact spans confidentiality, integrity and availability (CVSS 8.1), with the stated outcome being complete takeover of WebCenter Portal. Only supported versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected; no public exploit code or CISA KEV entry was present in the supplied intelligence, and the high attack-complexity metric (AC:H) suggests exploitation requires specific, non-trivial conditions rather than a simple one-shot request.
Authenticated low-privileged users can fully take over Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 by sending crafted HTTP requests to the Portlet Services component. Oracle's Critical Security Patch Update rates this 8.8 with complete loss of confidentiality, integrity and availability of the portal, meaning an attacker with any valid low-privilege account can seize control of the application. No public exploit code or CISA KEV listing is known at time of analysis, so exploitation is currently limited to attackers who already hold credentials, though the low attack complexity makes weaponization plausible once a proof of concept surfaces.
We need answer JSON only. Need synthesize CVE-2026-73948 Oracle WebCenter Portal. Need ensure all fields strings, data_quality_flags array maybe empty or flags. Need follow precision rules. We have data: Description vulnerability in Oracle WebCenter Portal product of Oracle Fusion Middleware component Composer. Supported versions affected 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While vulnerability in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Reported by secalert_us@oracle.com. Tags: Information Disclosure, Oracle. ENISA EUVD ID EUVD-2026-79302. Affected versions EUVD. References Oracle advisory and NVD. No EPSS / KEV / POC / patch data explicitly. Need state no public exploit identified. Need maybe infer from Oracle quarterly CPU. Need product_name 1-3 words: "Oracle WebCenter Portal". Summary: critical takeover. Mention low-priv network HTTP, scope change. Not copy description. Need mention no KEV/POC? Input has none. Could say no public exploit identified at time of analysis, EPSS not provided. But summary 2-3 sentences, mention actively exploited? No KEV so no. Need likely original synthesis. Technical_context: underlying technology: Oracle WebCenter Portal, component Composer. CPE? Not provided as CPE strings, only affected versions. We can say no CPE strings provided. CWE missing N/A. Explain root cause class unknown; "Composer" likely page composer functionality. Need educational, be specific but don't invent root cause. Tags include Information Disclosure but CVSS high C/I/A and takeover; tag may be mislabeled? Need perhaps data quality flag? Tags: "Information Disclosure, Oracle" — Description says takeover, C/I/A high, not information disclosure. But vulnerabili
We need answer JSON only. Need synthesize. Need be careful: input has CVE, description, CVSS. Tags: Information Disclosure, Oracle. References Oracle advisory. No KEV/POC/EPSS in prompt? We need use all data. No EPSS, no KEV, no patch? Need infer patch maybe Oracle CPU? The reference URL is likely Oracle Critical Patch Update. Need product name "Oracle Access Manager". Summary original, not paraphrase. Need mention no public exploit identified at time of analysis. Need CVSS vector provided AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. High privileged attacker with network via HTTP. Scope change. Easily exploitable. Result takeover of Oracle Access Manager. CWE N/A. Tags include Information Disclosure but CVSS says C/I/A high? Maybe conflicting. Need mention tag mismatch perhaps in data_quality_flags? Tags: "Information Disclosure, Oracle". Vulnerability description says takeover (C/I/A), so Information Disclosure tag may be mislabeled? But we must be highly confident. It could be Oracle advisory lists component as Authentication Engine; CVSS impacts C/I/A high, not just information disclosure. Tag "Information Disclosure" might be miscategorized? Need maybe flag mislabeled_tag target "Information Disclosure", suggested maybe "authentication-bypass"? But CWE N/A, description not detail. Could flag low/medium. However data_quality_flags must be concrete wrong verifiable. "Information Disclosure" tag on a CVE with CVSS C/I/A H seems likely mislabeled, but not verifiable from references? Need maybe not flag, or flag as missing? Let's follow rules: only highly confident. The tag "Information Disclosure" is maybe wrong because description says takeover; but tags may reflect underlying vuln? Not enough. We can mention in confidence_notes or risk? The prompt says use all data, tags. We can note tags say Information Disclosure but description indicates full compromise; however flag? Maybe not unless clearly wrong. But maybe "Information Disclosure" is contradictory. Let's consider.
We need answer JSON only. Need synthesize. Let's inspect input. CVE-2026-73945 Oracle Access Manager. Description from Oracle. CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. EUVD affected versions: OAM 14.1.2.1.0, 12.2.1.4.0. References: Oracle security alert cspusep2026, NVD link. CWE N/A. No KEV, EPSS, POC, patch availability? Input lacks KEV etc. Need obey: every field string. Need product_name "Oracle Access Manager" (3 words). summary original, no copy. Need mention no KEV, no POC identified, EPSS absent. "Remote code? takeover". Vulnerability in Authentication Engine allows low privileged network HTTP attacker to take over Oracle Access Manager with scope change impacting additional products. We cannot say RCE? Result takeover, C/I/A high. We'll say "Compromise of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 via Authentication Engine enables a low-privileged network attacker over HTTP to take over the product and significantly impact adjacent systems due to scope change. No public exploit or CISA KEV entry was present in the provided intelligence; EPSS data was not available." That complies. technical_context: Oracle Fusion Middleware Oracle Access Manager, authentication engine. CWE N/A. Identify affected products from CPE? No CPE strings provided, but EUVD versions. Need mention CWE not provided, root cause class unknown/inferred. Must use CPE data? Input doesn't have CPE, say no CPE provided. Product component Authentication Engine. Scope change implies vulnerable component exposes/influences other system components. CVSS PR:L authenticated low privilege. HTTP. risk_assessment: Use CVSS vector. EPSS not provided, KEV no, POC no. No patch availability specified? Wait input says nothing about patch? Reference advisory. Oracle security alert likely patch. The affected versions are supported. Need maybe patch available? We cannot assert exact fix version. Input has only affected versions. The Oracle advisory URL but no
Low-privileged attackers with network access can achieve full takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 through a flaw in the OIM Legacy UI component of Oracle Fusion Middleware. Successful exploitation compromises confidentiality, integrity, and availability of the identity platform itself, which typically means control over the accounts, roles, and provisioning workflows it governs. The vulnerability is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N), requires only an authenticated low-privilege session, and no public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
We need answer JSON object. Need synthesize. Must obey. Need extract data. Let's parse input. CVE-2026-73458. Description: On affected platforms running Arista EOS with authenticated BFD sessions configured, specially crafted packet can cause BFD sessions to go down. May result in undesirable network changes because routing protocols monitor BFD status. CVSS Score 9.2, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H... CWE-303. Reported by psirt@arista.com. Tags: Information Disclosure. ENISA ID. Affected versions EUVD: EOS 4.36.0 ≤4.36.1F, 4.33.0 ≤4.33.8M, 4.35.0 ≤4.35.5M, 4.34.0 ≤4.34.7M. References: arista advisory and nvd. No KEV, no POC, no EPSS given. Patch availability not explicitly but advisory likely patch? Need not invent. Need maybe references include advisory. Need fields. product_name: "Arista EOS" (1-3 words). Good. summary: Original synthesis. Must not copy/paraphrase description. Start with specific impact verb and product, e.g. "Denial of service in Arista EOS BFD..." Mention affected versions, authenticated BFD sessions configured, specially crafted packet causes BFD sessions down, routing protocols depending on BFD may reconverge. Mention no KEV/POC/EPSS? Summary needs mention if actively exploited, if POC exists, and EPSS risk if notable. There is no KEV, no POC, EPSS not provided. State no public exploit identified at time of analysis, EPSS not available. Need careful: "On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, ..." We can start with "Denial of service in Arista EOS 4.33.0 through 4.36.1F..." and not "A vulnerability". Do not say "allows remote code execution", it's availability impact. Need influence routing, availability. Summary: "Denial of service in Arista EOS 4.33.0 through 4.36.1F can drop authenticated BFD sessions when an unauthenticated remote attacker sends a specially crafted packet; because BFD down state is monitored by routi
Full takeover of Oracle Identity Manager is achievable by any low-privileged authenticated user who can reach the application's HTTP interface in versions 12.2.1.4.0 and 14.1.2.1.0 (Oracle Fusion Middleware, Core component). The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), meaning a single authenticated request chain can hand an attacker administrative control over the identity governance platform. No CISA KEV listing, EPSS score, or public proof-of-concept was supplied in the source data, so exploitation status is currently unconfirmed and no public exploit has been identified at time of analysis.
Oracle Identity Manager (OIM), the identity-governance component of Oracle Fusion Middleware, is exposed to a takeover-level flaw in its Core component affecting versions 12.2.1.4.0 and 14.1.2.1.0. An attacker who holds a low-privileged account and can reach the T3 or IIOP listener over the network can exploit the defect to fully compromise the OIM deployment, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). No public exploit code or CISA KEV entry was present in the supplied intelligence, and the accompanying 'Information Disclosure' tag understates the reported impact — the vector's C/I/A metrics are all High.
Remote unauthenticated denial of service in the libp2p-quic transport crate (Rust implementation of libp2p) prior to 0.13.1: a peer that completes a valid-looking QUIC/TLS handshake with a deliberately short-lived libp2p TLS certificate and then withholds the final TLS 1.3 handshake fragment until that certificate expires triggers a wall-clock validity re-check in the post-handshake upgrade path, where an `expect()` call panics and tears down the application hosting the QUIC listener. Only a single inbound connection from a network peer is needed, no malformed packets are required, and the attack is fully automatable against any service exposing an affected libp2p-quic listener. The flaw is an uncaught exception (CWE-248) and is fixed in 0.13.1; no public exploit code and no CISA KEV listing were identified at time of analysis, though the GHSA advisory publishes a precise reproduction recipe.
The Apache Airflow FAB provider (apache-airflow-providers-fab) before 3.9.0 fails to validate the issuer and audience claims of id_tokens presented to its Authentik OAuth login path, so any token that the same Authentik deployment minted for a different client application is accepted by Airflow and authenticates the attacker as the user named in that token. Only deployments running the FAB auth manager with Authentik OAuth against an Authentik instance that also serves other applications are affected — the attacker needs a valid token for one of those other apps, not for Airflow itself. This is a follow-up to CVE-2026-75156, which fixed the identical missing-validation flaw on the Azure AD path in the same file while leaving the Authentik path untouched; upgrade to 3.9.0 or later to remediate. No public exploit code or active-exploitation telemetry was provided in the source data.
Authentication bypass in the Apache Airflow Keycloak provider (apache-airflow-providers-keycloak) before 0.10.0 lets an attacker who holds valid client credentials for any unrelated confidential client in a shared Keycloak realm obtain a signed Airflow session JWT. Because the provider's token endpoint does not allowlist client ids, credentials that were never issued for Airflow are silently accepted as Airflow login credentials, and Airflow mints a session token for that third-party application's service account. Access is then limited only by what that service account can reach plus any endpoint gated solely on being authenticated, and the endpoint additionally permits unauthenticated credential guessing against Keycloak under Airflow's identity. No public exploit code or CISA KEV entry was identified at time of analysis; severity is rated moderate by the vendor, with the impact bounded by subject-level resource authorization.
We need to produce JSON. Let me parse the data. CVE-2026-79410: Improper validation of quantity parameter in add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce order total below legitimate price of shippable goods. CVSS: 8.1, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. CWE-20 (Improper Input Validation — note: description says improper validation, matches CWE-20). Tags: Information Disclosure (mislabeled — this is a business logic / price manipulation flaw, integrity impact). Actually the tag "Information Disclosure" is wrong — the impact is integrity (price manipulation) and confidentiality per CVSS C:H/I:H. Hmm, CVSS says C:H too which is odd. But tag "Information Disclosure" is arguably mislabeled given the CWE-20 improper input validation and the described impact. I could flag it as mislabeled_tag with target "Information Disclosure". References: only a GitHub repo (isukasanuj/bagisto-cve). No vendor advisory, no patch refs. ENISA EUVD ID present. Affected versions: Bagisto v2.4.9 (Webkul Bagisto, a Laravel-based open-source e-commerce platform). Prevalence: Bagisto is a relatively niche open-source e-commerce platform (Laravel). I'd say "low" — it's not widely deployed like WooCommerce/Magento. Maybe "low". Basis: "niche open-source Laravel e-commerce platform, limited deployment". Product name: "Bagisto" (1-3 words). Maybe "Webkul Bagisto". Now the fields. summary: Must not start with "A vulnerability". Start with impact verb and product. E.g., "Improper validation of the quantity parameter in Webkul Bagisto v2.4.9's add-to-cart path lets authenticated shoppers drive their order total below the true price of shippable goods..." Mention auth (PR:L = authenticated), no KEV, no POC stated (the reference is a GitHub PoC repo... hmm, github.com/isukasanuj/bagisto-cve/blob/main/CVE-2026-79410.md — that looks like a PoC/advisory repo. That suggests publicly available exploit code might exist. But POC field isn't provided. I
Let me synthesize. CVE-2026-69205: http4s Ember HTTP parser request smuggling via Transfer-Encoding header case-sensitivity and charset decoding issues. Key facts: - http4s Ember (Scala HTTP library), prior to 0.23.35 and 1.0.0-M47 - CWE-444 (Inconsistent Interpretation of HTTP Requests / request smuggling) - CVSS 8.7, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N - No EPSS given, no KEV, no explicit POC. - Patch: 0.23.35 and 1.0.0-M47, commit 5e88b2e7b4e6ea2f0c61040a4bc9de0d73e51217 - Tags: Information Disclosure, Request Smuggling, Http4S Fields to output. Let me write carefully. Product name: "http4s Ember" — 1-3 words. "http4s" is one word. Maybe "http4s Ember". That's fine. Summary: must not start with "A vulnerability". Start with impact. E.g., "HTTP request smuggling in http4s Ember (0.23.x before 0.23.35 and 1.0.0 milestones before M47) allows attackers to desynchronize HTTP/1.1 framing between Ember and intermediary proxies..." Note S:C (scope changed) with C:H/I:H/A:N. Affected products: http4s Ember before 0.23.35, 1.0.0-M47. CPE cpe:2.3:a:http4s:http4s:*:*:*:*:*:*:*:*. Advisories GHSA-9998-894r-fwvr, releases. Remediation: upgrade to 0.23.35 or 1.0.0-M47; the fix decodes header bytes as ISO-8859-1 and rejects any transfer coding token other than "chunked" case-insensitively; workaround: reject/rewrite ambiguous Transfer-Encoding at reverse proxy, strip Transfer-Encoding, disable chunked, use HTTP/2 end-to-end. Note side effects: strict rejection of unknown transfer codings may break clients sending e.g. "gzip, chunked" or "identity" — actually the fix rejects any Transfer-Encoding other than chunked, including "identity"? codings split by ',' and all must equalIgnoreCase("chunked"). So "identity" would be rejected. Side effect: legitimate clients sending multiple codings will get errors. Note Ember is both server and client (ember-client). Response smuggling requires malicious upstream. Exploitation conditions: Requires Ember-based server behind
Unauthenticated order-state tampering in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7) lets anyone mark any order as FAILED without supplying a payment amount, transaction ID, or any other verification data. An attacker can mass-fail pending orders to disrupt revenue, or flip already-fulfilled orders back to FAILED, triggering unwarranted refunds, cancellations, and customer-support load. The CVE carries a CVSS 4.0 score of 8.7 driven entirely by high integrity impact; no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.
Let me synthesize. CVE-2026-56882: Cellular Modem (Android Pixel), information disclosure due to logic error, leading to RCE, no additional execution privileges, no UI. CVSS 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CWE-200 (Exposure of Sensitive Information). Reported by Google_Devices, Pixel bulletin September 2026. Product name: "Android Cellular Modem" — 1-3 words. Maybe "Android Cellular Modem" (3 words). Or "Pixel Cellular Modem". Let's use "Android Cellular Modem". Prevalence: Android is ubiquitous. But cellular modem specifically... The affected component is the cellular modem firmware in Android/Pixel devices. Prevalence of Android = ubiquitous. Hmm. The CPE is google:android. Modem component. I'd say "ubiquitous" given Android base. But the specific modem component... The CPE says google:android, so I'll go with ubiquitous. Actually maybe "high"? Android is on billions of devices — ubiquitous is defensible. Let me say ubiquitous with basis "core platform component across billions of Android devices". Hmm, but cellular modem is only in phones with cellular. Still ubiquitous. Actually, let's be careful — the CPE is google:android which is the whole OS. Cellular modem affects devices with cellular radios = most Android phones. I'll go with ubiquitous. CVSS vector given: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — PR:L is odd for a modem, but that's the input. Note the mismatch: description says "no additional execution privileges needed" but vector says PR:L. That's a conflict to note. My assessed vector: Given it's a modem logic error leading to info disclosure → RCE, remote. I'll assess AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H? Hmm. Let me think. Cellular modem attack — typically over-the-air from a rogue base station or via malicious network. AC:H might be reasonable (requires specific modem state / malformed signaling). But CVSS says AC:L. I'll go with AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H — hmm, but "no additional execution privileges needed" suggests PR:N. But
Apache ZooKeeper quorum TLS peers running in FIPS mode can skip hostname verification, so a certificate whose SAN does not match the connected host is still accepted, letting a rogue peer join quorum traffic, participate in leader election, and enter replication flows. The flaw affects org.apache.zookeeper:zookeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5, but only in deployments where sslQuorum=true, zookeeper.fips-mode=true, and both ssl.quorum.hostnameVerification and ssl.quorum.clientHostnameVerification are enabled. Exploitation additionally requires the attacker to hold a certificate issued by a CA the cluster already trusts, making this a misissuance or CA-compromise scenario rather than a generic remote attack; no public exploit code or CISA KEV entry was identified at time of analysis, and fixes are released in 3.8.7 and 3.9.6.
An out-of-bounds read in the App object handling of pdfforge's PDF Architect allows an attacker to execute arbitrary code in the context of the current process when a victim opens a crafted PDF or visits a malicious page. The flaw is a user-interaction-dependent memory-safety bug (CWE-125) driven by missing validation of user-supplied data, reported through the Zero Day Initiative as ZDI-CAN-28570. No public exploit code and no CISA KEV listing are present in the available intelligence, and EPSS data was not supplied, so the current risk is driven mainly by the 7.8 CVSS base score and the file-parsing attack surface rather than by observed in-the-wild activity.
Denial of service in the tftp-hpa in.tftpd remap engine allows a remote, unauthenticated attacker to crash the TFTP daemon with a single crafted request: when an inverse remap rule also aborts with a non-empty custom error message, invalid regex match offsets are passed into genmatchstring(), producing out-of-bounds reads and writes. The flaw affects tftp-hpa as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, but is only reachable when the daemon is launched with a remap (map-file) configuration containing such a rule, so default installations with no remap file do not exercise the vulnerable code path. At time of analysis there was no public exploit identified and no CISA KEV listing; CVSS rates the issue 7.5 with availability-only impact.
MCPVault, a lightweight Model Context Protocol server that exposes Obsidian vault files to AI agents, fails to block access to restricted directories such as .git, .obsidian, and node_modules in versions prior to 0.11.4. PathFilter compiles its deny-list patterns case-sensitively and matches raw path segments, so on case-insensitive macOS and Windows filesystems variants like .Git/config or .GIT/config (and on Windows, trailing-dot/space forms such as .git./config) pass both isAllowed() and isAllowedForListing() while the operating system still opens the real restricted directory. An attacker who can influence a path selected by an AI agent can then read, write, move, search, or list sensitive repository and Obsidian metadata; no public exploit code or CISA KEV entry was identified at time of analysis.
Information tampering in Dell Wyse Management Suite (WMS) releases prior to 2605.0.3.683 is possible because the console omits a required cryptographic step (CWE-325), allowing an attacker who already holds a high-privileged WMS account to defeat integrity protections on data or artifacts the suite handles. The flaw is remotely reachable but constrained by PR:H and AC:H, making it a post-compromise or privileged-insider vector rather than an unauthenticated remote takeover. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the intelligence feed.
IBM Security Verify Identity Access (formerly Security Verify Access) ships a reverse proxy component that, in certain configurations, performs weaker-than-expected cryptographic validation of user-supplied data. A remote, unauthenticated attacker (CVSS 3.1 AV:N/PR:N/UI:N) can therefore submit crafted data that is improperly validated, exposing protected resources and sensitive identity information; the impact is confidentiality-only (C:H/I:N/A:N) with a base score of 7.5. No CISA KEV entry and no public exploit code were identified at time of analysis, and IBM has published a vendor fix. Affected lines are Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and Security Verify Access / Security Verify Access Container 10.0.0 through 10.0.9.2 Interim Fix 001.
We need to produce JSON. Let's synthesize. CVE-2026-12355: IBM MQ JNDI injection due to insufficient input validation, CWE-74 (injection, specifically neutralization of special elements... CWE-74 is Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). JNDI injection → potentially log4shell-like JNDI lookup. IBM MQ has JNDI support in JMS administration? Actually IBM MQ has JNDI naming context support for JMS, and also IBM MQ's "MQ Explorer" or "JMS" client could do JNDI lookups. Insufficient input validation allowing JNDI injection. CVSS: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.1. No KEV, no EPSS given, no POC given. Patch available from vendor (IBM support page). Product name: "IBM MQ" (2 words). Prevalence: high (widely-deployed enterprise messaging middleware). Summary: original synthesis, start with impact verb/product. "JNDI injection in IBM MQ ..." Hmm, must not copy description. Start with specific impact verb and product. E.g., "Unauthenticated remote attackers can trigger JNDI lookups in IBM MQ 9.1 through 10.0 by sending crafted input that is insufficiently validated, potentially leading to remote code execution or disclosure of sensitive configuration data." Must not start with "A vulnerability". Good. Exploitation status: no KEV, no POC → "no public exploit identified at time of analysis". Technical context: IBM MQ is enterprise message-oriented middleware; JNDI is Java Naming and Directory Interface used by JMS clients to look up connection factories and destinations; JNDI injection occurs when attacker-controlled data is passed to a JNDI lookup (e.g., InitialContext.lookup) causing the server to fetch a remote object from an attacker-controlled LDAP/RMI/COBRA endpoint, leading to deserialization/RCE — analogous to Log4Shell. Root cause CWE-74: improper neutralization of special elements that are interpreted by a downstream Java component. Affected CPE cpe:2.3:a:ibm:mq:* — all versions up to 10.0.0.
We need answer JSON only. Need synthesize. Need obey all rules. Need use data: CVE-2026-77972, Slab safeurl, Elixir library? Product name: safeurl? Vendor slab? Description TOCTOU race in Slab safeurl allows attacker controlling hostname DNS responses to reach internal destinations validation rejected. Affects safeurl from 0.1.0 onward. CVSS 4.0 vector given: AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N. CWE-367. Tags: Information Disclosure, Safeurl. references. Patch commit feabbd0... maybe initial commit? Wait diff shows initial commit adding LICENSE README lib safeurl.ex, no fix? Actually source code evidence from commit feabbd... maybe the fix commit? It adds initial files? Maybe commit is initial? EUVD affected versions safeurl feabbd0a13...<* and 0.1.0<*. Weird: "safeurl feabbd0a13f83028ab24b71710526e9da9841f70 <*" maybe from? They list commit as affected? Need parse. Affected versions EUVD: ["safeurl feabbd0a13f83028ab24b71710526e9da9841f70 <*", "safeurl 0.1.0 <*"] maybe means affected commit feabbd0 and before? Not sure. No patch available info in input? References include github commit diff. Could be fix or vulnerable code. The commit diff appears to be initial creation. Potential no fix? Need assess patch. Input has no explicit patch availability/source? We have references: cveorg, osv, github commit. There is no Patch section. We can infer patch status from commit? The diff shows adding README/LICENSE/lib/safeurl.ex. Could be the fix commit? But diff includes no changes to validation? Actually initial commit? The description says validation returns verdict and not address approved, HTTP clients receive original hostname and resolve second time. The fix likely should return validated URL/address to HTTP client. But commit diff is initial commit adding code that has the flaw, not fix. The reference may be to vulnerable commit? EUVD affected versions "safeurl feabbd0a13f83028ab24b71710526e9da9841f70 <*" suggests commit is vulnerable? They say affe
Credential leakage in Tornado's CurlAsyncHTTPClient (all releases through 6.5.6) lets sensitive per-request state — client TLS certificates (SSLCERT/SSLKEY) and proxy basic-auth credentials (PROXYUSERPWD) — persist on pooled pycurl handles and be presented to a different, unintended host on a later request. The flaw affects applications that pass per-request credentials to the curl-backed client and reuse the same client instance across hosts; it is not reachable by an anonymous internet attacker against a default server deployment, and the vendor rates attack complexity as high with attack requirements present. No public exploit code has been identified at time of analysis and no active exploitation is reported; the vendor has fixed the issue in Tornado 6.5.7.
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint, so any authenticated user holding only read-only membership in a project can read the credential that is supposed to be reserved for the link itself. Because that hash can be exchanged for a link-share JWT carrying the share's own permission level, the disclosure becomes a privilege-escalation primitive: if the leaked share was created with write or admin rights, the attacker inherits them and can modify tasks, projects, or administrative settings. The issue is fixed in 2.6.0 per the vendor advisory, and no CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence at time of analysis.