Java
Monthly
Malformed HTTP/2 CONNECT stream injection in Red Hat JBoss EAP and the wider Red Hat middleware stack (Quarkus, Keycloak, Camel for Spring Boot 4 and Quarkus 3, Data Grid 8, AMQ Broker 7, Fuse 7, Apicurio Registry 3, Debezium 3) lets unauthenticated remote attackers control the :authority of an upstream HTTP/2 CONNECT when the product is deployed as an HTTP/1-to-HTTP/2 translating proxy or gateway. The client-supplied Host header from an HTTP/1 authority-form CONNECT is copied verbatim into the HTTP/2 :authority pseudo-header, so the fronting component and the HTTP/2 backend can disagree about the routing target, yielding an integrity impact (vendor CVSS 3.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N; our assessment raises the attack complexity to High and the scope to Changed because a H1→H2 CONNECT translation path and a fronting-proxy topology are required). No public exploit identified at time of analysis, and no EPSS or CISA KEV data was provided.
Remote unauthenticated attackers can exhaust memory in Netty-based services that parse PROXY protocol v2, due to a reference-count leak in the handling of nested TLVs within HAProxyMessageDecoder, leading to denial of service. The flaw is an incomplete fix of upstream PR #16881, so partially patched deployments may remain vulnerable through the grandchild-TLV code path. It affects numerous Red Hat products bundling Netty, such as JBoss EAP 7, Keycloak, and Quarkus, and no public exploit code has been identified at time of analysis.
Unbounded per-connection queue growth in Netty's WebSocketServerExtensionHandler lets unauthenticated remote attackers exhaust server memory (OutOfMemory) and cause denial of service in Red Hat products that bundle the affected Netty code, including AMQ Broker 7, AMQ Clients, Build of Keycloak, Build of Quarkus, Camel for Spring Boot 4, Camel 4 for Quarkus 3, Data Grid 8, Fuse 7, JBoss EAP 7/8, Single Sign-On 7, Apicurio Registry 3 and Debezium 3. The flaw carries CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - unauthenticated, no user interaction, availability-only) and is reachable only where a Netty-based server exposes a WebSocket endpoint that negotiates protocol extensions such as permessage-deflate to untrusted clients. No public exploit identified at time of analysis, and no CISA KEV listing; impact is confined to availability, with no confidentiality or integrity loss.
Memory exhaustion in Netty's SMTP client response decoder (SmtpResponseDecoder) allows an attacker who controls or can intercept the SMTP server that an application talks to, to force that application to accumulate unlimited multi-line responses until heap is exhausted. The defect is a pure availability issue (C:N/I:N/A:H, CVSS 7.5, AV:N/AC:L/PR:N/UI:N) and is reachable without authentication or user interaction on the victim side, but exploitation is conditional: the vulnerable JVM must have Netty's SMTP client codec active and must establish an SMTP session with a hostile or man-in-the-middle peer, since only server responses are parsed. Shipping products affected through bundled Netty include Red Hat JBoss Enterprise Application Platform 7, Red Hat Fuse 7, Red Hat Single Sign-On 7 and Red Hat Build of Apache Camel for Spring Boot 4; no public exploit code has been identified at time of analysis and there is no confirmed CISA KEV entry.
Heap exhaustion in Netty's Redis array aggregator, as shipped inside Red Hat products such as JBoss Enterprise Application Platform 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, lets a remote unauthenticated attacker crash the JVM by sending a tiny stream of nested RESP array headers. Because the decoder eagerly allocates an ArrayList sized to the declared array length before any child element arrives, roughly 12 KB of crafted input can reserve about 1.02 billion child slots when the default 1024-level nesting limit and default element limit are in effect; the impact is availability-only, with no data read or modified. Exploitation is limited to deployments that feed attacker-reachable, untrusted RESP/Redis-protocol traffic into the Netty codec with the default constructor; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Denial of service in Netty's MQTT decoder lets unauthenticated remote attackers exhaust server memory and CPU by sending a crafted CONNECT packet whose Properties Length is enormous while its Remaining Length stays small, bypassing the maxBytesInMessage guard that was added to fix CVE-2026-44248. The issue affects any Netty pipeline that runs io.netty.handler.codec.mqtt.MqttDecoder and exposes an MQTT listener; downstream Red Hat products such as AMQ Broker 7, Fuse 7, JBoss EAP 7, Red Hat Single Sign-On 7, and Red Hat Build of Apache Camel for Spring Boot 4 are listed as affected. No public exploit has been identified at time of analysis, and the practical risk is bounded by the need to expose an MQTT endpoint.
Cross-origin data exposure in RESTEasy's CorsFilter (CVSS 7.4) occurs when a deployment is configured with allowedOrigins set to the wildcard '*' together with allowCredentials=true, causing the filter to reflect the caller's Origin header back in Access-Control-Allow-Origin alongside Access-Control-Allow-Credentials: true. Because that configuration defeats the browser's built-in guard against combining wildcard origins with credentials, an attacker who lures an already-authenticated user (UI:R) to an attacker-controlled page can issue credentialed cross-origin requests and read that user's authenticated API responses - a confidentiality-only impact (C:H/I:N/A:N), with no integrity or availability effect. The prerequisite wildcard-plus-credentials CORS configuration is a non-default operator choice, and analysis identifies no public exploit identified at time of analysis.
A remote, unauthenticated attacker can exhaust the JVM heap and cause a denial of service by sending a small crafted image to any RESTEasy (JAX-RS) endpoint that consumes an image request body, because the framework's IIOImageProvider decodes the image through ImageIO without validating declared dimensions or pixel count. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a clean, low-complexity, availability-only flaw with no confidentiality or integrity impact, consistent with CWE-409 data amplification. Reachability is the key limiting factor: only applications that actually expose a resource method consuming image content types through the image provider are affected, and no public exploit code was identified at time of analysis.
Memory corruption in snappy-java through 1.1.10.8 lets an attacker terminate the JVM hosting the library: the Snappy.compress(ByteBuffer, ByteBuffer) overload writes past the end of the destination buffer when incompressible input exceeds its remaining capacity, corrupting off-heap memory. Exposure is limited to Java applications that call that specific ByteBuffer overload with attacker-influenceable, low-compressibility data and a destination buffer that was not sized using Snappy.maxCompressedLength(); code using the byte[]-based compress API or compressing only trusted data is not exposed. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 vector reports PR:N, and the independent assessment agrees with AV:N/PR:N/UI:N), but the impact is availability-only - no confidentiality or integrity loss and no code execution - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Server-side request forgery in Prebid Server Java before 3.43.0 allows unauthenticated remote attackers to redirect the server's outbound bidder traffic to arbitrary destinations by injecting values into bidder adapter parameters. Multiple adapters - including acuityads, adhese, adtonos, adview, axonix, bidmachine, blis, clydo, contxtful, elementaltv, and eplanning - interpolate user-supplied imp.ext fields (host, path, sellerId, accountId, supplierId, supplyId, partnerId, customerId, adunit) directly into endpoint URL templates without calling HttpUtil to validate the resulting domain or path segment, so a crafted bid request can make the server reach internal network services, cloud metadata endpoints such as 169.254.169.254, or other sensitive endpoints using its own network position. No public exploit identified at time of analysis; the vendor's CVSS score of 10.0 overstates the assessed impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), and real-world severity depends on which of the affected adapters are actually enabled and on the network adjacency of the server.
OS command injection in JabRef's built-in HTTP server (CWE-78) lets a caller who can reach the localhost GET /better-bibtex/cayw endpoint with application=sublime smuggle shell metacharacters through the untrusted cite-command prefix, which is concatenated with citation keys and executed via sh -c by PushToSublimeText without escaping, achieving arbitrary command execution as the JabRef user. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:A) shows this is remotely reachable and requires no authentication, but exploitation is gated behind a stack of non-default conditions: the built-in server must be enabled or jabsrv running, a valid Sublime Text command path must be configured as a push target, only Unix-like systems are affected because of the sh -c invocation, and the victim must actively complete the CAYW citation selection dialog. No KEV listing and no public exploit code were identified at time of analysis; the layered opt-in and interaction requirements keep real-world risk comparatively low despite the high confidentiality, integrity and availability impact if the preconditions are met. The flaw is fixed in 6.0-alpha.6.
SQL injection in the Traccar GPS tracking server affects all versions prior to 6.14.0 and allows an authenticated, non-read-only user to extract arbitrary database values - including administrator email addresses, password hashes and salts - or to conditionally delete permission rows. The attacker submits a DELETE /api/permissions request with an extra, attacker-chosen JSON key: only the first two keys are validated by Permission.java, while DatabaseStorage.removePermission() concatenates every map key into the SQL WHERE clause as a column identifier, turning the key name into injectable SQL and providing a blind boolean/error oracle. Exploitation requires a valid account with write permissions and access to at least one object usable in a permission pair; unauthenticated requests are explicitly rejected (CVSS 3.1 7.1, PR:L, C:H/I:L). No public exploit code has been identified at time of analysis, and a vendor-released patch (6.14.0) is available.
Heap exhaustion in AsyncHttpClient (AHC) 2.0.0 through 2.16.0 and 3.x before 3.0.12 allows any server the client calls - or anyone able to rewrite a response in transit - to kill the client JVM by returning a small gzip, deflate, or snappy body that inflates without bound across chunks until the process raises OutOfMemoryError. The vulnerable path is automatic response decompression on HTTP/1.1, and on releases 3.0.8 through 3.0.10 the HTTP/2 decompressor is unbounded as well, so switching protocols does not mitigate; brotli and zstd are also affected when those optional codecs are on the classpath. This is an availability-only issue (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/A:H) with no public exploit identified at time of analysis, and realistic exposure is limited to deployments that make outbound HTTP requests to untrusted, attacker-influenceable, or user-supplied URLs.
AsyncHttpClient (AHC) 2.1.0 through 2.16.0 and 3.0.x before 3.0.12 can disclose authenticated SOCKS proxy credentials - including directly reversible Basic credentials and NTLM/Kerberos/SPNEGO material - to the origin server because the library attaches a Proxy-Authorization header to a request carried over a SOCKS tunnel without first confirming that the destination is an HTTP proxy. Any Java application that configures AHC with an authenticated SOCKS4 or SOCKS5 proxy in those versions is exposed: in the preemptive-authentication path the header is emitted on plaintext HTTP requests to any origin, and in the default non-preemptive path a hostile origin that answers with HTTP 407 triggers ProxyUnauthorized407Interceptor to push the proxy credentials back through the tunnel to that origin. The reporter-assigned CVSS is 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), a confidentiality-only, high-impact issue that requires an authenticated SOCKS proxy configuration to be present; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Denial of service in the Red Hat Quarkus WebSockets Next extension (quarkus-websockets-next), as shipped in Red Hat Build of Quarkus and Red Hat Enterprise Linux AI (RHEL AI) 3, allows a remote, unauthenticated attacker to crash the Java Virtual Machine by streaming WebSocket messages over a single connection faster than the application can consume them. Unbounded message buffering combined with a lack of read backpressure exhausts heap memory, producing a java.lang.OutOfMemoryError that terminates the JVM and takes the hosting service offline; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms availability-only impact with no confidentiality or integrity loss and requires no authentication, user interaction, or special configuration beyond an attacker-reachable WebSocket endpoint. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was included in the available intelligence; the practical risk is governed by exposure, since only applications serving a WebSocket route to untrusted networks are reachable.
Session fixation in the default security configuration of Opencast prior to 19.7 and 20.2 lets an unauthenticated attacker who can deliver a crafted link to a victim hijack that victim's authenticated session. Because the shipped etc/security/mh_default_org.xml accepts a client-supplied JSESSIONID via the ;jsessionid= URL path parameter and does not regenerate the identifier at login, an attacker who knows the fixated value can reuse it once the victim authenticates - exposing the victim's data and actions, and escalating to full administrative account takeover when the victim is an administrator. Exploitation requires user interaction (the victim must open the link while holding no active Opencast session cookie and then log in), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated file upload in admin3 through 3.0.0 allows a user with an account and access to the storage handler to escape the configured storage root on Windows deployments by supplying filenames containing dot-dot path segments, overwriting any file the server process can write. The vulnerability requires authentication (CVSS 4.0 vector PR:L) and the reported escape path is Windows-specific, which narrows the exploitable population below what a raw network-vector score would suggest, and impact is bounded to files writable by the server process account. Publicly available exploit code exists, making the flaw a mid-tier but actionable finding for exposed Windows installations.
Session token harvesting in cjbi admin3 through version 3.0.0 lets any authenticated account holding the log:view permission read bearer credentials out of the audit-log event body returned by GET /logs. Because the UserLoggedIn domain-event handler writes the user's live session token into the logged event JSON, an attacker who opens the log-viewing screen can extract tokens belonging to other users - including administrators - and replay them as bearer credentials for full account takeover, yielding high confidentiality, integrity, and availability impact (CVSS 8.7). Publicly available exploit code exists (a PoC script is published for this CVE), though there is no indication of confirmed active exploitation; the assessed vector is AV:N/AC:L/PR:L/UI:N, so a valid low-privileged log-viewing session is mandatory, and the payoff depends on a higher-privileged user holding an active, unexpired session at the time the log is read.
Server-side request forgery (SSRF) in Graylog through version 7.1.4 allows an authenticated user who holds lookup table or event notification permissions to coerce the Graylog server into fetching internal services. The flaw occurs because Graylog validates outbound URLs against an allowlist only before the initial request and does not re-validate the destination after an HTTP redirect; an attacker can supply an allowlisted endpoint that redirects to an internal address, and the server returns the internal response. This is a confidentiality-only issue (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no public exploit identified at time of analysis.
Unauthenticated Kryo deserialization in the Angel-ML Angel distributed machine-learning coordinator (all versions through 3.3.0) lets any remote attacker who can reach the master RPC endpoint submit crafted setAlgoMetrics payloads that instantiate arbitrary classes or exhaust coordinator memory, producing denial of service and - when exploitable gadget classes are present on the coordinator classpath - remote code execution. No authentication or user interaction is required, but exploitation depends on network reachability to the master RPC service and, for the RCE outcome specifically, on the composition of the target's classpath; the memory-exhaustion outcome carries no such precondition and is reliably achievable. No public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing); the referenced GitHub issue and source-file links document the flaw but no patched release has been published.
Missing authorization checks in DiDi KnowStreaming through 3.4.1 allow any authenticated user - regardless of assigned role - to reach protected REST API functionality, including identity-management endpoints that can create administrator accounts or elevate the caller's own privileges. Exploitation requires only a valid low-privilege login (PR:L) with network reach to the REST API; no admin role, user interaction, or non-default configuration is needed, which makes the flaw most dangerous in deployments where accounts are broadly provisioned or self-registration is enabled. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation, but the complete loss of confidentiality, integrity, and availability on affected systems keeps this a genuinely high-priority privilege-escalation issue.
Authenticated attackers holding any valid low-privilege role in metasfresh can read, replace, and delete attachments and comments belonging to records their role is not permitted to access. The DocumentAttachmentsRestController and CommentsRestController endpoints enforce only login state and never apply metasfresh's record-level (role/organization) permissions, so an attacker who enumerates sequential document identifiers can traverse records across access boundaries - an insecure direct object reference (CWE-639) rated 8.7 under CVSS 4.0 (CVSS 3.1 assessment: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). Exploitation requires a valid account and sequentially enumerable identifiers; no public exploit code exists, and there is no confirmed actively exploited (CISA KEV) status at time of analysis.
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has the External Database Access feature configured, via insecure deserialization of a crafted Java byte stream sent to the feature's TCP port (CWE-502). Vendor scoring is 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment rates it AV:N/AC:H/PR:N/UI:N because exploitation additionally requires the attacker to control a host already listed in the external database access list and to reach that specific port - a trust relationship that gates who can hit the vulnerable endpoint. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the attack surface is substantially reduced where the FMC management interface is not exposed to the public internet.
Root-level command execution on Cisco Identity Services Engine (ISE) is achievable by an authenticated, high-privileged administrator who sends a crafted serialized Java object to an affected node, allowing arbitrary commands to run on the underlying operating system. The flaw is insecure Java deserialization (CWE-502) that yields user-level OS access escalating to root, and in single-node deployments a successful exploit can also render the ISE node unavailable, so endpoints that have not already authenticated cannot reach the network until the node is restored. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the vendor's CVSS 9.1 is driven by the scope change (S:C) and full C:H/I:H/A:H impact, but exploitation requires valid high-privileged administrative credentials (PR:H), which is the primary limiting factor.
Denial of service in HAPI FHIR core (org.hl7.fhir.core) before 6.9.12: remote attackers who can reach an endpoint that parses Smart Health Card content can submit a JWT whose header declares zip:"DEF" with an empty or truncated raw-DEFLATE payload, driving SHCParser.decodeJWT() into a non-terminating Inflater loop that pins a JVM worker thread indefinitely. The trigger is unauthenticated and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and because each malformed request consumes a validation worker permanently, concurrent submissions can exhaust the entire worker pool and make legitimate FHIR validation unavailable. No public exploit code has been identified at time of analysis, and the risk is bounded: a deployment that never feeds untrusted Smart Health Card data into SHCParser (directly or through ResourceChecker file-format detection) is not remotely exploitable despite the network attack vector, with impact limited to availability only - no confidentiality or integrity loss.
Unbounded DEFLATE decompression in HAPI FHIR's SHCParser (org.hl7.fhir.core prior to 6.9.12) allows an unauthenticated remote attacker to exhaust heap memory by submitting a small Smart Health Card JWT whose header sets zip:"DEF" and whose compressed payload inflates to an arbitrarily large size, resulting in severe garbage-collection pressure, request failure, process instability, or process termination. The issue is confined to the decompression path in SHCParser.decodeJWT(), SHCParser.inflate() and SHCParser.decompress(), which accumulate all output in a ByteArrayOutputStream before any size check occurs; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though no EPSS estimate was supplied in the source data. The practical exposure is bounded by reachability: any application, validator service, or API endpoint built on org.hl7.fhir.core that accepts attacker-supplied SHC/JWT content and routes it through SHCParser before 6.9.12 is affected, while deployments that never expose SHC parsing to untrusted callers have effectively no network attack surface.
Memory exhaustion in the RabbitMQ Java client (all versions prior to 5.34.0) lets a rogue AMQP broker or an in-path attacker crash the JVM host application: when both the client's default ConnectionFactory.DEFAULT_FRAME_MAX and the server's Connection.Tune frame_max negotiate to 0, the library's maxInboundMessageBodySize cap is silently discarded and an oversized inbound frame is allocated without limit. Attackers cannot force this against a passive, correctly connected client - the victim must connect outbound to attacker-influenced infrastructure, or the attacker must hold a man-in-the-middle position able to rewrite the Connection.Tune frame and inject frames, which the vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) and our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) both treat as an unauthenticated, availability-only denial of service with no code execution or data exposure. Impact is limited to terminating the client process via heap exhaustion, and there is no public exploit identified at time of analysis and no CISA KEV listing; vendor-released patch: 5.34.0.
Authenticated remote code execution in Cisco ISE allows an attacker with low-privileged administrative credentials to execute arbitrary commands on the underlying operating system and elevate to root via insecure deserialization of a crafted Java object sent to the web-based management interface. Exploitation requires network access to the management interface and valid low-privileged admin credentials (CVSS 9.9, PR:L), and successful attacks on single-node deployments can cause a denial-of-service condition that prevents unauthenticated endpoints from accessing the network. No public exploit has been identified at time of analysis.
Improper access control in stylefeng Guns through 8.3.5 lets any authenticated user, even one with no assigned roles, create, edit, delete, publish, and retract system-wide notices via SysNoticeController actions that never require a permission. The issue is remotely exploitable with low privileges and high integrity impact but no confidentiality or availability impact; no public exploit code has been identified at time of analysis, and authentication is required (PR:L) because the attacker must already have a valid Guns session.
Missing authorization in the Guns Java rapid-development framework (through 8.3.5) allows any authenticated user to harvest the full user directory, including account names, real names, email addresses, phone numbers, last-login IPs and role assignments. The /sysUser/detail and /sysUser/page handlers in SysUserController omit the requiredPermission annotation, so the TokenAndPermissionInterceptor performs no RBAC check on them and returns data for every user in the system to anyone holding a valid login token. The attack is network-reachable and needs only a low-privileged authenticated session (PR:L), with no user interaction and no administrative rights; no public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was supplied in the source data.
Server-side request forgery with a local file inclusion component in Apache MyFaces - the JSF implementation referred to in the CVE text as 'Apache MyFace Core' - allows an unauthenticated remote attacker to send a single crafted request that makes the application server dereference an attacker-controlled address or file path, yielding disclosure of internal service responses and sensitive local files. The vendor rates this 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); our independent assessment keeps the unauthenticated, network-reachable, low-complexity profile but models the integrity impact as Low rather than High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), since the disclosed mechanism is primarily read/dereference oriented. Exploitation is constrained only by reachability of a vulnerable JSF endpoint on an affected release (2.2.0-beta-2.2.15, 2.3.0-2.3.11, 2.3-next-M1-M8, 3.0.0-3.0.3, 4.0.0-4.0.3, 4.1.0-4.1.3, plus older unsupported versions) and by the presence of interesting internal targets; vendor patches are already released and no public exploit code was identified at time of analysis.
Authenticated path traversal in Apache NiFi Registry 0.4.0 through 2.11.0 allows a user who is authorized to both write and delete extension bundles in a bucket to upload a NAR whose manifest carries crafted parent-directory group, artifact, or version coordinates, causing the default file persistence provider to perform file system operations outside the configured persistence directory. Impact is limited to integrity and availability (files created, overwritten, or deleted outside the storage root) rather than confidentiality or remote code execution, and exploitation requires a valid account with write-plus-delete bundle privileges on a deployment using the default file persistence provider. There is no public exploit identified at time of analysis and no CVSS-vector indication of unauthenticated reach; upgrading to Apache NiFi Registry 2.12.0 closes the vector by rejecting parent-directory coordinates and enforcing a normalized strict-child path check.
Authorization bypass in ScadaLTS 2.8.1-release-candidate build 0 lets any authenticated user invoke restricted DWR methods by sending a POST to a URL their role is allowed to reach while naming a privileged class and method in the request body, bypassing Spring Security's URL-pattern-only access control; the assessed severity is CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with high confidentiality, integrity, and availability impact once the flaw is chained with the other Tenable-reported findings it enables. Exploitation is not anonymous: the attacker must already hold a valid low-privilege ScadaLTS session, and the deployment must run with DWR's crossDomainSessionSecurity setting set to false in web.xml (the default in the affected build), which disables DWR's built-in origin and session validation. No confirmed active exploitation (CISA KEV) and no public exploit code were identified in the available intelligence at time of analysis, so the practical urgency is driven by the credential precondition rather than by observed attacks.
This is a genuine but bounded-priority integrity flaw: in TDuck Survey Form through version 5.0, any authenticated low-privilege user can overwrite other respondents stored form submissions by calling POST /user/form/data/update with a submission identifier that does not belong to them, because the endpoint performs no ownership validation (CWE-639). Confidentiality and availability are unaffected, so the realistic impact is corruption or falsification of collected survey data, including responses containing personal information, rather than data theft or denial of service. Exploitation requires only a valid account (authenticated, PR:L) with no admin role, user interaction, or non-default configuration, and it is aided by submission identifiers being allocated in narrow, guessable ranges; no public exploit code has been identified at time of analysis and the issue is not reported as actively exploited.
Unauthenticated server-side request forgery in DataGear through 6.0.0 lets any remote attacker who can reach the web interface force the server to issue arbitrary HTTP requests - GET, POST, PUT, PATCH, or DELETE - to internal hosts and cloud metadata services via the /dataSet/preview/Http endpoint, returning the full response body to the caller. The endpoint is reachable without credentials (it is exempted by the SecurityConfigSupport allowlist), so the only prerequisite is network reachability to the DataGear instance, with impact maximized in cloud deployments where the link-local metadata service at 169.254.169.254 is reachable and can yield IAM credential theft. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and no vendor-released patch has been identified.
Stored cross-site scripting in Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier lets an attacker who already holds Item/Configure permission on a job submit a job configuration through the REST API with a javascript: scheme URL in the unvalidated coverage results ID field, which is then stored and rendered when a victim later opens the job's coverage page. Exploitation therefore requires authenticated low-privilege access (CVSS PR:L) plus victim interaction (UI:R), meaning it is not usable against default unauthenticated Jenkins deployments; Impact on confidentiality, integrity and availability is rated High (CVSS 8.0). No public exploit code or confirmed active exploitation was identified at time of analysis, and CISA's SSVC assessment records Exploitation: none and Automatable: no.
Stored cross-site scripting in Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier lets an authenticated attacker holding Item/Configure permission inject a javascript: scheme value as the analysis results identifier by submitting a job configuration through the REST API, bypassing the validation that the normal UI path performs. The payload is persisted with the job and executes in the browser of any user who later opens the affected Warnings/analysis results page (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, 8.0, CWE-79). No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none and automatable as no, although technical impact is rated total; vendor patches are available in 13.10259.v80f407cb_03a_e and the backport 13.10223.10225.vcf001b_b_b_3a_90.
Sandbox escape in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier allows an authenticated Jenkins user who is permitted to define and run sandboxed scripts - including Pipeline jobs - to break out of the Groovy sandbox and execute arbitrary code on the Jenkins controller. The flaw is a protection-mechanism failure (CWE-693): the sandbox's call-site interception does not cover methods that are added dynamically to a class at runtime, so a crafted script can invoke such a method and run code that should have been blocked. Exploitation requires script-authoring privileges (PR:L) and a deliberately crafted script (AC:H) with no user interaction, giving high confidentiality, integrity, and availability impact on the controller; no public exploit code was identified at the time of analysis, and the practical risk is concentrated in multi-tenant Jenkins deployments where lower-trust users are delegated Pipeline authoring.
Arbitrary code execution in the Jenkins Script Security Plugin (versions up to and including 1415.v9a_f9b_3a_c253d) lets an authenticated attacker who holds permission to define classpath entries run attacker-supplied code inside the Jenkins controller JVM. The plugin downloads the URL-specified JAR twice - it verifies approval against the first response but then loads classpath entries from the second - so an attacker who controls the hosting server can present a benign, approvable JAR on request one and a malicious JAR on request two. The assessed CVSS 3.1 vector (7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects this time-of-check/time-of-use race: the flaw is remotely reachable but requires an authenticated classpath-defining user and a reliably won race; there is no public exploit code and no confirmed active exploitation identified at time of analysis.
Arbitrary code execution in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier: when a user with job-configure privileges defines classpath entries in an item configuration, those entries are silently auto-approved the moment a user holding Overall/Administer permission copies that item or updates its configuration through the REST API or CLI. The result is code execution inside the Jenkins controller JVM (CWE-94, CVSS 8.0), but exploitation is a two-actor, confused-deputy scenario: the attacker needs pre-existing config-edit rights (PR:L) and must wait for a privileged user to perform the copy or API/CLI update (UI:R), so installations where only administrators author jobs and never copy them or drive configuration through REST/CLI are effectively unexposed. No public exploit code or confirmed active exploitation was identified at time of analysis.
Sandbox escape in the Jenkins Script Security Plugin (1415.v9a_f9b_3a_c253d and earlier) allows an authenticated Jenkins user who holds permission to define and run sandboxed scripts - including Pipelines - to execute code outside the Groovy sandbox by supplying an @Builder annotation whose builderStrategy member names an arbitrary class. Exploitation additionally requires that a suitable "gadget" class be present on the classpath of the component that evaluates the script, which is why the assessment rates it AC:H despite high C:H/I:H/A:H impact and a scope change (S:C) across the sandbox boundary; the limitation is that only instances where untrusted or low-privilege users can author sandboxed scripts are meaningfully exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.20% (11th percentile), consistent with a high-severity but precondition-heavy flaw rather than a mass-exploitable internet threat.
Sandbox escape leading to arbitrary code execution inside the Jenkins controller JVM affects Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier because the plugin fails to reject the @GroovyASTTransformationClass annotation in script source. An authenticated Jenkins user with permission to define and run sandboxed scripts, including Pipelines (the CVSS vector carries PR:L), can submit a script that registers a Groovy AST transformation executed at compile time, before the sandbox applies, resulting in high confidentiality, integrity, and availability impact on the controller; our independent assessment scores this 8.8 with a scope change (S:C) rather than the provider's S:U. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but for any account holding script-submission rights the exploit path is direct rather than theoretical, so the practical risk concentrates on instances that grant Job/Configure or equivalent Pipeline-authoring rights broadly. This is a genuine high-priority vulnerability, not CVSS inflation: the sandbox itself, not a misconfiguration, is the control being bypassed.
Arbitrary code execution in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier allows an authenticated attacker with permission to define and run sandboxed Groovy scripts or Pipelines to bypass the sandbox and run code in the Jenkins controller JVM. The flaw is a protection mechanism failure (CWE-693) in how the plugin casts collections, and it carries CVSS 8.8 with PR:L; only users who can author sandboxed scripts or Pipelines can trigger it. No public exploit code was identified at time of analysis, and CISA SSVC rates exploitation as none, but this is high-priority for multi-tenant Jenkins because script-authoring rights are often broadly granted.
Sandbox escape in the Jenkins Script Security Plugin (1415.v9a_f9b_3a_c253d and earlier) allows authenticated users with permission to define and run sandboxed Groovy or Pipeline scripts to execute arbitrary code in the Jenkins controller JVM, because the sandbox fails to intercept method calls, property and attribute accesses, and array accesses made on a null receiver. No non-default configuration is required - the weakness is inherent to the default sandbox - and the flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-693), with CISA SSVC assessing total technical impact but no active exploitation and no public exploit identified at time of analysis. Real-world urgency is moderated by the access prerequisite: the attacker must already hold script-authoring rights, so exposure is concentrated in multi-tenant or delegated Jenkins instances where Pipeline authoring is granted to less-trusted users.
Sandbox escape in the Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier lets an authenticated user who holds permission to define and run sandboxed scripts - including Pipelines - execute arbitrary code in the Jenkins controller JVM, earning a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a protection-mechanism failure (CWE-693): the sandbox proxy created when a script coerces a value to a Java interface skips the method check when the coerced value inherits a same-named method, so the interface proxy can be used to reach unchecked code. No public exploit code has been identified at time of analysis and CISA SSVC rates the issue non-automatable (Exploitation: none, Automatable: no, Technical Impact: total), so mass exploitation is not expected; the binding prerequisite is the authenticated script-authoring permission reflected by PR:L, which makes this a real but privilege-gated RCE-class risk.
Arbitrary file deletion in zlt2000 microservices-platform through 6.0.0 allows authenticated attackers to delete any user's files and metadata due to missing ownership validation in the file-center module's DELETE /files/{id} endpoint. Attackers can enumerate file identifiers via GET /files and then delete arbitrary files, bypassing authorization controls (CWE-639); publicly available exploit code exists. Exploitation requires a valid, low-privilege account (PR:L) with access to the file-center REST API, and the impact is limited to integrity and availability (no data disclosure), with a CVSS 4.0 base score of 7.2.
Authenticated attackers can read arbitrary Elasticsearch indices in zlt2000 microservices-platform through 6.0.0 by supplying any index name in the POST /search/{indexName} or GET /agg/requestStat/{indexName}/{routing} endpoints, bypassing authorization checks. This exposes sensitive data such as the sys_user index containing user records and password hashes; the vulnerability has a CVSS 4.0 base score of 7.1 and an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning high confidentiality impact with no integrity or availability effect. Publicly available exploit code exists (no CISA KEV confirmation), and exploitation requires only a valid low-privilege session on a network-reachable search-center service.
Authenticated users of zlt2000 microservices-platform through 6.0.0 can overwrite the password of any non-administrator account by calling the PUT /users/password endpoint with an arbitrary user id and a new password, because the server never verifies the current password. The flaw is network-reachable, low-complexity, and requires only a low-privilege login session (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:L), and publicly available exploit code exists. Exploitation is limited to non-administrator accounts and is not possible pre-authentication, but a successful attack yields full credential takeover of the targeted account.
Missing authorization in zlt2000 microservices-platform through 6.0.0 lets any authenticated account - including one with zero assigned roles - invoke administrative APIs for user management, role assignment, password resets by user ID, and Elasticsearch index deletion, because the shipped default of zlt.security.auth.urlPermission.enable is false and suppresses all permission checks once authentication succeeds. Exploitation is not pre-auth: it requires a valid low-privilege session against a deployment running the out-of-the-box configuration, and publicly available exploit code exists (VulnCheck-reported PoC scripts covering role-granting, user enumeration, password reset, and ES index deletion), though no confirmed active exploitation (CISA KEV) has been recorded. Assessed severity is high (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8; vendor-published CVSS 4.0 score 8.7) because a zero-role user obtains both read and write access to sensitive administrative functions.
Authenticated back-office users of yshop-crm through 2.1.3 can enumerate the complete user directory via GET /admin-api/system/user/page because the endpoint's @PreAuthorize('system:user:list') gate is commented out in UserController.java. The flaw is a broken-access-control issue (CWE-862) that requires valid admin-panel credentials plus a role configured with data scope ALL; without that scope the query returns little of value, but with it an attacker can harvest login names, nicknames, departments, emails, mobile numbers, and last-login metadata. Publicly available exploit code exists (a Python enumeration PoC), and no CISA KEV entry confirms active exploitation at time of analysis. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning authenticated remote confidentiality loss only - no integrity or availability impact.
Missing authorization in yshop-crm 2.1.3 and earlier lets any authenticated back-office (admin-api) user delete arbitrary approval-workflow steps via DELETE /admin-api/crm/flow/delete-step, bypassing the permission check that should restrict this to workflow administrators. The result is an integrity-only compromise of the approval chains that gate contract, receivable, and invoice finalization; there is no confidentiality or availability impact, and the CVE record's CVSS 4.0 score of 7.1 maps to an independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, i.e. a genuine but moderate-priority missing-authorization flaw rather than a critical takeover. Publicly available exploit code exists (a Python PoC against the delete-step endpoint); no CISA KEV listing or other confirmation of active in-the-wild exploitation was present in the supplied data.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user - including low-privilege operators - to read the installation-wide audit trail by calling GET /admin-api/crm/operatelog/page, exposing operator names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers. Publicly available exploit code exists (a PoC script that queries the endpoint), and although exploitation requires a valid back-office session with network reach to the admin API, no elevated role or user interaction is needed, so the realistic threat is a malicious insider or anyone who has reused or stolen an operator credential. The vulnerability is broken access control (CWE-862) with high confidentiality impact only; it does not permit data modification, service disruption, or pre-authentication compromise.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to claim and reassign sales leads belonging to other employees by invoking the CrmCluesController receiveCustomer lead-claim endpoint with a manipulated ownerUserId value. The flaw is a broken access control (CWE-862) issue that requires only a valid low-privilege staff login and no administrative role, feature toggle, or user interaction, with the practical impact limited to integrity of lead ownership data (no confidentiality or availability impact). Publicly available exploit code exists in the form of a Python proof-of-concept targeting the endpoint, and the absence of access logging or quota validation on the operation removes any built-in brake on bulk lead theft, though no confirmed active exploitation (CISA KEV) has been observed at time of analysis.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to issue arbitrary invoices by calling the PUT /admin-api/crm/invoice/issue endpoint, which performs no permission check on the caller. An attacker holding low-privileged back-office credentials can set an invoice's status, overwrite contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary recipient addresses - a pure integrity impact with no confidentiality or availability loss. Publicly available exploit code exists (a Python PoC in the LinYuanyi1 cve-request-poc repository), but there is no evidence of confirmed active exploitation (CISA KEV).
Server-side request forgery in kkFileView 4.2.0 and later lets remote, unauthenticated attackers make the server fetch arbitrary URLs and read the echoed response body via the cross-origin file proxy endpoint /getCorsFile. The flaw is a validation/consumption mismatch: TrustHostFilter checks the first non-empty parameter in a fixed priority order against the trust.host whitelist, while the controller only reads and fetches urlPath, so a request supplying both a whitelisted decoy (url) and the real target (urlPath) passes validation and fetches the unvalidated target. Our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - high confidentiality impact with no integrity or availability impact, somewhat lower than the vendor's 9.1 - and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Remote compromise of Oracle GraalVM is possible: an unauthenticated attacker with HTTP access can exploit a defect in the Compiler component to achieve full takeover of the affected runtime, with high confidentiality, integrity and availability impact. Affected builds are Oracle GraalVM for JDK 17 (23.0.13.1), Oracle GraalVM for JDK 21 (23.1.12.1) and Oracle GraalVM 25 (25.0.4.1). No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently assessed as targeted rather than opportunistic; note that the accompanying 'Information Disclosure' tag understates the stated impact.
Oracle GraalVM (including GraalVM for JDK 17/21, GraalVM Enterprise Edition and GraalVM 25.x) contains a flaw in its Compiler component that a network-positioned attacker can reach over HTTP without authenticating. Successful exploitation can expose critical data, allow limited unauthorized modification of data, and cause a partial denial of service; Oracle characterizes the issue as difficult to exploit per the AC:H metric, implying attacker-controlled timing or memory-layout preconditions. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.0 with a high confidentiality impact.
Remote compromise of Oracle GraalVM for JDK is achievable through a flaw in the bundled Compiler component, where a crafted attack delivered over HTTP can lead to full takeover of the affected runtime with high confidentiality, integrity, and availability impact. The vulnerability affects Oracle GraalVM for JDK 17 version 23.0.13.1, Oracle GraalVM for JDK 21 version 23.1.12.1, and Oracle GraalVM 25.0.4.1, and Oracle explicitly rates it as 'difficult to exploit' (CVSS 3.1 AC:H) despite an 8.1 base score and no authentication requirement. No CISA KEV listing, EPSS score, or public exploit code was provided in the source data, so active exploitation is not confirmed at time of analysis.
Oracle GraalVM 25.0.4.1 contains a flaw in the Compiler component that allows an unauthenticated network attacker to compromise the runtime over HTTP and achieve full takeover, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N). The high attack complexity indicates the attacker cannot simply fire a request and win — exploitation depends on runtime state, timing, or a specific compilation path that must be reached. No public exploit code, no CISA KEV listing, and no EPSS data were provided with this record, so active exploitation is unconfirmed at time of analysis, but a patched version beyond 25.0.4.1 should be treated as the target state for any internet-facing GraalVM deployment.
Oracle GraalVM 25.0.4.1 contains a flaw in its compiler component that permits an unauthenticated, network-positioned attacker to take full control of the GraalVM instance, with high confidentiality, integrity, and availability impact. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and explicitly calls it 'difficult to exploit', implying exploitation depends on precise
Full takeover of Oracle GraalVM 25.0.4.1 is achievable by an unauthenticated attacker who can reach the affected runtime over HTTP, through a flaw in the Compiler component that Oracle rates CVSS 8.1 with high confidentiality, integrity and availability impact. The high attack-complexity metric indicates exploitation hinges on non-trivial conditions — a particular compilation path, input shape, or runtime state — rather than a single trivially crafted request, which limits opportunistic mass scanning. No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis, and no EPSS score was supplied with the source data.
Unauthenticated remote attackers can obtain complete read and write access to Oracle Identity Manager's OIM Legacy UI component in supported versions 12.2.1.4.0 and 14.1.2.1.0, enabling unauthorized creation, deletion and modification of critical identity data as well as full disclosure of OIM-accessible data (CVSS 3.1 base score 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The decisive limiting factor is the UI:R requirement: a legitimate OIM user or administrator must be induced to interact with attacker-supplied content over HTTP, which makes this a targeted social-engineering vector rather than a fully automated one, and there is no availability impact. No public exploit has been identified at time of analysis, and Oracle published the issue as part of its September 2026 Critical Patch Update, which is the authoritative remediation source; the issue is tracked in the EU as EUVD-2026-79722.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 can be taken over by a low-privileged local attacker with logon access to the host infrastructure, allowing complete compromise of the Content Server component's confidentiality, integrity, and availability. The flaw is easily exploitable given local access and a valid account, but no public exploit or active exploitation has been identified at time of analysis. This is a locally-scoped critical-impact issue, not a remote-drive-by vulnerability.
Improper authentication in the Personalization component of Oracle Applications Framework (Oracle E-Business Suite 12.2.3 through 12.2.15) lets an unauthenticated remote attacker reach the SOAP interface and take over the framework, with full confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). CISA's SSVC assessment rates the technical impact as total and the vulnerability as automatable, meaning exploitation could be scripted and scaled once a target is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven mainly by whether an organisation exposes EBS SOAP endpoints to untrusted networks.
Authentication bypass in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 (Platform Security component) lets an unauthenticated remote attacker with HTTP access take over the BI platform, yielding full confidentiality, integrity, and availability impact (CVSS 3.1 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation have been identified at time of analysis, so exposure drives urgency: internet-facing BI EE instances are the highest priority, while internal-only deployments carry materially lower reach. The blast radius is bounded by the fact that only the single supported release 12.2.1.4.0 is affected and the sole prerequisite is network reachability of the BI EE HTTP interface.
Authenticated takeover of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 is achievable through the Platform Security component by a low-privileged attacker with network HTTP access, producing high confidentiality, integrity and availability impact (CVSS 9.9, scope change). Exploitation is straightforward once any valid low-privilege credential or session is held - attack complexity is low and no user interaction is required - and the scope change means a successful compromise can extend beyond BI EE into other products integrated with the platform. No public exploit code has been identified at time of analysis, and Oracle classifies the flaw as easily exploitable in its Critical Security Patch Update advisory.
Authentication bypass in Oracle BI Publisher (BI Platform Security component of Oracle Analytics) lets unauthenticated remote attackers with HTTP access take over the affected system, with full confidentiality, integrity, and availability impact. Affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and score of 9.8 confirm an easily exploitable, automatable condition; no public exploit or evidence of active exploitation was identified at time of analysis, but CISA SSVC classifies technical impact as total and the vulnerability is automatable, making exposed instances a high priority to patch or isolate.
Takeover of Oracle Agile PLM 9.3.6 is achievable through the Event Java PX component, where an attacker with high privileges and network reachability over T3 or IIOP can fully compromise confidentiality, integrity, and availability while the scope change (S:C) allows significant impact on additional products. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), and the dominant real-world limiter is the PR:H requirement - the attacker must already hold an elevated, authenticated role, so realistic exploitation is confined to insiders or adversaries who have already compromised a privileged account. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (the CVE is not in CISA KEV).
Unauthenticated remote attackers who can reach the Oracle Data Integrator Console / Repository Explorer over HTTP can bypass authentication entirely (CWE-287) and take full control of the affected deployment, affecting versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle Fusion Middleware's ODI product. The flaw is rated CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction, and no special preconditions beyond network reachability of the console interface - the primary exposure limiter is whether the ODI Console is internet-facing versus segmented behind VPN or internal-only access. As of analysis, there is no CISA KEV entry and no public exploit identified at time of analysis, though CISA's SSVC assessment rates the issue as automatable with total technical impact, so patching should be treated as urgent rather than deferred.
Unauthenticated attackers who can reach the One-to-One Fulfillment module of Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP can achieve complete takeover of that component, with high confidentiality, integrity, and availability impact (CVSS 8.1). Oracle characterizes the flaw as difficult to exploit (AC:H), which tempers the unauthenticated network attack vector, and the issue resides in the module's Java Server layer. No public exploit code and no CISA KEV listing were identified at time of analysis, and Oracle published the fix as part of its September 2026 Critical Security Patch Update.
Unauthenticated attackers with network access to the SOAP interface of Oracle Service Delivery Platform (SDP) versions 12.2.1.4.0 and 14.1.2.0.0 can bypass authentication and achieve full takeover of the product, per CWE-287 and a CVSS 3.1 base score of 9.8. The flaw is remotely exploitable without privileges or user interaction (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. Real-world risk is concentrated in telecom environments where the Messaging Enabler component is deployed and network-reachable.
Oracle Application Testing Suite 13.3.0.1 allows an authenticated attacker holding only the low-privilege 'Test Manager for Web Apps' role to obtain unauthorized access to critical data, perform unauthorized inserts, updates, or deletes, and cause a partial denial of service, with a scope change (S:C) indicating that a successful attack can significantly affect other products beyond the tested application. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) reflects low attack complexity and no user interaction over HTTP, but the low-privileged account requirement is the primary limiter - an anonymous or externally unauthenticated attacker cannot exploit this, and exposure is confined to deployments running 13.3.0.1 with the Web Apps test component deployed and network-reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers who can reach the HTTP interface of Oracle Forms Services in a Client/Server, Character mode (C/S, Charmode) deployment can potentially achieve full takeover of the affected Oracle Forms instance on versions 12.2.1.19.0 and 14.1.2.0.0. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.0) reflects complete confidentiality, integrity and availability impact plus a scope change, meaning a successful compromise can materially affect products beyond Oracle Forms itself; however, the High attack complexity rating means exploitation is difficult and depends on a condition outside the attacker's direct control, which limits reliability and mass exploitation. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) - real-world exposure is confined to environments running the affected Forms Services C/S Charmode component with its HTTP listener reachable by the attacker.
Improper authentication in the Oracle Forms Client/Server (C/S) Charmode runtime allows an unauthenticated, network-reachable attacker to bypass authentication and operate with the data privileges granted to the Oracle Forms application, yielding high confidentiality and integrity impact (CVSS 3.1 base 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, as shipped in Oracle Fusion Middleware (Forms Services, C/S, Charmode), are affected; the vector requires no credentials and no user interaction, and there is no availability impact. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and exposure is limited to deployments whose C/S Charmode listener is network-reachable over TCP from an untrusted network.
Unauthenticated remote takeover of Oracle Forms is achievable through the Forms Services C/S Charmode component in versions 12.2.1.19.0 and 14.1.2.0.0, where an improper-authentication flaw (CWE-287) lets any attacker who can reach the HTTP endpoint seize full control of the affected service, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). Based on the available intelligence there is no public exploit code identified at time of analysis and no CISA KEV listing, so urgency is driven by exposure rather than observed exploitation. Real-world risk is constrained mainly by deployment reality: Oracle Forms is legacy enterprise middleware that is usually published through web or application tiers rather than directly to the internet, and the C/S Charmode vector specifically points at character-mode client/server installations.
Unauthenticated remote takeover of Oracle Forms is possible in the Forms Services (C/S, Charmode) component of Oracle Fusion Middleware running versions 12.2.1.19.0 and 14.1.2.0.0. An attacker who can reach the Forms HTTP interface with no credentials, no user interaction, and no special privileges can bypass authentication and gain full control of the affected deployment, and the CVSS scope-change flag (S:C) indicates the compromise can significantly impact additional products tied to the same environment. The vendor-rated CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and the flaw is described as easily exploitable, though no public exploit identified at time of analysis.
Full takeover of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 is achievable by an unauthenticated remote attacker exploiting an improper-authentication flaw (CWE-287) in the Forms Services C/S (Charmode) component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) confirms there are no credential, user-interaction, or special-complexity prerequisites - only HTTP reachability to an affected Forms deployment is required. No public exploit code has been identified at time of analysis, and real-world exposure is bounded by how widely the legacy C/S Charmode mode is deployed and whether the Forms HTTP endpoint is exposed beyond the internal network.
Unauthenticated remote attackers with HTTP reachability to the Oracle Forms Services listener can bypass authentication and take over Oracle Forms deployments in Oracle Fusion Middleware versions 12.2.1.19.0 and 14.1.2.0.0, specifically the Forms Services, C/S, and Charmode components. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), matching our independent assessment, meaning no credentials and no user interaction are required and the only practical precondition is network access to the Forms endpoint on default configurations. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patch candidate - particularly for any instance exposed to the internet or to untrusted internal segments - rather than a currently exploited threat.
Authentication bypass in Oracle Forms (Oracle Fusion Middleware) 12.2.1.19.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the Forms Services component - including its C/S and Charmode channels - over HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are stated prerequisites, and the impact is rated complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No CISA KEV entry or public exploit code was identified at time of analysis (EPSS was not provided in the available data); the practical limiting factor is exposure, since Forms Services is frequently shielded behind internal networks, reverse proxies, or VPNs rather than being internet-facing. Our assessment concurs with the vendor vector and classifies this as a genuine high-priority vulnerability.
Unauthenticated remote attackers can achieve full takeover of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 by reaching the OID LDAP Server through its exposed T3 or IIOP remoting listeners, requiring no credentials and no user interaction (CVSS 3.1 base score 9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The root cause is an authentication-bypass condition (CWE-287) in the Fusion Middleware OID LDAP Server component, and successful exploitation yields complete loss of confidentiality, integrity and availability across the directory service. No CISA KEV entry and no public exploit code were identified at time of analysis, so this is not confirmed active exploitation; however, the pre-authentication, network-reachable attack path means internet-facing or broadly reachable OID/WebLogic deployments carry the highest risk, while instances confined to trusted management networks are substantially harder to reach because the only real gating factor is network access to the T3/IIOP listener.
Takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is achievable by an attacker who already holds a high-privilege account on the portal, reaching the Runtime Tools component over HTTP. The flaw is easy to execute once that privileged foothold exists - network vector, low attack complexity, no user interaction required - and its scope-change metric means the fallout can extend into additional Oracle Fusion Middleware products beyond WebCenter Portal itself, with full confidentiality, integrity and availability impact on the portal. The CVSS 3.1 base score is 9.1, but the PR:H prerequisite is the dominant practical constraint: it excludes anonymous and unauthenticated attackers and makes insider abuse or the reuse of stolen administrator credentials the realistic exploitation path. No public exploit code and no confirmed active exploitation were identified at time of analysis, so priority rests on the high severity and low post-authentication effort rather than on observed attacks.
Authentication bypass in Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network access to the OID LDAP Server component to take over the directory service, with high confidentiality, integrity and availability impact (CVSS 3.1 base score 9.8). Exploitation requires no credentials, no user interaction and no non-default configuration per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); the principal practical constraint is reachability of the LDAP listener, since directory servers are normally deployed on internal or segmented networks rather than exposed to the internet. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but Oracle's 'easily exploitable' characterization and the complete compromise outcome make this a high-priority patch target for any organization running the affected versions.
Unauthenticated attackers with network access to the OID LDAP Server component can fully compromise Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0, achieving complete loss of confidentiality, integrity, and availability of the directory service (CVSS 3.1 base score 9.8). Because the flaw is an improper authentication weakness (CWE-287) reachable over LDAP with no credentials, no user interaction, and no special configuration - Oracle itself characterizes it as 'easily exploitable' - any directory deployment whose LDAP listener is exposed to an untrusted network is directly at risk of takeover. No public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing), so the practical risk is driven primarily by network exposure of the OID LDAP port.
Unauthenticated remote takeover of Oracle Internet Directory is achievable through its OID LDAP Server component in versions 12.2.1.4.0 and 14.1.2.1.0. The flaw is an improper-authentication weakness (CWE-287) rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning an attacker who can reach the LDAP listener needs no credentials, no user interaction, and no non-default configuration to gain full control of confidentiality, integrity, and availability of the directory service. Our assessment concurs with this vector and flags it as a genuine top-tier priority; no public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk hinges mainly on whether OID LDAP ports (default 389/636) are exposed beyond trusted internal or management networks.
Takeover of Oracle Internet Directory (OID) is possible for a network-positioned attacker who holds only low-level authenticated privileges on the directory, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Exploitation requires a valid low-privilege LDAP bind credential (PR:L) but no user interaction; the scope change means a successful compromise can propagate to other Oracle Fusion Middleware products that depend on OID for identity. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Low-privileged authenticated LDAP access to Oracle Internet Directory 12.2.1.4.0 or 14.1.2.1.0 can be escalated into full takeover of the directory service, with a scope change that lets a compromise propagate into other Oracle Fusion Middleware components and identity-dependent applications. Oracle rated this 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a remote attacker only needs a valid low-privilege directory credential or authenticated LDAP session - no user interaction - to fully compromise confidentiality, integrity, and availability of OID. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but because OID is typically a central identity store, the blast radius justifies treating this as an urgent patch item; the corresponding Oracle Critical Security Patch Update advisory is the authoritative source for affected fix versions.
Unauthenticated attackers who can reach the Composer component of Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 over HTTP can achieve complete takeover of the portal - full confidentiality, integrity and availability impact - provided they first persuade a legitimate user to perform some action, since the CVSS vector requires user interaction (UI:R). The scope-change flag (S:C) means a successful exploit can extend beyond the portal itself into integrated or dependent products, which is why the base score reaches 9.6 despite the interaction requirement. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the practical near-term risk is driven by the low attack complexity and the existence of a vendor patch through Oracle's Critical Security Patch Update process rather than by observed exploitation.
Authentication bypass in the OIM Legacy UI component of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated attacker who can reach the interface over HTTP take full control of the affected deployment, with complete loss of confidentiality, integrity, and availability (CVSS 3.1 base score 9.8). Exploitation requires no credentials or user interaction (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but it does depend on the Legacy UI being network-reachable; instances shielded by segmentation, VPN, or reverse-proxy access controls that block direct HTTP to that component are not exposed to external actors. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and affected versions are strictly limited to 12.2.1.4.0 and 14.1.2.1.0.
A low-privileged authenticated attacker with HTTP network access can fully compromise Oracle WebCenter Portal through its Composer component, achieving complete loss of confidentiality, integrity and availability plus a scope change that can extend impact to connected downstream products. Only versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and the attack requires no user interaction and has low complexity - the sole meaningful barrier is that an attacker must already hold valid credentials (PR:L), so this is not a pre-authentication flaw. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but the 9.9 CVSS score and the ease of exploitation once credentials are obtained make this a high-priority patch item.
Unauthenticated remote attackers can achieve full takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 through an authentication bypass reachable over HTTP, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector that drives the 9.8 base score. No authentication, user interaction, or non-default configuration is required - the only practical prerequisite is network reachability of the WebCenter Sites HTTP interface, which means internet-exposed authoring or delivery instances carry the highest risk. The flaw is rated CWE-287 (Improper Authentication), and at time of analysis there was no public exploit code identified and no confirmed active exploitation (not listed in CISA KEV); Oracle has published a Critical Security Patch Update advisory covering the affected versions.
Malformed HTTP/2 CONNECT stream injection in Red Hat JBoss EAP and the wider Red Hat middleware stack (Quarkus, Keycloak, Camel for Spring Boot 4 and Quarkus 3, Data Grid 8, AMQ Broker 7, Fuse 7, Apicurio Registry 3, Debezium 3) lets unauthenticated remote attackers control the :authority of an upstream HTTP/2 CONNECT when the product is deployed as an HTTP/1-to-HTTP/2 translating proxy or gateway. The client-supplied Host header from an HTTP/1 authority-form CONNECT is copied verbatim into the HTTP/2 :authority pseudo-header, so the fronting component and the HTTP/2 backend can disagree about the routing target, yielding an integrity impact (vendor CVSS 3.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N; our assessment raises the attack complexity to High and the scope to Changed because a H1→H2 CONNECT translation path and a fronting-proxy topology are required). No public exploit identified at time of analysis, and no EPSS or CISA KEV data was provided.
Remote unauthenticated attackers can exhaust memory in Netty-based services that parse PROXY protocol v2, due to a reference-count leak in the handling of nested TLVs within HAProxyMessageDecoder, leading to denial of service. The flaw is an incomplete fix of upstream PR #16881, so partially patched deployments may remain vulnerable through the grandchild-TLV code path. It affects numerous Red Hat products bundling Netty, such as JBoss EAP 7, Keycloak, and Quarkus, and no public exploit code has been identified at time of analysis.
Unbounded per-connection queue growth in Netty's WebSocketServerExtensionHandler lets unauthenticated remote attackers exhaust server memory (OutOfMemory) and cause denial of service in Red Hat products that bundle the affected Netty code, including AMQ Broker 7, AMQ Clients, Build of Keycloak, Build of Quarkus, Camel for Spring Boot 4, Camel 4 for Quarkus 3, Data Grid 8, Fuse 7, JBoss EAP 7/8, Single Sign-On 7, Apicurio Registry 3 and Debezium 3. The flaw carries CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - unauthenticated, no user interaction, availability-only) and is reachable only where a Netty-based server exposes a WebSocket endpoint that negotiates protocol extensions such as permessage-deflate to untrusted clients. No public exploit identified at time of analysis, and no CISA KEV listing; impact is confined to availability, with no confidentiality or integrity loss.
Memory exhaustion in Netty's SMTP client response decoder (SmtpResponseDecoder) allows an attacker who controls or can intercept the SMTP server that an application talks to, to force that application to accumulate unlimited multi-line responses until heap is exhausted. The defect is a pure availability issue (C:N/I:N/A:H, CVSS 7.5, AV:N/AC:L/PR:N/UI:N) and is reachable without authentication or user interaction on the victim side, but exploitation is conditional: the vulnerable JVM must have Netty's SMTP client codec active and must establish an SMTP session with a hostile or man-in-the-middle peer, since only server responses are parsed. Shipping products affected through bundled Netty include Red Hat JBoss Enterprise Application Platform 7, Red Hat Fuse 7, Red Hat Single Sign-On 7 and Red Hat Build of Apache Camel for Spring Boot 4; no public exploit code has been identified at time of analysis and there is no confirmed CISA KEV entry.
Heap exhaustion in Netty's Redis array aggregator, as shipped inside Red Hat products such as JBoss Enterprise Application Platform 7, Red Hat Fuse 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, lets a remote unauthenticated attacker crash the JVM by sending a tiny stream of nested RESP array headers. Because the decoder eagerly allocates an ArrayList sized to the declared array length before any child element arrives, roughly 12 KB of crafted input can reserve about 1.02 billion child slots when the default 1024-level nesting limit and default element limit are in effect; the impact is availability-only, with no data read or modified. Exploitation is limited to deployments that feed attacker-reachable, untrusted RESP/Redis-protocol traffic into the Netty codec with the default constructor; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Denial of service in Netty's MQTT decoder lets unauthenticated remote attackers exhaust server memory and CPU by sending a crafted CONNECT packet whose Properties Length is enormous while its Remaining Length stays small, bypassing the maxBytesInMessage guard that was added to fix CVE-2026-44248. The issue affects any Netty pipeline that runs io.netty.handler.codec.mqtt.MqttDecoder and exposes an MQTT listener; downstream Red Hat products such as AMQ Broker 7, Fuse 7, JBoss EAP 7, Red Hat Single Sign-On 7, and Red Hat Build of Apache Camel for Spring Boot 4 are listed as affected. No public exploit has been identified at time of analysis, and the practical risk is bounded by the need to expose an MQTT endpoint.
Cross-origin data exposure in RESTEasy's CorsFilter (CVSS 7.4) occurs when a deployment is configured with allowedOrigins set to the wildcard '*' together with allowCredentials=true, causing the filter to reflect the caller's Origin header back in Access-Control-Allow-Origin alongside Access-Control-Allow-Credentials: true. Because that configuration defeats the browser's built-in guard against combining wildcard origins with credentials, an attacker who lures an already-authenticated user (UI:R) to an attacker-controlled page can issue credentialed cross-origin requests and read that user's authenticated API responses - a confidentiality-only impact (C:H/I:N/A:N), with no integrity or availability effect. The prerequisite wildcard-plus-credentials CORS configuration is a non-default operator choice, and analysis identifies no public exploit identified at time of analysis.
A remote, unauthenticated attacker can exhaust the JVM heap and cause a denial of service by sending a small crafted image to any RESTEasy (JAX-RS) endpoint that consumes an image request body, because the framework's IIOImageProvider decodes the image through ImageIO without validating declared dimensions or pixel count. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a clean, low-complexity, availability-only flaw with no confidentiality or integrity impact, consistent with CWE-409 data amplification. Reachability is the key limiting factor: only applications that actually expose a resource method consuming image content types through the image provider are affected, and no public exploit code was identified at time of analysis.
Memory corruption in snappy-java through 1.1.10.8 lets an attacker terminate the JVM hosting the library: the Snappy.compress(ByteBuffer, ByteBuffer) overload writes past the end of the destination buffer when incompressible input exceeds its remaining capacity, corrupting off-heap memory. Exposure is limited to Java applications that call that specific ByteBuffer overload with attacker-influenceable, low-compressibility data and a destination buffer that was not sized using Snappy.maxCompressedLength(); code using the byte[]-based compress API or compressing only trusted data is not exposed. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 vector reports PR:N, and the independent assessment agrees with AV:N/PR:N/UI:N), but the impact is availability-only - no confidentiality or integrity loss and no code execution - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Server-side request forgery in Prebid Server Java before 3.43.0 allows unauthenticated remote attackers to redirect the server's outbound bidder traffic to arbitrary destinations by injecting values into bidder adapter parameters. Multiple adapters - including acuityads, adhese, adtonos, adview, axonix, bidmachine, blis, clydo, contxtful, elementaltv, and eplanning - interpolate user-supplied imp.ext fields (host, path, sellerId, accountId, supplierId, supplyId, partnerId, customerId, adunit) directly into endpoint URL templates without calling HttpUtil to validate the resulting domain or path segment, so a crafted bid request can make the server reach internal network services, cloud metadata endpoints such as 169.254.169.254, or other sensitive endpoints using its own network position. No public exploit identified at time of analysis; the vendor's CVSS score of 10.0 overstates the assessed impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), and real-world severity depends on which of the affected adapters are actually enabled and on the network adjacency of the server.
OS command injection in JabRef's built-in HTTP server (CWE-78) lets a caller who can reach the localhost GET /better-bibtex/cayw endpoint with application=sublime smuggle shell metacharacters through the untrusted cite-command prefix, which is concatenated with citation keys and executed via sh -c by PushToSublimeText without escaping, achieving arbitrary command execution as the JabRef user. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:A) shows this is remotely reachable and requires no authentication, but exploitation is gated behind a stack of non-default conditions: the built-in server must be enabled or jabsrv running, a valid Sublime Text command path must be configured as a push target, only Unix-like systems are affected because of the sh -c invocation, and the victim must actively complete the CAYW citation selection dialog. No KEV listing and no public exploit code were identified at time of analysis; the layered opt-in and interaction requirements keep real-world risk comparatively low despite the high confidentiality, integrity and availability impact if the preconditions are met. The flaw is fixed in 6.0-alpha.6.
SQL injection in the Traccar GPS tracking server affects all versions prior to 6.14.0 and allows an authenticated, non-read-only user to extract arbitrary database values - including administrator email addresses, password hashes and salts - or to conditionally delete permission rows. The attacker submits a DELETE /api/permissions request with an extra, attacker-chosen JSON key: only the first two keys are validated by Permission.java, while DatabaseStorage.removePermission() concatenates every map key into the SQL WHERE clause as a column identifier, turning the key name into injectable SQL and providing a blind boolean/error oracle. Exploitation requires a valid account with write permissions and access to at least one object usable in a permission pair; unauthenticated requests are explicitly rejected (CVSS 3.1 7.1, PR:L, C:H/I:L). No public exploit code has been identified at time of analysis, and a vendor-released patch (6.14.0) is available.
Heap exhaustion in AsyncHttpClient (AHC) 2.0.0 through 2.16.0 and 3.x before 3.0.12 allows any server the client calls - or anyone able to rewrite a response in transit - to kill the client JVM by returning a small gzip, deflate, or snappy body that inflates without bound across chunks until the process raises OutOfMemoryError. The vulnerable path is automatic response decompression on HTTP/1.1, and on releases 3.0.8 through 3.0.10 the HTTP/2 decompressor is unbounded as well, so switching protocols does not mitigate; brotli and zstd are also affected when those optional codecs are on the classpath. This is an availability-only issue (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/A:H) with no public exploit identified at time of analysis, and realistic exposure is limited to deployments that make outbound HTTP requests to untrusted, attacker-influenceable, or user-supplied URLs.
AsyncHttpClient (AHC) 2.1.0 through 2.16.0 and 3.0.x before 3.0.12 can disclose authenticated SOCKS proxy credentials - including directly reversible Basic credentials and NTLM/Kerberos/SPNEGO material - to the origin server because the library attaches a Proxy-Authorization header to a request carried over a SOCKS tunnel without first confirming that the destination is an HTTP proxy. Any Java application that configures AHC with an authenticated SOCKS4 or SOCKS5 proxy in those versions is exposed: in the preemptive-authentication path the header is emitted on plaintext HTTP requests to any origin, and in the default non-preemptive path a hostile origin that answers with HTTP 407 triggers ProxyUnauthorized407Interceptor to push the proxy credentials back through the tunnel to that origin. The reporter-assigned CVSS is 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), a confidentiality-only, high-impact issue that requires an authenticated SOCKS proxy configuration to be present; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Denial of service in the Red Hat Quarkus WebSockets Next extension (quarkus-websockets-next), as shipped in Red Hat Build of Quarkus and Red Hat Enterprise Linux AI (RHEL AI) 3, allows a remote, unauthenticated attacker to crash the Java Virtual Machine by streaming WebSocket messages over a single connection faster than the application can consume them. Unbounded message buffering combined with a lack of read backpressure exhausts heap memory, producing a java.lang.OutOfMemoryError that terminates the JVM and takes the hosting service offline; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms availability-only impact with no confidentiality or integrity loss and requires no authentication, user interaction, or special configuration beyond an attacker-reachable WebSocket endpoint. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was included in the available intelligence; the practical risk is governed by exposure, since only applications serving a WebSocket route to untrusted networks are reachable.
Session fixation in the default security configuration of Opencast prior to 19.7 and 20.2 lets an unauthenticated attacker who can deliver a crafted link to a victim hijack that victim's authenticated session. Because the shipped etc/security/mh_default_org.xml accepts a client-supplied JSESSIONID via the ;jsessionid= URL path parameter and does not regenerate the identifier at login, an attacker who knows the fixated value can reuse it once the victim authenticates - exposing the victim's data and actions, and escalating to full administrative account takeover when the victim is an administrator. Exploitation requires user interaction (the victim must open the link while holding no active Opencast session cookie and then log in), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated file upload in admin3 through 3.0.0 allows a user with an account and access to the storage handler to escape the configured storage root on Windows deployments by supplying filenames containing dot-dot path segments, overwriting any file the server process can write. The vulnerability requires authentication (CVSS 4.0 vector PR:L) and the reported escape path is Windows-specific, which narrows the exploitable population below what a raw network-vector score would suggest, and impact is bounded to files writable by the server process account. Publicly available exploit code exists, making the flaw a mid-tier but actionable finding for exposed Windows installations.
Session token harvesting in cjbi admin3 through version 3.0.0 lets any authenticated account holding the log:view permission read bearer credentials out of the audit-log event body returned by GET /logs. Because the UserLoggedIn domain-event handler writes the user's live session token into the logged event JSON, an attacker who opens the log-viewing screen can extract tokens belonging to other users - including administrators - and replay them as bearer credentials for full account takeover, yielding high confidentiality, integrity, and availability impact (CVSS 8.7). Publicly available exploit code exists (a PoC script is published for this CVE), though there is no indication of confirmed active exploitation; the assessed vector is AV:N/AC:L/PR:L/UI:N, so a valid low-privileged log-viewing session is mandatory, and the payoff depends on a higher-privileged user holding an active, unexpired session at the time the log is read.
Server-side request forgery (SSRF) in Graylog through version 7.1.4 allows an authenticated user who holds lookup table or event notification permissions to coerce the Graylog server into fetching internal services. The flaw occurs because Graylog validates outbound URLs against an allowlist only before the initial request and does not re-validate the destination after an HTTP redirect; an attacker can supply an allowlisted endpoint that redirects to an internal address, and the server returns the internal response. This is a confidentiality-only issue (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no public exploit identified at time of analysis.
Unauthenticated Kryo deserialization in the Angel-ML Angel distributed machine-learning coordinator (all versions through 3.3.0) lets any remote attacker who can reach the master RPC endpoint submit crafted setAlgoMetrics payloads that instantiate arbitrary classes or exhaust coordinator memory, producing denial of service and - when exploitable gadget classes are present on the coordinator classpath - remote code execution. No authentication or user interaction is required, but exploitation depends on network reachability to the master RPC service and, for the RCE outcome specifically, on the composition of the target's classpath; the memory-exhaustion outcome carries no such precondition and is reliably achievable. No public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing); the referenced GitHub issue and source-file links document the flaw but no patched release has been published.
Missing authorization checks in DiDi KnowStreaming through 3.4.1 allow any authenticated user - regardless of assigned role - to reach protected REST API functionality, including identity-management endpoints that can create administrator accounts or elevate the caller's own privileges. Exploitation requires only a valid low-privilege login (PR:L) with network reach to the REST API; no admin role, user interaction, or non-default configuration is needed, which makes the flaw most dangerous in deployments where accounts are broadly provisioned or self-registration is enabled. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation, but the complete loss of confidentiality, integrity, and availability on affected systems keeps this a genuinely high-priority privilege-escalation issue.
Authenticated attackers holding any valid low-privilege role in metasfresh can read, replace, and delete attachments and comments belonging to records their role is not permitted to access. The DocumentAttachmentsRestController and CommentsRestController endpoints enforce only login state and never apply metasfresh's record-level (role/organization) permissions, so an attacker who enumerates sequential document identifiers can traverse records across access boundaries - an insecure direct object reference (CWE-639) rated 8.7 under CVSS 4.0 (CVSS 3.1 assessment: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). Exploitation requires a valid account and sequentially enumerable identifiers; no public exploit code exists, and there is no confirmed actively exploited (CISA KEV) status at time of analysis.
Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has the External Database Access feature configured, via insecure deserialization of a crafted Java byte stream sent to the feature's TCP port (CWE-502). Vendor scoring is 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment rates it AV:N/AC:H/PR:N/UI:N because exploitation additionally requires the attacker to control a host already listed in the external database access list and to reach that specific port - a trust relationship that gates who can hit the vulnerable endpoint. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the attack surface is substantially reduced where the FMC management interface is not exposed to the public internet.
Root-level command execution on Cisco Identity Services Engine (ISE) is achievable by an authenticated, high-privileged administrator who sends a crafted serialized Java object to an affected node, allowing arbitrary commands to run on the underlying operating system. The flaw is insecure Java deserialization (CWE-502) that yields user-level OS access escalating to root, and in single-node deployments a successful exploit can also render the ISE node unavailable, so endpoints that have not already authenticated cannot reach the network until the node is restored. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the vendor's CVSS 9.1 is driven by the scope change (S:C) and full C:H/I:H/A:H impact, but exploitation requires valid high-privileged administrative credentials (PR:H), which is the primary limiting factor.
Denial of service in HAPI FHIR core (org.hl7.fhir.core) before 6.9.12: remote attackers who can reach an endpoint that parses Smart Health Card content can submit a JWT whose header declares zip:"DEF" with an empty or truncated raw-DEFLATE payload, driving SHCParser.decodeJWT() into a non-terminating Inflater loop that pins a JVM worker thread indefinitely. The trigger is unauthenticated and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and because each malformed request consumes a validation worker permanently, concurrent submissions can exhaust the entire worker pool and make legitimate FHIR validation unavailable. No public exploit code has been identified at time of analysis, and the risk is bounded: a deployment that never feeds untrusted Smart Health Card data into SHCParser (directly or through ResourceChecker file-format detection) is not remotely exploitable despite the network attack vector, with impact limited to availability only - no confidentiality or integrity loss.
Unbounded DEFLATE decompression in HAPI FHIR's SHCParser (org.hl7.fhir.core prior to 6.9.12) allows an unauthenticated remote attacker to exhaust heap memory by submitting a small Smart Health Card JWT whose header sets zip:"DEF" and whose compressed payload inflates to an arbitrarily large size, resulting in severe garbage-collection pressure, request failure, process instability, or process termination. The issue is confined to the decompression path in SHCParser.decodeJWT(), SHCParser.inflate() and SHCParser.decompress(), which accumulate all output in a ByteArrayOutputStream before any size check occurs; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though no EPSS estimate was supplied in the source data. The practical exposure is bounded by reachability: any application, validator service, or API endpoint built on org.hl7.fhir.core that accepts attacker-supplied SHC/JWT content and routes it through SHCParser before 6.9.12 is affected, while deployments that never expose SHC parsing to untrusted callers have effectively no network attack surface.
Memory exhaustion in the RabbitMQ Java client (all versions prior to 5.34.0) lets a rogue AMQP broker or an in-path attacker crash the JVM host application: when both the client's default ConnectionFactory.DEFAULT_FRAME_MAX and the server's Connection.Tune frame_max negotiate to 0, the library's maxInboundMessageBodySize cap is silently discarded and an oversized inbound frame is allocated without limit. Attackers cannot force this against a passive, correctly connected client - the victim must connect outbound to attacker-influenced infrastructure, or the attacker must hold a man-in-the-middle position able to rewrite the Connection.Tune frame and inject frames, which the vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) and our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) both treat as an unauthenticated, availability-only denial of service with no code execution or data exposure. Impact is limited to terminating the client process via heap exhaustion, and there is no public exploit identified at time of analysis and no CISA KEV listing; vendor-released patch: 5.34.0.
Authenticated remote code execution in Cisco ISE allows an attacker with low-privileged administrative credentials to execute arbitrary commands on the underlying operating system and elevate to root via insecure deserialization of a crafted Java object sent to the web-based management interface. Exploitation requires network access to the management interface and valid low-privileged admin credentials (CVSS 9.9, PR:L), and successful attacks on single-node deployments can cause a denial-of-service condition that prevents unauthenticated endpoints from accessing the network. No public exploit has been identified at time of analysis.
Improper access control in stylefeng Guns through 8.3.5 lets any authenticated user, even one with no assigned roles, create, edit, delete, publish, and retract system-wide notices via SysNoticeController actions that never require a permission. The issue is remotely exploitable with low privileges and high integrity impact but no confidentiality or availability impact; no public exploit code has been identified at time of analysis, and authentication is required (PR:L) because the attacker must already have a valid Guns session.
Missing authorization in the Guns Java rapid-development framework (through 8.3.5) allows any authenticated user to harvest the full user directory, including account names, real names, email addresses, phone numbers, last-login IPs and role assignments. The /sysUser/detail and /sysUser/page handlers in SysUserController omit the requiredPermission annotation, so the TokenAndPermissionInterceptor performs no RBAC check on them and returns data for every user in the system to anyone holding a valid login token. The attack is network-reachable and needs only a low-privileged authenticated session (PR:L), with no user interaction and no administrative rights; no public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was supplied in the source data.
Server-side request forgery with a local file inclusion component in Apache MyFaces - the JSF implementation referred to in the CVE text as 'Apache MyFace Core' - allows an unauthenticated remote attacker to send a single crafted request that makes the application server dereference an attacker-controlled address or file path, yielding disclosure of internal service responses and sensitive local files. The vendor rates this 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); our independent assessment keeps the unauthenticated, network-reachable, low-complexity profile but models the integrity impact as Low rather than High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), since the disclosed mechanism is primarily read/dereference oriented. Exploitation is constrained only by reachability of a vulnerable JSF endpoint on an affected release (2.2.0-beta-2.2.15, 2.3.0-2.3.11, 2.3-next-M1-M8, 3.0.0-3.0.3, 4.0.0-4.0.3, 4.1.0-4.1.3, plus older unsupported versions) and by the presence of interesting internal targets; vendor patches are already released and no public exploit code was identified at time of analysis.
Authenticated path traversal in Apache NiFi Registry 0.4.0 through 2.11.0 allows a user who is authorized to both write and delete extension bundles in a bucket to upload a NAR whose manifest carries crafted parent-directory group, artifact, or version coordinates, causing the default file persistence provider to perform file system operations outside the configured persistence directory. Impact is limited to integrity and availability (files created, overwritten, or deleted outside the storage root) rather than confidentiality or remote code execution, and exploitation requires a valid account with write-plus-delete bundle privileges on a deployment using the default file persistence provider. There is no public exploit identified at time of analysis and no CVSS-vector indication of unauthenticated reach; upgrading to Apache NiFi Registry 2.12.0 closes the vector by rejecting parent-directory coordinates and enforcing a normalized strict-child path check.
Authorization bypass in ScadaLTS 2.8.1-release-candidate build 0 lets any authenticated user invoke restricted DWR methods by sending a POST to a URL their role is allowed to reach while naming a privileged class and method in the request body, bypassing Spring Security's URL-pattern-only access control; the assessed severity is CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with high confidentiality, integrity, and availability impact once the flaw is chained with the other Tenable-reported findings it enables. Exploitation is not anonymous: the attacker must already hold a valid low-privilege ScadaLTS session, and the deployment must run with DWR's crossDomainSessionSecurity setting set to false in web.xml (the default in the affected build), which disables DWR's built-in origin and session validation. No confirmed active exploitation (CISA KEV) and no public exploit code were identified in the available intelligence at time of analysis, so the practical urgency is driven by the credential precondition rather than by observed attacks.
This is a genuine but bounded-priority integrity flaw: in TDuck Survey Form through version 5.0, any authenticated low-privilege user can overwrite other respondents stored form submissions by calling POST /user/form/data/update with a submission identifier that does not belong to them, because the endpoint performs no ownership validation (CWE-639). Confidentiality and availability are unaffected, so the realistic impact is corruption or falsification of collected survey data, including responses containing personal information, rather than data theft or denial of service. Exploitation requires only a valid account (authenticated, PR:L) with no admin role, user interaction, or non-default configuration, and it is aided by submission identifiers being allocated in narrow, guessable ranges; no public exploit code has been identified at time of analysis and the issue is not reported as actively exploited.
Unauthenticated server-side request forgery in DataGear through 6.0.0 lets any remote attacker who can reach the web interface force the server to issue arbitrary HTTP requests - GET, POST, PUT, PATCH, or DELETE - to internal hosts and cloud metadata services via the /dataSet/preview/Http endpoint, returning the full response body to the caller. The endpoint is reachable without credentials (it is exempted by the SecurityConfigSupport allowlist), so the only prerequisite is network reachability to the DataGear instance, with impact maximized in cloud deployments where the link-local metadata service at 169.254.169.254 is reachable and can yield IAM credential theft. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and no vendor-released patch has been identified.
Stored cross-site scripting in Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier lets an attacker who already holds Item/Configure permission on a job submit a job configuration through the REST API with a javascript: scheme URL in the unvalidated coverage results ID field, which is then stored and rendered when a victim later opens the job's coverage page. Exploitation therefore requires authenticated low-privilege access (CVSS PR:L) plus victim interaction (UI:R), meaning it is not usable against default unauthenticated Jenkins deployments; Impact on confidentiality, integrity and availability is rated High (CVSS 8.0). No public exploit code or confirmed active exploitation was identified at time of analysis, and CISA's SSVC assessment records Exploitation: none and Automatable: no.
Stored cross-site scripting in Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier lets an authenticated attacker holding Item/Configure permission inject a javascript: scheme value as the analysis results identifier by submitting a job configuration through the REST API, bypassing the validation that the normal UI path performs. The payload is persisted with the job and executes in the browser of any user who later opens the affected Warnings/analysis results page (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, 8.0, CWE-79). No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none and automatable as no, although technical impact is rated total; vendor patches are available in 13.10259.v80f407cb_03a_e and the backport 13.10223.10225.vcf001b_b_b_3a_90.
Sandbox escape in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier allows an authenticated Jenkins user who is permitted to define and run sandboxed scripts - including Pipeline jobs - to break out of the Groovy sandbox and execute arbitrary code on the Jenkins controller. The flaw is a protection-mechanism failure (CWE-693): the sandbox's call-site interception does not cover methods that are added dynamically to a class at runtime, so a crafted script can invoke such a method and run code that should have been blocked. Exploitation requires script-authoring privileges (PR:L) and a deliberately crafted script (AC:H) with no user interaction, giving high confidentiality, integrity, and availability impact on the controller; no public exploit code was identified at the time of analysis, and the practical risk is concentrated in multi-tenant Jenkins deployments where lower-trust users are delegated Pipeline authoring.
Arbitrary code execution in the Jenkins Script Security Plugin (versions up to and including 1415.v9a_f9b_3a_c253d) lets an authenticated attacker who holds permission to define classpath entries run attacker-supplied code inside the Jenkins controller JVM. The plugin downloads the URL-specified JAR twice - it verifies approval against the first response but then loads classpath entries from the second - so an attacker who controls the hosting server can present a benign, approvable JAR on request one and a malicious JAR on request two. The assessed CVSS 3.1 vector (7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects this time-of-check/time-of-use race: the flaw is remotely reachable but requires an authenticated classpath-defining user and a reliably won race; there is no public exploit code and no confirmed active exploitation identified at time of analysis.
Arbitrary code execution in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier: when a user with job-configure privileges defines classpath entries in an item configuration, those entries are silently auto-approved the moment a user holding Overall/Administer permission copies that item or updates its configuration through the REST API or CLI. The result is code execution inside the Jenkins controller JVM (CWE-94, CVSS 8.0), but exploitation is a two-actor, confused-deputy scenario: the attacker needs pre-existing config-edit rights (PR:L) and must wait for a privileged user to perform the copy or API/CLI update (UI:R), so installations where only administrators author jobs and never copy them or drive configuration through REST/CLI are effectively unexposed. No public exploit code or confirmed active exploitation was identified at time of analysis.
Sandbox escape in the Jenkins Script Security Plugin (1415.v9a_f9b_3a_c253d and earlier) allows an authenticated Jenkins user who holds permission to define and run sandboxed scripts - including Pipelines - to execute code outside the Groovy sandbox by supplying an @Builder annotation whose builderStrategy member names an arbitrary class. Exploitation additionally requires that a suitable "gadget" class be present on the classpath of the component that evaluates the script, which is why the assessment rates it AC:H despite high C:H/I:H/A:H impact and a scope change (S:C) across the sandbox boundary; the limitation is that only instances where untrusted or low-privilege users can author sandboxed scripts are meaningfully exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.20% (11th percentile), consistent with a high-severity but precondition-heavy flaw rather than a mass-exploitable internet threat.
Sandbox escape leading to arbitrary code execution inside the Jenkins controller JVM affects Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier because the plugin fails to reject the @GroovyASTTransformationClass annotation in script source. An authenticated Jenkins user with permission to define and run sandboxed scripts, including Pipelines (the CVSS vector carries PR:L), can submit a script that registers a Groovy AST transformation executed at compile time, before the sandbox applies, resulting in high confidentiality, integrity, and availability impact on the controller; our independent assessment scores this 8.8 with a scope change (S:C) rather than the provider's S:U. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but for any account holding script-submission rights the exploit path is direct rather than theoretical, so the practical risk concentrates on instances that grant Job/Configure or equivalent Pipeline-authoring rights broadly. This is a genuine high-priority vulnerability, not CVSS inflation: the sandbox itself, not a misconfiguration, is the control being bypassed.
Arbitrary code execution in Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier allows an authenticated attacker with permission to define and run sandboxed Groovy scripts or Pipelines to bypass the sandbox and run code in the Jenkins controller JVM. The flaw is a protection mechanism failure (CWE-693) in how the plugin casts collections, and it carries CVSS 8.8 with PR:L; only users who can author sandboxed scripts or Pipelines can trigger it. No public exploit code was identified at time of analysis, and CISA SSVC rates exploitation as none, but this is high-priority for multi-tenant Jenkins because script-authoring rights are often broadly granted.
Sandbox escape in the Jenkins Script Security Plugin (1415.v9a_f9b_3a_c253d and earlier) allows authenticated users with permission to define and run sandboxed Groovy or Pipeline scripts to execute arbitrary code in the Jenkins controller JVM, because the sandbox fails to intercept method calls, property and attribute accesses, and array accesses made on a null receiver. No non-default configuration is required - the weakness is inherent to the default sandbox - and the flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-693), with CISA SSVC assessing total technical impact but no active exploitation and no public exploit identified at time of analysis. Real-world urgency is moderated by the access prerequisite: the attacker must already hold script-authoring rights, so exposure is concentrated in multi-tenant or delegated Jenkins instances where Pipeline authoring is granted to less-trusted users.
Sandbox escape in the Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier lets an authenticated user who holds permission to define and run sandboxed scripts - including Pipelines - execute arbitrary code in the Jenkins controller JVM, earning a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The root cause is a protection-mechanism failure (CWE-693): the sandbox proxy created when a script coerces a value to a Java interface skips the method check when the coerced value inherits a same-named method, so the interface proxy can be used to reach unchecked code. No public exploit code has been identified at time of analysis and CISA SSVC rates the issue non-automatable (Exploitation: none, Automatable: no, Technical Impact: total), so mass exploitation is not expected; the binding prerequisite is the authenticated script-authoring permission reflected by PR:L, which makes this a real but privilege-gated RCE-class risk.
Arbitrary file deletion in zlt2000 microservices-platform through 6.0.0 allows authenticated attackers to delete any user's files and metadata due to missing ownership validation in the file-center module's DELETE /files/{id} endpoint. Attackers can enumerate file identifiers via GET /files and then delete arbitrary files, bypassing authorization controls (CWE-639); publicly available exploit code exists. Exploitation requires a valid, low-privilege account (PR:L) with access to the file-center REST API, and the impact is limited to integrity and availability (no data disclosure), with a CVSS 4.0 base score of 7.2.
Authenticated attackers can read arbitrary Elasticsearch indices in zlt2000 microservices-platform through 6.0.0 by supplying any index name in the POST /search/{indexName} or GET /agg/requestStat/{indexName}/{routing} endpoints, bypassing authorization checks. This exposes sensitive data such as the sys_user index containing user records and password hashes; the vulnerability has a CVSS 4.0 base score of 7.1 and an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning high confidentiality impact with no integrity or availability effect. Publicly available exploit code exists (no CISA KEV confirmation), and exploitation requires only a valid low-privilege session on a network-reachable search-center service.
Authenticated users of zlt2000 microservices-platform through 6.0.0 can overwrite the password of any non-administrator account by calling the PUT /users/password endpoint with an arbitrary user id and a new password, because the server never verifies the current password. The flaw is network-reachable, low-complexity, and requires only a low-privilege login session (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:L), and publicly available exploit code exists. Exploitation is limited to non-administrator accounts and is not possible pre-authentication, but a successful attack yields full credential takeover of the targeted account.
Missing authorization in zlt2000 microservices-platform through 6.0.0 lets any authenticated account - including one with zero assigned roles - invoke administrative APIs for user management, role assignment, password resets by user ID, and Elasticsearch index deletion, because the shipped default of zlt.security.auth.urlPermission.enable is false and suppresses all permission checks once authentication succeeds. Exploitation is not pre-auth: it requires a valid low-privilege session against a deployment running the out-of-the-box configuration, and publicly available exploit code exists (VulnCheck-reported PoC scripts covering role-granting, user enumeration, password reset, and ES index deletion), though no confirmed active exploitation (CISA KEV) has been recorded. Assessed severity is high (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8; vendor-published CVSS 4.0 score 8.7) because a zero-role user obtains both read and write access to sensitive administrative functions.
Authenticated back-office users of yshop-crm through 2.1.3 can enumerate the complete user directory via GET /admin-api/system/user/page because the endpoint's @PreAuthorize('system:user:list') gate is commented out in UserController.java. The flaw is a broken-access-control issue (CWE-862) that requires valid admin-panel credentials plus a role configured with data scope ALL; without that scope the query returns little of value, but with it an attacker can harvest login names, nicknames, departments, emails, mobile numbers, and last-login metadata. Publicly available exploit code exists (a Python enumeration PoC), and no CISA KEV entry confirms active exploitation at time of analysis. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning authenticated remote confidentiality loss only - no integrity or availability impact.
Missing authorization in yshop-crm 2.1.3 and earlier lets any authenticated back-office (admin-api) user delete arbitrary approval-workflow steps via DELETE /admin-api/crm/flow/delete-step, bypassing the permission check that should restrict this to workflow administrators. The result is an integrity-only compromise of the approval chains that gate contract, receivable, and invoice finalization; there is no confidentiality or availability impact, and the CVE record's CVSS 4.0 score of 7.1 maps to an independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, i.e. a genuine but moderate-priority missing-authorization flaw rather than a critical takeover. Publicly available exploit code exists (a Python PoC against the delete-step endpoint); no CISA KEV listing or other confirmation of active in-the-wild exploitation was present in the supplied data.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user - including low-privilege operators - to read the installation-wide audit trail by calling GET /admin-api/crm/operatelog/page, exposing operator names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers. Publicly available exploit code exists (a PoC script that queries the endpoint), and although exploitation requires a valid back-office session with network reach to the admin API, no elevated role or user interaction is needed, so the realistic threat is a malicious insider or anyone who has reused or stolen an operator credential. The vulnerability is broken access control (CWE-862) with high confidentiality impact only; it does not permit data modification, service disruption, or pre-authentication compromise.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to claim and reassign sales leads belonging to other employees by invoking the CrmCluesController receiveCustomer lead-claim endpoint with a manipulated ownerUserId value. The flaw is a broken access control (CWE-862) issue that requires only a valid low-privilege staff login and no administrative role, feature toggle, or user interaction, with the practical impact limited to integrity of lead ownership data (no confidentiality or availability impact). Publicly available exploit code exists in the form of a Python proof-of-concept targeting the endpoint, and the absence of access logging or quota validation on the operation removes any built-in brake on bulk lead theft, though no confirmed active exploitation (CISA KEV) has been observed at time of analysis.
Missing authorization in yshop-crm through 2.1.3 allows any authenticated back-office user to issue arbitrary invoices by calling the PUT /admin-api/crm/invoice/issue endpoint, which performs no permission check on the caller. An attacker holding low-privileged back-office credentials can set an invoice's status, overwrite contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary recipient addresses - a pure integrity impact with no confidentiality or availability loss. Publicly available exploit code exists (a Python PoC in the LinYuanyi1 cve-request-poc repository), but there is no evidence of confirmed active exploitation (CISA KEV).
Server-side request forgery in kkFileView 4.2.0 and later lets remote, unauthenticated attackers make the server fetch arbitrary URLs and read the echoed response body via the cross-origin file proxy endpoint /getCorsFile. The flaw is a validation/consumption mismatch: TrustHostFilter checks the first non-empty parameter in a fixed priority order against the trust.host whitelist, while the controller only reads and fetches urlPath, so a request supplying both a whitelisted decoy (url) and the real target (urlPath) passes validation and fetches the unvalidated target. Our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - high confidentiality impact with no integrity or availability impact, somewhat lower than the vendor's 9.1 - and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Remote compromise of Oracle GraalVM is possible: an unauthenticated attacker with HTTP access can exploit a defect in the Compiler component to achieve full takeover of the affected runtime, with high confidentiality, integrity and availability impact. Affected builds are Oracle GraalVM for JDK 17 (23.0.13.1), Oracle GraalVM for JDK 21 (23.1.12.1) and Oracle GraalVM 25 (25.0.4.1). No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently assessed as targeted rather than opportunistic; note that the accompanying 'Information Disclosure' tag understates the stated impact.
Oracle GraalVM (including GraalVM for JDK 17/21, GraalVM Enterprise Edition and GraalVM 25.x) contains a flaw in its Compiler component that a network-positioned attacker can reach over HTTP without authenticating. Successful exploitation can expose critical data, allow limited unauthorized modification of data, and cause a partial denial of service; Oracle characterizes the issue as difficult to exploit per the AC:H metric, implying attacker-controlled timing or memory-layout preconditions. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.0 with a high confidentiality impact.
Remote compromise of Oracle GraalVM for JDK is achievable through a flaw in the bundled Compiler component, where a crafted attack delivered over HTTP can lead to full takeover of the affected runtime with high confidentiality, integrity, and availability impact. The vulnerability affects Oracle GraalVM for JDK 17 version 23.0.13.1, Oracle GraalVM for JDK 21 version 23.1.12.1, and Oracle GraalVM 25.0.4.1, and Oracle explicitly rates it as 'difficult to exploit' (CVSS 3.1 AC:H) despite an 8.1 base score and no authentication requirement. No CISA KEV listing, EPSS score, or public exploit code was provided in the source data, so active exploitation is not confirmed at time of analysis.
Oracle GraalVM 25.0.4.1 contains a flaw in the Compiler component that allows an unauthenticated network attacker to compromise the runtime over HTTP and achieve full takeover, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N). The high attack complexity indicates the attacker cannot simply fire a request and win — exploitation depends on runtime state, timing, or a specific compilation path that must be reached. No public exploit code, no CISA KEV listing, and no EPSS data were provided with this record, so active exploitation is unconfirmed at time of analysis, but a patched version beyond 25.0.4.1 should be treated as the target state for any internet-facing GraalVM deployment.
Oracle GraalVM 25.0.4.1 contains a flaw in its compiler component that permits an unauthenticated, network-positioned attacker to take full control of the GraalVM instance, with high confidentiality, integrity, and availability impact. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and explicitly calls it 'difficult to exploit', implying exploitation depends on precise
Full takeover of Oracle GraalVM 25.0.4.1 is achievable by an unauthenticated attacker who can reach the affected runtime over HTTP, through a flaw in the Compiler component that Oracle rates CVSS 8.1 with high confidentiality, integrity and availability impact. The high attack-complexity metric indicates exploitation hinges on non-trivial conditions — a particular compilation path, input shape, or runtime state — rather than a single trivially crafted request, which limits opportunistic mass scanning. No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis, and no EPSS score was supplied with the source data.
Unauthenticated remote attackers can obtain complete read and write access to Oracle Identity Manager's OIM Legacy UI component in supported versions 12.2.1.4.0 and 14.1.2.1.0, enabling unauthorized creation, deletion and modification of critical identity data as well as full disclosure of OIM-accessible data (CVSS 3.1 base score 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The decisive limiting factor is the UI:R requirement: a legitimate OIM user or administrator must be induced to interact with attacker-supplied content over HTTP, which makes this a targeted social-engineering vector rather than a fully automated one, and there is no availability impact. No public exploit has been identified at time of analysis, and Oracle published the issue as part of its September 2026 Critical Patch Update, which is the authoritative remediation source; the issue is tracked in the EU as EUVD-2026-79722.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 can be taken over by a low-privileged local attacker with logon access to the host infrastructure, allowing complete compromise of the Content Server component's confidentiality, integrity, and availability. The flaw is easily exploitable given local access and a valid account, but no public exploit or active exploitation has been identified at time of analysis. This is a locally-scoped critical-impact issue, not a remote-drive-by vulnerability.
Improper authentication in the Personalization component of Oracle Applications Framework (Oracle E-Business Suite 12.2.3 through 12.2.15) lets an unauthenticated remote attacker reach the SOAP interface and take over the framework, with full confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). CISA's SSVC assessment rates the technical impact as total and the vulnerability as automatable, meaning exploitation could be scripted and scaled once a target is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven mainly by whether an organisation exposes EBS SOAP endpoints to untrusted networks.
Authentication bypass in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 (Platform Security component) lets an unauthenticated remote attacker with HTTP access take over the BI platform, yielding full confidentiality, integrity, and availability impact (CVSS 3.1 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation have been identified at time of analysis, so exposure drives urgency: internet-facing BI EE instances are the highest priority, while internal-only deployments carry materially lower reach. The blast radius is bounded by the fact that only the single supported release 12.2.1.4.0 is affected and the sole prerequisite is network reachability of the BI EE HTTP interface.
Authenticated takeover of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 is achievable through the Platform Security component by a low-privileged attacker with network HTTP access, producing high confidentiality, integrity and availability impact (CVSS 9.9, scope change). Exploitation is straightforward once any valid low-privilege credential or session is held - attack complexity is low and no user interaction is required - and the scope change means a successful compromise can extend beyond BI EE into other products integrated with the platform. No public exploit code has been identified at time of analysis, and Oracle classifies the flaw as easily exploitable in its Critical Security Patch Update advisory.
Authentication bypass in Oracle BI Publisher (BI Platform Security component of Oracle Analytics) lets unauthenticated remote attackers with HTTP access take over the affected system, with full confidentiality, integrity, and availability impact. Affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and score of 9.8 confirm an easily exploitable, automatable condition; no public exploit or evidence of active exploitation was identified at time of analysis, but CISA SSVC classifies technical impact as total and the vulnerability is automatable, making exposed instances a high priority to patch or isolate.
Takeover of Oracle Agile PLM 9.3.6 is achievable through the Event Java PX component, where an attacker with high privileges and network reachability over T3 or IIOP can fully compromise confidentiality, integrity, and availability while the scope change (S:C) allows significant impact on additional products. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), and the dominant real-world limiter is the PR:H requirement - the attacker must already hold an elevated, authenticated role, so realistic exploitation is confined to insiders or adversaries who have already compromised a privileged account. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (the CVE is not in CISA KEV).
Unauthenticated remote attackers who can reach the Oracle Data Integrator Console / Repository Explorer over HTTP can bypass authentication entirely (CWE-287) and take full control of the affected deployment, affecting versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle Fusion Middleware's ODI product. The flaw is rated CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction, and no special preconditions beyond network reachability of the console interface - the primary exposure limiter is whether the ODI Console is internet-facing versus segmented behind VPN or internal-only access. As of analysis, there is no CISA KEV entry and no public exploit identified at time of analysis, though CISA's SSVC assessment rates the issue as automatable with total technical impact, so patching should be treated as urgent rather than deferred.
Unauthenticated attackers who can reach the One-to-One Fulfillment module of Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP can achieve complete takeover of that component, with high confidentiality, integrity, and availability impact (CVSS 8.1). Oracle characterizes the flaw as difficult to exploit (AC:H), which tempers the unauthenticated network attack vector, and the issue resides in the module's Java Server layer. No public exploit code and no CISA KEV listing were identified at time of analysis, and Oracle published the fix as part of its September 2026 Critical Security Patch Update.
Unauthenticated attackers with network access to the SOAP interface of Oracle Service Delivery Platform (SDP) versions 12.2.1.4.0 and 14.1.2.0.0 can bypass authentication and achieve full takeover of the product, per CWE-287 and a CVSS 3.1 base score of 9.8. The flaw is remotely exploitable without privileges or user interaction (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. Real-world risk is concentrated in telecom environments where the Messaging Enabler component is deployed and network-reachable.
Oracle Application Testing Suite 13.3.0.1 allows an authenticated attacker holding only the low-privilege 'Test Manager for Web Apps' role to obtain unauthorized access to critical data, perform unauthorized inserts, updates, or deletes, and cause a partial denial of service, with a scope change (S:C) indicating that a successful attack can significantly affect other products beyond the tested application. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) reflects low attack complexity and no user interaction over HTTP, but the low-privileged account requirement is the primary limiter - an anonymous or externally unauthenticated attacker cannot exploit this, and exposure is confined to deployments running 13.3.0.1 with the Web Apps test component deployed and network-reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers who can reach the HTTP interface of Oracle Forms Services in a Client/Server, Character mode (C/S, Charmode) deployment can potentially achieve full takeover of the affected Oracle Forms instance on versions 12.2.1.19.0 and 14.1.2.0.0. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.0) reflects complete confidentiality, integrity and availability impact plus a scope change, meaning a successful compromise can materially affect products beyond Oracle Forms itself; however, the High attack complexity rating means exploitation is difficult and depends on a condition outside the attacker's direct control, which limits reliability and mass exploitation. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) - real-world exposure is confined to environments running the affected Forms Services C/S Charmode component with its HTTP listener reachable by the attacker.
Improper authentication in the Oracle Forms Client/Server (C/S) Charmode runtime allows an unauthenticated, network-reachable attacker to bypass authentication and operate with the data privileges granted to the Oracle Forms application, yielding high confidentiality and integrity impact (CVSS 3.1 base 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, as shipped in Oracle Fusion Middleware (Forms Services, C/S, Charmode), are affected; the vector requires no credentials and no user interaction, and there is no availability impact. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and exposure is limited to deployments whose C/S Charmode listener is network-reachable over TCP from an untrusted network.
Unauthenticated remote takeover of Oracle Forms is achievable through the Forms Services C/S Charmode component in versions 12.2.1.19.0 and 14.1.2.0.0, where an improper-authentication flaw (CWE-287) lets any attacker who can reach the HTTP endpoint seize full control of the affected service, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). Based on the available intelligence there is no public exploit code identified at time of analysis and no CISA KEV listing, so urgency is driven by exposure rather than observed exploitation. Real-world risk is constrained mainly by deployment reality: Oracle Forms is legacy enterprise middleware that is usually published through web or application tiers rather than directly to the internet, and the C/S Charmode vector specifically points at character-mode client/server installations.
Unauthenticated remote takeover of Oracle Forms is possible in the Forms Services (C/S, Charmode) component of Oracle Fusion Middleware running versions 12.2.1.19.0 and 14.1.2.0.0. An attacker who can reach the Forms HTTP interface with no credentials, no user interaction, and no special privileges can bypass authentication and gain full control of the affected deployment, and the CVSS scope-change flag (S:C) indicates the compromise can significantly impact additional products tied to the same environment. The vendor-rated CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and the flaw is described as easily exploitable, though no public exploit identified at time of analysis.
Full takeover of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 is achievable by an unauthenticated remote attacker exploiting an improper-authentication flaw (CWE-287) in the Forms Services C/S (Charmode) component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) confirms there are no credential, user-interaction, or special-complexity prerequisites - only HTTP reachability to an affected Forms deployment is required. No public exploit code has been identified at time of analysis, and real-world exposure is bounded by how widely the legacy C/S Charmode mode is deployed and whether the Forms HTTP endpoint is exposed beyond the internal network.
Unauthenticated remote attackers with HTTP reachability to the Oracle Forms Services listener can bypass authentication and take over Oracle Forms deployments in Oracle Fusion Middleware versions 12.2.1.19.0 and 14.1.2.0.0, specifically the Forms Services, C/S, and Charmode components. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), matching our independent assessment, meaning no credentials and no user interaction are required and the only practical precondition is network access to the Forms endpoint on default configurations. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patch candidate - particularly for any instance exposed to the internet or to untrusted internal segments - rather than a currently exploited threat.
Authentication bypass in Oracle Forms (Oracle Fusion Middleware) 12.2.1.19.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the Forms Services component - including its C/S and Charmode channels - over HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are stated prerequisites, and the impact is rated complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No CISA KEV entry or public exploit code was identified at time of analysis (EPSS was not provided in the available data); the practical limiting factor is exposure, since Forms Services is frequently shielded behind internal networks, reverse proxies, or VPNs rather than being internet-facing. Our assessment concurs with the vendor vector and classifies this as a genuine high-priority vulnerability.
Unauthenticated remote attackers can achieve full takeover of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 by reaching the OID LDAP Server through its exposed T3 or IIOP remoting listeners, requiring no credentials and no user interaction (CVSS 3.1 base score 9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The root cause is an authentication-bypass condition (CWE-287) in the Fusion Middleware OID LDAP Server component, and successful exploitation yields complete loss of confidentiality, integrity and availability across the directory service. No CISA KEV entry and no public exploit code were identified at time of analysis, so this is not confirmed active exploitation; however, the pre-authentication, network-reachable attack path means internet-facing or broadly reachable OID/WebLogic deployments carry the highest risk, while instances confined to trusted management networks are substantially harder to reach because the only real gating factor is network access to the T3/IIOP listener.
Takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is achievable by an attacker who already holds a high-privilege account on the portal, reaching the Runtime Tools component over HTTP. The flaw is easy to execute once that privileged foothold exists - network vector, low attack complexity, no user interaction required - and its scope-change metric means the fallout can extend into additional Oracle Fusion Middleware products beyond WebCenter Portal itself, with full confidentiality, integrity and availability impact on the portal. The CVSS 3.1 base score is 9.1, but the PR:H prerequisite is the dominant practical constraint: it excludes anonymous and unauthenticated attackers and makes insider abuse or the reuse of stolen administrator credentials the realistic exploitation path. No public exploit code and no confirmed active exploitation were identified at time of analysis, so priority rests on the high severity and low post-authentication effort rather than on observed attacks.
Authentication bypass in Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network access to the OID LDAP Server component to take over the directory service, with high confidentiality, integrity and availability impact (CVSS 3.1 base score 9.8). Exploitation requires no credentials, no user interaction and no non-default configuration per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); the principal practical constraint is reachability of the LDAP listener, since directory servers are normally deployed on internal or segmented networks rather than exposed to the internet. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but Oracle's 'easily exploitable' characterization and the complete compromise outcome make this a high-priority patch target for any organization running the affected versions.
Unauthenticated attackers with network access to the OID LDAP Server component can fully compromise Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0, achieving complete loss of confidentiality, integrity, and availability of the directory service (CVSS 3.1 base score 9.8). Because the flaw is an improper authentication weakness (CWE-287) reachable over LDAP with no credentials, no user interaction, and no special configuration - Oracle itself characterizes it as 'easily exploitable' - any directory deployment whose LDAP listener is exposed to an untrusted network is directly at risk of takeover. No public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing), so the practical risk is driven primarily by network exposure of the OID LDAP port.
Unauthenticated remote takeover of Oracle Internet Directory is achievable through its OID LDAP Server component in versions 12.2.1.4.0 and 14.1.2.1.0. The flaw is an improper-authentication weakness (CWE-287) rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning an attacker who can reach the LDAP listener needs no credentials, no user interaction, and no non-default configuration to gain full control of confidentiality, integrity, and availability of the directory service. Our assessment concurs with this vector and flags it as a genuine top-tier priority; no public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk hinges mainly on whether OID LDAP ports (default 389/636) are exposed beyond trusted internal or management networks.
Takeover of Oracle Internet Directory (OID) is possible for a network-positioned attacker who holds only low-level authenticated privileges on the directory, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Exploitation requires a valid low-privilege LDAP bind credential (PR:L) but no user interaction; the scope change means a successful compromise can propagate to other Oracle Fusion Middleware products that depend on OID for identity. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Low-privileged authenticated LDAP access to Oracle Internet Directory 12.2.1.4.0 or 14.1.2.1.0 can be escalated into full takeover of the directory service, with a scope change that lets a compromise propagate into other Oracle Fusion Middleware components and identity-dependent applications. Oracle rated this 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a remote attacker only needs a valid low-privilege directory credential or authenticated LDAP session - no user interaction - to fully compromise confidentiality, integrity, and availability of OID. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but because OID is typically a central identity store, the blast radius justifies treating this as an urgent patch item; the corresponding Oracle Critical Security Patch Update advisory is the authoritative source for affected fix versions.
Unauthenticated attackers who can reach the Composer component of Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 over HTTP can achieve complete takeover of the portal - full confidentiality, integrity and availability impact - provided they first persuade a legitimate user to perform some action, since the CVSS vector requires user interaction (UI:R). The scope-change flag (S:C) means a successful exploit can extend beyond the portal itself into integrated or dependent products, which is why the base score reaches 9.6 despite the interaction requirement. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the practical near-term risk is driven by the low attack complexity and the existence of a vendor patch through Oracle's Critical Security Patch Update process rather than by observed exploitation.
Authentication bypass in the OIM Legacy UI component of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated attacker who can reach the interface over HTTP take full control of the affected deployment, with complete loss of confidentiality, integrity, and availability (CVSS 3.1 base score 9.8). Exploitation requires no credentials or user interaction (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but it does depend on the Legacy UI being network-reachable; instances shielded by segmentation, VPN, or reverse-proxy access controls that block direct HTTP to that component are not exposed to external actors. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and affected versions are strictly limited to 12.2.1.4.0 and 14.1.2.1.0.
A low-privileged authenticated attacker with HTTP network access can fully compromise Oracle WebCenter Portal through its Composer component, achieving complete loss of confidentiality, integrity and availability plus a scope change that can extend impact to connected downstream products. Only versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and the attack requires no user interaction and has low complexity - the sole meaningful barrier is that an attacker must already hold valid credentials (PR:L), so this is not a pre-authentication flaw. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but the 9.9 CVSS score and the ease of exploitation once credentials are obtained make this a high-priority patch item.
Unauthenticated remote attackers can achieve full takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 through an authentication bypass reachable over HTTP, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector that drives the 9.8 base score. No authentication, user interaction, or non-default configuration is required - the only practical prerequisite is network reachability of the WebCenter Sites HTTP interface, which means internet-exposed authoring or delivery instances carry the highest risk. The flaw is rated CWE-287 (Improper Authentication), and at time of analysis there was no public exploit code identified and no confirmed active exploitation (not listed in CISA KEV); Oracle has published a Critical Security Patch Update advisory covering the affected versions.