Java
Monthly
Authentication bypass in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 lets unauthenticated remote attackers reach and compromise the application purely over HTTP, with a successful exploit resulting in complete takeover of the WebCenter Sites instance (CVSS 3.1 base score 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Per the assessed vector there are no prerequisites beyond network reachability to the affected service: no credentials, no user interaction, and low attack complexity, which Oracle itself characterizes as 'easily exploitable.' No public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was supplied in the available intelligence, so the immediate driver for prioritization is the 9.8 severity combined with unauthenticated network exploitability rather than confirmed active exploitation.
An authentication bypass in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 enables unauthenticated remote attackers to take over the application via HTTP requests, rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity and availability impact. The vulnerability sits in the WebCenter Sites component of Oracle Fusion Middleware and requires no credentials, no user interaction and no non-default configuration - only network reachability of the HTTP service - making any internet-exposed instance an immediate target. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing), but the trivial attack prerequisites mean exposed deployments should be treated as urgent; instances confined to internal networks or sitting behind an authenticating reverse proxy or WAF have materially reduced reachable attack surface.
A low-privileged authenticated attacker with network access over HTTP can achieve complete takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0, with a CVSS 3.1 base score of 9.9 - the scope-change flag (S:C) indicates that a successful compromise can also significantly impact other co-located Fusion Middleware and WebLogic components, not just Sites itself. No user interaction is required, though valid low-privilege credentials (or a low-privilege session that can be obtained) are a prerequisite, so this is not pre-authentication. There is no public exploit identified at time of analysis and no confirmed active exploitation, but the low attack complexity and full confidentiality, integrity, and availability impact make this a high-priority item for any organization running the affected versions.
Oracle Managed File Transfer (MFT) Runtime Server, the file-transfer component of Oracle Fusion Middleware, allows an authenticated low-privileged attacker with network HTTP access to create, delete, modify, and read critical data handled by MFT, and the scope change (S:C) means a successful attack can escape the MFT trust boundary and impact additional Oracle products. The flaw is trivially reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, base 9.6), requiring no user interaction, but it is not pre-authentication: the attacker must already hold valid low-privileged credentials and be able to reach a MFT Runtime Server HTTP endpoint on versions 12.2.1.4.0 or 14.1.2.0.0. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (no CISA KEV listing); the 9.6 score reflects the confidentiality/integrity impact and cross-boundary scope change rather than observed exploitation, and the Oracle advisory provides no technical root-cause detail or CWE.
Unauthenticated attackers on the same adjacent network segment can compromise the Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0), bypassing authentication to gain unauthorized read/write access to critical data, with scope change potentially affecting other Oracle products. This high-severity vulnerability (CVSS 9.3) requires local network adjacency but no credentials or user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can achieve full takeover of Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 by exploiting an authentication bypass in the Web Container component reachable over HTTP. The vulnerability carries a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), meaning no credentials, user interaction, or special preconditions are required beyond network reachability to the WebLogic HTTP listener; the Scope:Changed rating indicates successful exploitation can also compromise additional products beyond WebLogic itself. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), but the trivial attack preconditions and maximum severity rating make this a top-priority patch target for any internet-exposed deployment.
Unauthenticated remote attackers can achieve full takeover of Oracle Platform Security for Java (OPSS) versions 12.2.1.4.0 and 14.1.2.0.0, an authentication-bypass flaw (CWE-287) in the Centralized Thirdparty Jars component of Oracle Fusion Middleware that carries a maximum CVSS 3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Because the scope is marked as changed (S:C), Oracle warns that a successful compromise of OPSS - the shared security services layer that other Fusion Middleware components depend on - may significantly propagate impact to additional products, which is what elevates this above the otherwise near-identical 9.8-rated issue. No public exploit code has been identified and there is no CISA KEV listing at time of analysis, but Oracle characterises the flaw as 'easily exploitable' with no privileges or user interaction required, so the practical limiting factor is whether the affected middleware's HTTP surface is network-reachable - internet-exposed deployments are at the highest risk.
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privilege authenticated user with HTTP access to the Client Bundle component to read all data accessible to the Capture application, and - because the vulnerable component crosses a security scope boundary - potentially reach data in adjacent Oracle Fusion Middleware products. The flaw is rated CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and is confidentiality-only, with no integrity or availability impact; exploitation requires an existing low-privilege account, so despite being tagged 'Authentication Bypass' in threat-intelligence feeds, this is not reachable by a fully unauthenticated actor. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and lack of user interaction make it attractive for post-authentication data theft against internet-exposed Capture deployments.
Unauthenticated remote attackers with HTTP access to Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware can achieve full takeover of the service by exploiting a flaw in the bundled Centralized Thirdparty Jars component. Only versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected by Oracle's advisory. The flaw carries a CVSS 3.1 base score of 8.1 with a High attack complexity rating, and no public exploit code or CISA KEV entry has been identified at time of analysis, so real-world exploitation appears opportunistic rather than widespread.
Full takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is achievable by an authenticated, high-privileged attacker who can reach the Authentication Engine over HTTP, with a CVSS 3.1 base score of 9.1 due to low attack complexity, no user interaction, and scope change that can affect integrated identity/SSO products. The PR:H prerequisite means this is realistically an insider or post-compromise privilege-abuse path rather than a remote unauthenticated break-in. No public exploit code was identified at time of analysis and no CISA KEV listing is present in the provided intelligence.
Improper authentication in the Messaging Enabler component of Oracle Fusion Middleware Service Delivery Platform allows unauthenticated remote attackers to bypass authentication and fully take over the product, compromising confidentiality, integrity, and availability. Affected releases are Oracle SDP 12.2.1.4.0 and 14.1.2.0.0, and per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires only network reachability to the Messaging Enabler HTTP interface - no credentials, privileges, or user interaction are needed. There is no public exploit code identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the main real-world limiting factor is exposure, since SDP is niche carrier/telecom middleware typically deployed inside operator networks rather than on the public internet.
Authenticated, low-privileged attackers with network HTTP access to the Messaging Enabler component of Oracle Service Delivery Platform (Fusion Middleware) can achieve full takeover of the platform, and because the CVSS profile carries a scope change (S:C) the compromise can extend to additional connected products beyond SDP itself. Oracle rates the issue CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), affecting SDP 12.2.1.4.0 and 14.1.2.0.0; exploitation needs valid low-privilege credentials but no user interaction, at low attack complexity, and no public exploit code has been identified at time of analysis. The realistic limiting factors are the credential prerequisite, the narrow deployment base of this specialized telecom service-delivery platform rather than general-purpose middleware, and the fact that the vector is well-calibrated rather than inflated.
Takeover of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler component) is achievable by a low-privileged, network-positioned attacker, carrying a CVSS 3.1 base score of 9.9 with a scope change (S:C) that lets a successful compromise spill over into other products. The affected releases are 12.2.1.4.0 and 14.1.2.0.0, and the attack path is the T3 and IIOP listeners; per the assessed vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) the attacker must already hold a valid low-privileged account on the platform, but no user interaction is required and confidentiality, integrity and availability impacts are all High. There is no public exploit code identified at time of analysis and the vulnerability is not listed in CISA KEV, so urgency rests on the near-maximum score and the exposure of internal T3/IIOP ports rather than on observed exploitation; the residual risk drops sharply where those proprietary protocols are firewalled or the platform is segmented away from untrusted users.
Authenticated remote attackers who can reach the WebLogic T3 or IIOP remoting interfaces of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler) can take over the product entirely, with the compromise extending to connected Oracle components because of the scope change. The flaw affects Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - no user interaction is required, but a valid low-privileged account is a prerequisite, so it is exploitable (not unauthenticated). No public exploit code and no confirmed active exploitation were identified at time of analysis; practical exposure is further narrowed because T3/IIOP ports are commonly firewalled or not internet-facing in hardened WebLogic deployments.
Oracle Platform Security for Java (component: Centralized Thirdparty Jars) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with logon access to the host to fully compromise the component, resulting in high confidentiality, integrity, and availability impact. The flaw is locally exploitable (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and requires only a valid low-privileged account on the infrastructure where the component executes. No public exploit code or CISA KEV listing is identified at time of analysis, and the vendor advisory is available via Oracle's Critical Patch Update.
Authentication bypass in Oracle Platform Security for Java (OPSS) 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to reach the affected SOAP interface and achieve full takeover of the OPSS instance, with high confidentiality, integrity, and availability impact (CVSS 9.8). The flaw is classified as CWE-287 improper authentication and is tagged as an authentication bypass; per the Oracle-supplied CVSS vector, no credentials or user interaction are required. No public exploit identified at time of analysis, but any reachable vulnerable OPSS service should be treated as high risk because the practical limiting factor is network exposure of the SOAP endpoint rather than a configuration prerequisite.
Unauthenticated remote attackers who can reach an exposed LDAP authentication path in Oracle Platform Security for Java (OPSS) can achieve complete takeover of the OPSS security framework in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, with full confidentiality, integrity and availability impact (CWE-287 improper authentication, CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the Centralized Thirdparty Jars component and requires no credentials and no user interaction, but exploitability in practice depends on network reachability: OPSS is an embedded security framework consumed by Fusion Middleware applications rather than a standalone internet-facing service, so internal-only or firewalled OPSS/LDAP endpoints substantially reduce exposure. No public exploit code and no CISA KEV entry were identified at time of analysis, and no real-world exploitation telemetry is available, so the 9.8 severity reflects assessed potential rather than observed attack activity.
Unauthenticated remote attackers who can reach the Portlet Services component of Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 over HTTP can bypass authentication and achieve full takeover of the application, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 9.8; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is an improper-authentication defect (CWE-287) and, per the assessed vector, needs no credentials, no user interaction and no non-default configuration, so any instance with Portlet Services reachable is directly at risk. No public exploit code has been identified at time of analysis, and the principal real-world limiter is exposure, since WebCenter Portal is typically deployed behind an enterprise perimeter rather than openly on the internet; this is nevertheless a high-priority issue on every available static signal, with thin real-world exploitation evidence.
Authenticated attackers holding a low-privileged account can exploit the Authentication Engine in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 over HTTPS to read, create, delete, or modify all data reachable through the service, with CVSS 3.1 base score 9.6 reflecting high confidentiality and integrity impact and a scope change. The flaw is remotely reachable with low attack complexity and no user interaction, but it is not pre-authentication: a valid low-tier credential on the OAM instance is required, which is the main limiting factor on exploitation. No public exploit identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); Oracle's Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source.
Unauthenticated takeover of Oracle JDeveloper is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0 through the ADF Faces component, which is exposed over HTTP; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms remote, unauthenticated, low-complexity exploitation requiring no user interaction, with full confidentiality, integrity, and availability impact. The root cause is an authentication bypass (CWE-287) rather than a memory-safety or injection flaw, meaning an attacker who can reach the ADF Faces web tier may be able to act with privileges they were never granted. No public exploit code has been identified at time of analysis and the vulnerability is not listed as confirmed actively exploited (CISA KEV); the main real-world constraint is network exposure, since JDeveloper is primarily a Java development IDE and its ADF Faces web tier is not normally published to untrusted networks.
Unauthenticated network attackers can obtain complete confidentiality and integrity compromise of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 through the Portlet Services component, but only after a legitimate portal user is induced to interact with attacker-influenced content - exploitation is gated by the UI:R prerequisite, which requires human interaction from a person other than the attacker. With a CVSS 3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), the flaw allows unauthorized creation, deletion or modification of, and complete read access to, data accessible through the portal, and because scope changes (S:C) the impact can extend to additional integrated products. There is no KEV listing and no public exploit identified at time of analysis, so this is a high-severity issue whose real-world risk is bounded by the need to socially engineer a valid portal user and by the narrow set of affected releases.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can be taken over by an unauthenticated remote attacker who reaches the Composer component over HTTP, because the component fails to properly enforce authentication (CWE-287). Oracle scores this 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or non-default configuration are required - only network reachability of the WebCenter Portal HTTP interface, with the stated outcome being full takeover of the portal. At time of analysis there is no public exploit identified and the issue is not listed as confirmed actively exploited (CISA KEV), so the practical risk is driven by exposure: internet-facing instances are directly at risk, while deployments confined to internal networks or sitting behind an authenticating reverse proxy or WAF are materially harder to reach. This is assessed as well-calibrated maximum severity rather than an inflated score, since an unauthenticated authentication bypass leading to product takeover justifies the C:H/I:H/A:H impact set.
Improper authentication in the Portlet Services component of Oracle WebCenter Portal allows unauthenticated attackers with HTTP network access to the portal to bypass authentication and gain read and write access to all portal-accessible data, including the ability to create, delete, or modify critical content. Only versions 12.2.1.4.0 and 14.1.2.0.0 of this Oracle Fusion Middleware product are affected, and the flaw is rated high severity (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) with no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exploitation risk is driven primarily by internet or broad-network exposure of an unpatched portal.
Authentication bypass in the Oracle Access Manager (Fusion Middleware) Authentication Engine lets unauthenticated remote attackers with HTTP network access compromise OAM instances running 12.2.1.4.0 or 14.1.2.1.0, resulting in complete takeover of the affected service with high confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation of the CWE-287 flaw effectively grants the attacker the identity and authorization context the Authentication Engine is supposed to enforce, so any downstream application trusting OAM for single sign-on or access decisions is exposed to the same session. At the time of analysis there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified; the practical exposure is driven almost entirely by the network reachability of the OAM Authentication Engine endpoint, with internet-facing gateways the highest priority to patch.
Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the affected Access Manager instance, rated CVSS 3.1 9.8 (CWE-287, Improper Authentication) with high confidentiality, integrity, and availability impact. The vulnerable component is the Authentication Engine itself, and the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms no credentials, privileges, or user interaction are required, so any HTTP-reachable OAM deployment of those two versions is a candidate entry point. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); however, Oracle characterizes it as easily exploitable, so internet-exposed OAM instances should be treated as urgent.
Unauthenticated remote attackers can bypass authentication in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0, gaining full read and write access to all data managed by the affected component. This easily exploitable vulnerability (CVSS 9.1) requires only network access to the OAM authentication engine over HTTP and no credentials or user interaction. No public exploit code or active exploitation has been observed at the time of analysis, but the lack of authentication and high impact make it a critical risk for exposed instances.
Unauthenticated network attackers who can reach the T3 or IIOP listener fronting Oracle Access Manager's Authentication Engine on versions 12.2.1.4.0 or 14.1.2.1.0 can bypass authentication and take full control of the component, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No credentials or user interaction are required; the only meaningful precondition is that the T3/IIOP protocols are reachable from the attacker's position, so deployments that restrict those protocols to trusted internal networks are not externally exploitable. This vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis, but the combination of a perfect-exploitability CVSS vector, an authentication-bypass root cause, and default-exposed WebLogic remoting protocols makes it a high-priority patch target.
Authentication weaknesses in the Oracle Access Manager Authentication Engine expose deployments running 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware: an attacker with network access over HTTP and only a low-privileged foothold can bypass or subvert authentication to create, delete, or modify critical data and read data across the OAM-accessible estate, while also degrading service availability. Because the CVSS vector carries a scope change (S:C), a compromise of OAM can propagate to other products that rely on it as their single sign-on and identity provider, which is what pushes the base score to 9.9 rather than the more typical 8.x for an authenticated-only flaw. No user interaction is required and attack complexity is low, though the PR:L rating means the attacker must already hold at least minimal valid access or be able to reach an authenticated interface - this is not a fully unauthenticated pre-auth bypass. There is no CISA KEV listing and no public exploit code identified in the available intelligence, so exploitation is not confirmed actively exploited (CISA KEV) and no public exploit identified at time of analysis.
Unauthenticated remote takeover of Oracle WebLogic Server is achievable through its T3 and IIOP protocol listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Classified as CWE-287 (Improper Authentication) and scored CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw allows any network-reachable attacker - no credentials, no user interaction - to gain full confidentiality, integrity, and availability impact over the affected server, which Oracle itself rates 'easily exploitable'. Exploitation hinges on reachability of the T3/IIOP listeners, which are enabled by default on the WebLogic administration and managed-server listen ports, meaning most standard deployments are exposed unless those protocols are filtered, disabled, or network-segmented; no public exploit code or confirmed in-the-wild activity was identified at time of analysis, so exposure should be treated as high-impact and high-priority but not yet observed as actively exploited.
Authentication bypass in Oracle WebLogic Server (Core component) allows unauthenticated, network-positioned attackers to gain full takeover of the server, earning the maximum CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with complete confidentiality, integrity, and availability impact. All four supported branches are affected: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Exploitation requires reachability of the T3 or IIOP protocol listener (commonly port 7001) with no authentication and no user interaction, and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV, so exposure is primarily governed by whether T3/IIOP is reachable from untrusted networks.
Unauthenticated remote takeover of Oracle WebLogic Server is achievable via the T3 and IIOP listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, where an improper-authentication defect (CWE-287) in the Core component of Oracle Fusion Middleware lets a network attacker bypass login and obtain full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The only real precondition is reachability of the T3/IIOP listener, which is enabled by default and usually shares the WebLogic HTTP port (7001); no credentials and no user interaction are required, so environments that firewall, disable, or connection-filter T3/IIOP materially reduce exposure. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but this is a genuine high-priority vulnerability rather than a CVSS-inflated one.
Authorization bypass in Apache ZooKeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 lets remote attackers delete empty persistent, container, and TTL znodes by sending a raw deleteContainer opcode (20) to the client port - 2181 by default - without any credentials or ACL grant, because that code path skips both the session check and the DELETE ACL check enforced by the normal delete path. The official client exposes no API for this internal-only opcode, so exploitation requires hand-crafting the ZooKeeper wire protocol, and non-empty nodes cannot be removed directly. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) the impact is integrity-only, and no public exploit code has been identified at time of analysis with EPSS at 0.24% (16th percentile); practical risk is governed mainly by whether port 2181 is reachable from outside the trusted application or ensemble network.
Improper certificate hostname validation in Apache ZooKeeper's quorum TLS path allows a CA-trusted peer certificate whose SAN does not match the connected host to be accepted when FIPS mode and quorum hostname verification are enabled, letting the holder of such a certificate join quorum traffic, participate in leader election, and enter replication flows. Only deployments that simultaneously set sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true and ssl.quorum.clientHostnameVerification=true on affected releases (3.8.0 through 3.8.6 and 3.9.0 through 3.9.5) are exposed; plain TLS and non-quorum-TLS ensembles are unaffected. Exploitation additionally requires a certificate chaining to a CA already trusted by the quorum truststore, so the practical barrier is high; no public exploit code has been identified at time of analysis, and EPSS is 0.12% (2nd percentile). Unauthenticated remote attackers are in scope per the CVSS vector (PR:N), though the certificate precondition makes real-world abuse a targeted rather than opportunistic scenario.
Unsafe Java object deserialization in IBM MQ (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / 9.3.0.0-9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS / 9.4.0.0-9.4.5.1 CD, and 10.0.0.0) lets an authenticated attacker who can deliver a crafted message trigger JNDI injection and achieve arbitrary code execution inside the consuming client application rather than the queue manager itself. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.5) characterizes a network-reachable but authentication-gated (PR:L) and high-complexity (AC:H) path whose scope change (S:C) derives from the code execution landing in a downstream client. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available.
Remote code execution in IBM MQ is possible when the optional IVT (Installation Verification Test) application is deployed and network-reachable, because that component performs unsafe JNDI lookups that a remote, unauthenticated attacker (CVSS PR:N/UI:N) can redirect to an attacker-controlled endpoint. Affected builds are IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0, although the non-default, verification-only nature of IVT means exposure is confined to environments where it is actually running and exposed. IBM has released patches, there is no public exploit identified at time of analysis (CISA SSVC exploitation status: none), and while the vendor score of 9.8 reflects total technical impact, our independent assessment raises attack complexity to AC:H to account for the IVT deployment prerequisite.
IBM MQ versions 9.1.0.0 through 9.4.5.1 across LTS and CD streams and 10.0.0.0 are affected by a JNDI injection flaw that can lead to information disclosure or remote code execution. The issue arises from insufficient input validation before JNDI lookup (CWE-74), and according to the supplied CVSS vector it is remotely reachable without authentication (AV:N/AC:H/PR:N/UI:N), though exploitation requires the attacker to also control a network-reachable directory service and successfully resolve malicious object references in the MQ JVM. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none with automatable set to no; IBM has released patches per its advisory.
IBM MQ message queueing middleware fails to properly restrict XML external entity resolution while processing MQRFH2 message headers, letting an authenticated queue user read server-side files or resources and drive the broker and its Java clients into a denial-of-service state. Affected releases span the 9.1.x, 9.2.x, 9.3.x and 9.4.x LTS/CD streams plus 10.0.0.0 Classes for Java, so any environment running the JMS/XMS or Java messaging client against a current broker is in scope. IBM has published a vendor fix and there is no public exploit code or CISA KEV entry identified at time of analysis, but the confidentiality and availability impact are both rated High (CVSS 8.1, AV:N/AC:L/PR:L/UI:N).
Remote code execution in RuoYi-Vue-Plus 6.0.0 lets an authenticated low-privileged user run arbitrary Java code on the server through the workflow task-completion endpoint POST /workflow/task/completeTask, which flows through FlwTaskController.java into FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process and the Warm-Flow TaskService.skip path. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network reachability and complete confidentiality, integrity and availability impact, but it requires a valid authenticated session rather than being pre-auth. No public exploit code or CISA KEV entry was identified from the supplied intelligence, and no EPSS score was provided.
Expression Language injection in Activiti through 7.1.0.M6 allows authenticated users to execute arbitrary code within the Spring application context. The ExpressionResolver fails to validate hash-brace deferred expressions (#{...}) when stored as process variables, meaning crafted payloads bypass the existing expression filter. When a BPMN mail task subsequently evaluates a variable-backed body field, the stored #{...} expression is resolved in the full Spring EL context, enabling method invocation on any registered application bean. No public exploit has been identified at time of analysis, and exploitation requires an authenticated user with process variable write access.
HTTP/1.1 request smuggling in http4s blaze allows a remote client to desynchronize message boundaries between blaze's hand-written Java wire parser and a fronting proxy, enabling front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. All deployments of blaze prior to 0.23.18, and the 1.0.0 milestone line from 1.0.0-M1 through 1.0.0-M41, are affected via five independent parser laxities that are reachable from a default BlazeServerBuilder with no non-default configuration. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis; CISA SSVC records exploitation as none and automatable as no, and no EPSS score was supplied with the source data.
Local privilege escalation to root in Apache Storm's setuid-root `worker-launcher` binary (storm-core 3.0.0) allows a tenant user with code execution on a supervisor node to redirect root-owned `lchown` and `chmod` operations to arbitrary host files via a symlink race. The binary uses FTS to walk worker directories and then re-resolves pathnames at syscall time, creating a TOCTOU window exploitable by any topology user who can write to an intermediate directory component. Because worker relaunches and blob updates repeatedly re-trigger the walk, exploitation is low-cost and repeatable; this defeats the isolation boundary that `supervisor.run.worker.as.user` is designed to enforce. No public exploit is identified at time of analysis.
Out-of-bounds write in snappy-java through 1.1.10.8 allows unauthenticated remote attackers to crash the JVM by supplying valid compressed data whose decompressed size exceeds the caller-provided destination ByteBuffer capacity. The `Snappy.uncompress(ByteBuffer, ByteBuffer)` method passes the destination buffer directly to the native Snappy decompressor via JNI without first asserting that its capacity can accommodate the full decompressed output, causing native-layer writes past the buffer boundary and abrupt JVM process termination. No public exploit code or active exploitation has been identified at time of analysis, but the attack is trivially constructible by any attacker familiar with the Snappy wire format against applications that process untrusted compressed input through this specific API overload.
Denial of service in Apache OpenNLP 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 lets a remote unauthenticated attacker pin CPU or crash a worker thread by feeding crafted text to either of the two built-in RegexNameFinder patterns (EMAIL and URL) obtained via RegexNameFinderFactory.getDefaultRegexNameFinders(). The EMAIL pattern's ambiguous nested quantifiers cause quadratic catastrophic backtracking (~32 KB of local-part characters burns seconds of CPU per find() call), while the URL pattern's nested capturing repetition recurses once per query token, exhausting the thread stack and throwing StackOverflowError (~4 KB, or ~1 KB on -Xss512k worker threads). No public exploit was identified at time of analysis; this is availability-only with no code execution or data exposure.
SymSpellModelSerializer in Apache OpenNLP 3.0.0-M4 and 3.0.0-M5 crashes the host JVM with an OutOfMemoryError when deserializing a crafted SymSpell binary model file whose unigramCount or bigramCount field is set to Integer.MAX_VALUE, forcing a 4-8 GB heap allocation attempt. The root cause (CWE-789: Uncontrolled Memory Allocation) is that these two 32-bit count fields are validated only for non-negativity - no upper bound prevents attacker-controlled pre-sizing of a LinkedHashMap before any dictionary entries are consumed. The attack payload is described by the advisory as under 100 bytes, requires no prior authentication if the target application accepts externally supplied model bytes, and is effective against every deserialization code path in the opennlp-spellcheck extension. No public exploit has been identified at time of analysis, and exposure is substantially limited to the small population running pre-release milestone builds.
Unauthenticated configuration tampering in OpenNMS Horizon allows any attacker with network reach to the web interface to disable event definitions and SNMP data collection by sending HTTP PATCH requests to unprotected /api/v2 REST API endpoints. The Spring Security authorization policy in applicationContext-spring-security.xml defined intercept-url rules for GET, POST, PUT, and DELETE but omitted PATCH entirely, leaving /api/v2/eventconf/**, /api/v2/datacollectionconf/**, /api/v2/snmp-config/**, and /api/v2/trapd/** open to unauthenticated writes. Changes are persisted and reloaded into the running system, silently suppressing alarm generation and stopping metric collection - an attacker can blind the monitoring platform before conducting further operations.
Use-after-free in the reactive client-side encryption component of the MongoDB Java Driver allows a party that can cancel an in-flight encrypted operation to crash the hosting application process. The flaw surfaces only when the reactive encryption stack is active and KMS credentials are fetched on demand - a specific non-default configuration - making the affected population a subset of all Java Driver deployments. No public exploit code or active exploitation has been identified at time of analysis; impact is confined to availability (process termination), with no confidentiality or integrity consequence.
Integer overflow in Amazon Deep Java Library's tensor buffer validation component (versions 0.13.0 through 0.36.0) enables remote unauthenticated attackers to read from adjacent process memory or crash the serving process by submitting a crafted tensor payload. The CVSS 4.0 score of 8.8 reflects a straightforward network-exploitable path requiring no authentication and no preconditions (AV:N/AC:L/PR:N/UI:N), with dual confidentiality and availability impact. Vendor-released patch 0.37.0 is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands against the backend database. The vulnerability stems from unsafe `${}` string concatenation in MyBatis Mapper files - including AdminMapper.java, MerchantWithdrawRecordMapper.java, and MemberWithdrawRecordMapper.java - which bypasses parameterized query protections. Successful exploitation yields full confidentiality, integrity, and availability impact on the underlying database, confirmed by a proof-of-concept published on GitHub.
Remote code execution in Apache Impala 2.7.0 through 4.5.1 allows an authorized user with table-creation and remote-storage upload privileges to load and execute arbitrary Java classes on Impala daemon nodes by exploiting insufficient authorization controls over External Data Source tables. The vulnerability abuses Impala's legitimate extensibility feature - Data Source tables - which permits custom Java class loading from remote storage; insufficient authorization checks mean any user holding those two combined privileges can weaponize the feature for server-side code execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; upgrade to 4.5.2 is the vendor-confirmed fix.
Improper authentication handling in Spring Cloud Azure (versions 1.0.0 through releases before 7.4.0) allows an unauthenticated remote attacker to bypass authentication logic and elevate privileges within a Java application that embeds the library, yielding high confidentiality, integrity, and availability impact on the affected component and its Azure-connected resources. The 8.1 CVSS rating is moderated by a High attack-complexity metric, meaning the bypass hinges on a specific, non-trivial condition or configuration the attacker must satisfy rather than a single trivial request. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score is low at 0.64 percent (49th percentile), so the risk is driven by exposure of vulnerable deployments rather than observed attack activity.
Path traversal in Apache FreeMarker's template loading (versions 2.2.0 through 2.3.34) lets remote attackers who can influence the locale identifier passed to FreeMarker read templates outside the intended path when the default-enabled localized lookup feature is active. The actual reach is bounded by the configured TemplateLoader - FileTemplateLoader still blocks escape from its baseDir, while classloader- or servlet-context-backed loaders are limited to resources those mechanisms can reach. EPSS is low (0.21%, 11th percentile), no public exploit is identified at time of analysis, and it is not in CISA KEV.
Arbitrary command execution in SAP GUI for Java arises because the client does not correctly enforce its trust-level policy for certain functions that a connected backend can invoke. A low-privileged attacker who controls or compromises a backend SAP system can trigger the affected client-side functionality to run commands on the connected user's workstation, with high impact to confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.0 (scope-changed, requiring user interaction), it was reported by SAP with a fix note, and there is no public exploit identified at time of analysis.
Decompression bomb handling in Amazon ion-java before version 1.12.1 allows remote unauthenticated attackers to cause denial of service by submitting crafted GZIP-compressed Ion documents that expand to arbitrarily large sizes during automatic decompression. The vulnerability is a bypass of the incomplete fix for CVE-2026-75936, which introduced a GZIP auto-decompression opt-out that did not cover all decompression paths in the library. No public exploit has been identified at time of analysis, but the straightforward nature of decompression bomb construction makes the attack practically accessible to any attacker who can submit Ion data to a vulnerable application.
Local privilege escalation to root in Amazon's log4j-cve-2021-44228-hotpatch package (Amazon Linux before version 1.3-9) stems from an OS command injection flaw triggered when the hotpatch daemon processes a Java executable whose filesystem path contains embedded newline characters. A low-privileged local user can craft such a path and launch a Java process, causing the unpatched daemon to pass the unsanitized path into a shell command and execute the injected content with root privileges. Amazon has released a patched version (1.3-9) via ALAS2-2026-3784; no public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary OS command execution in GeoNetwork before 4.4.12 and 4.2.17 arises because the Saxon XSLT processor that renders formatters runs without FEATURE_SECURE_PROCESSING and with Java extension functions (ALLOW_EXTERNAL_FUNCTIONS) enabled. A user privileged enough to upload a formatter can supply a malicious .xsl stylesheet that invokes java.lang.Runtime.exec() or java.lang.ProcessBuilder, running commands as the GeoNetwork process user. No public exploit is identified at time of analysis, though the vendor GHSA advisory and public reporting describe the technique in detail.
Session cookie forgery in Dianping CAT (Central Application Tracking) through version 3.1.0 lets remote unauthenticated attackers mint valid administrator sessions. The server uses Java's String.hashCode() as the only integrity check on session cookies without any server-side secret key, so an attacker can compute a matching checksum entirely offline; combining this with a spoofed x-forwarded-for header to defeat IP-binding validation yields a full-access admin session over CAT's configuration. Reported by VulnCheck; no public exploit has been identified at time of analysis, but the technique is fully documented in the advisory and the vulnerable code (TokenBuilder.java, HttpUtils.java) is public.
Authorization bypass in Eclipse Arrowhead 5.0.0-5.2.1 allows any authenticated system - regardless of privilege level - to reach every protected management API endpoint by submitting percent-encoded paths that defeat the raw-URL substring check while still being routed by Spring MVC's decoded dispatcher. Exploiting the flaw is trivial: encoding a single character in '/mgmt/' (e.g. 'm' → '%6D') causes the filter to fall through without authorizing the request, yet Tomcat decodes and dispatches it normally. The highest-impact target is POST /authentication/mgmt/identities, which creates new sysop-level accounts, yielding full administrative takeover of the Arrowhead local cloud. No public exploit has been identified at time of analysis.
Remote code execution in Lutece Core (versions up to and including 7.1.7) allows an authenticated administrator to run arbitrary Java code on the server by abusing the XSL export management module. Because the XML/XSLT processor is configured without FEATURE_SECURE_PROCESSING, malicious XSL stylesheets can invoke Java extension functions; an admin uploads a crafted XSL transformation and triggers it during a user export. Rated CVSS 4.0 9.4 (critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side template injection in the Qute template engine's ReflectionValueResolver allows authenticated remote attackers with the ability to influence template content to bypass Java sandbox restrictions and execute arbitrary OS commands on the server. Affected Red Hat products include Red Hat Build of Quarkus, Red Hat Build of Apache Camel 4 for Quarkus 3, and the JBoss EAP Expansion Pack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the CVSS score of 8.8 and full C/I/A impact make this a high-priority patching target for any Quarkus deployment exposing user-influenced template rendering.
Per-file size and file-count upload limit enforcement in Apache Wicket 8.x through 10.x can be bypassed when a co-deployed servlet component pre-consumes the multipart request body before Wicket processes it. Affected deployments fall back to HttpServletRequest#getParts(), which silently skips Wicket's configured Form#setFileMaxSize and Form#setFileCountMax constraints, allowing remote unauthenticated submitters to upload files larger or more numerous than the application intends to permit. Parts omitting a Content-Type header are additionally loaded entirely into JVM heap during parsing, creating a secondary denial-of-service path limited only by external container allocation bounds. No public exploit or CISA KEV listing exists; EPSS stands at 0.20% (10th percentile), consistent with a conditional, architecturally specific flaw.
Unauthenticated XML External Entity (XXE) injection in MapFish Print's GML layer parser allows remote attackers to read arbitrary server-side files and conduct server-side request forgery (SSRF) via a single crafted HTTP POST to the /api/print3/print endpoint. All 3.x branches prior to 3.28.30, 3.30.32, 3.31.24, and 3.33.16, as well as 4.x prior to 4.0.5, are affected. A fully functional proof-of-concept exploit has been publicly disclosed in the GitHub Security Advisory GHSA-5v29-34h8-v68r, enabling exfiltration of Kubernetes service account tokens, OS credential files, and TLS certificates with no authentication required.
Log-record tampering in Graylog's FortiGate syslog parser enables unauthenticated network senders to overwrite or erase critical security-log fields - including srcip, dstip, date, time, and tz - or cause entire log messages to be silently discarded, creating a viable log-evasion primitive. Affected are Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2 (all branches), and Graylog Forwarder prior to version 7.3, on any deployment ingesting FortiGate key-value syslog. No public exploit code exists and this is not in CISA KEV, but the attack requires no authentication and minimal crafting skill, making it a realistic threat to security-monitoring integrity in FortiGate-centric environments.
Remote code execution in Yamcs (yamcs-core <= 5.12.7 and 5.13.0-5.13.1) lets an authenticated, low-privileged user run arbitrary OS commands by injecting a StreamSQL LIKE pattern that breaks out of a generated Java string literal compiled at runtime by Janino. Because the pattern is embedded raw whether it arrives as a SQL literal or a bound '?' argument, the sink is reachable not only from the archiving endpoints but from routine read-only APIs (readRows, events search, activities listing), including the Events page search box. A detailed vendor-published proof of concept exists; this is not in CISA KEV, so it is publicly available exploit code rather than confirmed active exploitation.
Remote code execution in Yamcs (open-source mission-control server) versions <= 5.12.7 and 5.13.0-5.13.1 allows a caller with the CreateInstances privilege - or any unauthenticated user in the default no-security.yaml configuration where guest is superuser - to inject YAML into an instance template via the templateArgs parameter of POST /api/instances (and PATCH /api/instances/{instance}). Because arguments are written into the rendered config as raw, unescaped text and then loaded as YAML, an attacker can inject a services: entry that instantiates org.yamcs.ProcessRunner and executes an arbitrary command as the Yamcs service account. Publicly available exploit code exists (a full PoC with a reverse shell is published in the GitHub Security Advisory), and vendor patches are available in 5.12.8 and 5.13.2.
Unauthenticated directory traversal in Yamcs versions up to and including 5.8.6 (per advisory scope, < 5.11.13 per package metadata) allows any remote attacker to read arbitrary files from the underlying host operating system by sending a crafted HTTP request. The flaw resides in StaticFileHandler.java, which resolves user-supplied URL paths against a static file root without verifying the resolved path stays within that root - a double-slash prefix (e.g., //etc/passwd) is sufficient to escape the boundary. No public exploit identified at time of analysis, though the steps-to-reproduce are fully published in the GitHub Security Advisory and the vulnerability was demonstrated in a public CTF challenge at DEFCON 33.
Remote code execution in Yamcs (Mission Control) versions <= 5.12.7 and 5.13.0-5.13.1 allows an authenticated user holding the ControlArchiving system privilege to run arbitrary Java on the server host by embedding executable code in a StreamSQL column name. The malicious name is interpolated unescaped into Java source that Janino compiles without a sandbox when a sum() aggregate is evaluated over that column via POST /api/archive/{instance}:executeSql. This is a second, independent Janino sink sharing the root cause of CVE-2026-44632, which the earlier fix did not close; the advisory (GHSA-3g44-3m7x-cgg2) includes a full working PoC verified end-to-end against a real, security-enabled Yamcs 5.13.0, though there is no CISA KEV listing.
Remote code execution affects PaperCut MF and PaperCut NG through unsafe dynamic class loading in the database connection utilities, which instantiate JDBC driver classes from configurable driver names without validating them against an allowlist. An attacker who can control administrative system configuration parameters can force the server to load and execute arbitrary Java bytecode already present on the application classpath, running with the full privileges of the PaperCut server process. No public exploit identified at time of analysis, but the PR:H requirement and PaperCut's history of being targeted make prompt patching advisable.
Spring Integration's reactive message pipeline leaks reply routing and security headers across concurrent users when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering operator that emits raw payloads, causing one user's replyChannel, correlationId, and security or tenant headers to be applied to another concurrent user's response. Affected versions span the 5.5.x, 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines across the core Spring Integration library, as confirmed by VMware via the spring.io security advisory. The CVSS 8.2 score reflects network exploitability with no authentication required and high confidentiality impact; no public exploit has been identified at time of analysis.
Stored cross-site scripting in Spring Authorization Server's DefaultConsentPage allows network-accessible, unauthenticated attackers to inject arbitrary JavaScript into the OAuth2 consent screen presented to legitimate users. Affected versions span 1.4.0-1.4.11 and 1.5.0-1.5.8; the attack payload is embedded in a crafted OAuth2 authorization request, persisted server-side, and executed in the victim's browser when they view the consent dialog. No public exploit has been identified at time of analysis, but the low-complexity injection mechanism combined with a CVSS 8.2 base score and high confidentiality impact makes this an urgent remediation target for any deployment relying on the default consent page.
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across Spring Framework 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19 and 7.0.0-7.0.8, where unneutralized CRLF sequences (CWE-93) let an attacker inject into or corrupt the event stream. Reported by VMware/Spring and tagged as Information Disclosure, the flaw can break stream framing and potentially leak or splice data across SSE responses. No public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile), but the vendor-assigned CVSS of 9.8 (all-High impact) sits in tension with the information-disclosure framing and warrants scrutiny.
JdbcMessageStore deserialization allowlist protection in Spring Integration silently fails when the store is configured as a Spring-managed bean, rendering the security control entirely ineffective. Operators who call addAllowedPatterns() to restrict which Java classes can be deserialized from the JDBC message store receive no actual protection - any class remains deserializable despite the configured allowlist - leaving applications exposed to unsafe Java deserialization attacks while operators believe they have hardened the component. Affected across Spring Integration 6.4.x through 7.1.0; no public exploit identified at time of analysis.
Spring for GraphQL's Spring Data pagination integration blindly forwards client-supplied Connection field arguments to the underlying repository without enforcing resource limits, enabling an unauthenticated remote attacker to exhaust JVM heap memory or impose sustained load on the backing datastore via crafted GraphQL pagination queries. Three release branches are affected: 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9, as confirmed by EUVD-2026-67178 and the VMware/Spring security advisory. No public exploit has been identified and the EPSS probability is very low (0.16%, 5th percentile), though the unauthenticated, network-accessible attack path makes any openly exposed endpoint a viable denial-of-service target.
Cross-origin data exfiltration in Spring for GraphQL exposes confidential application data when a victim browses a crafted URL pointing to the bundled GraphiQL interface. The GraphiQL IDE, intended for development use, can be weaponized to direct the victim's authenticated browser session to send GraphQL queries whose responses are leaked to an attacker-controlled origin. All major release lines from 1.0.0 through 2.0.4 are affected; no public exploit has been identified and the EPSS score sits at the 4th percentile, but the high confidentiality impact (C:H) and scope change make this notable for any deployment with GraphiQL exposed beyond trusted networks.
Spring for GraphQL's bundled GraphiQL developer IDE loads third-party JavaScript libraries from a public CDN without Subresource Integrity (SRI) verification, allowing any attacker capable of tampering with CDN responses to inject and execute arbitrary JavaScript in any browser that loads the GraphiQL page. All four maintained release lines are affected (1.0.x through 2.0.4), as confirmed by the VMware/Spring security advisory and EUVD-2026-67175. No public exploit code has been identified at time of analysis, and EPSS at 0.11% (2nd percentile) reflects currently minimal exploitation activity.
Unsafe deserialization in Spring for GraphQL 2.0.0-2.0.4 exposes Java applications to potential remote code execution when processing paginated GraphQL queries. The flaw, classified as CWE-502, allows network-accessible, unauthenticated attackers to supply crafted payloads through pagination parameters that are deserialized server-side without adequate type safety. CVSS 8.1 with AC:H reflects that exploitation hinges on the presence of a suitable Java gadget chain on the application classpath; EPSS of 0.44% (36th percentile) and no KEV listing indicate no widespread exploitation has been observed at time of analysis.
Unrestricted property key injection via Spring Cloud Commons' writable /actuator/env endpoint allows authenticated administrators to POST arbitrary environment properties with no allow-list enforcement, affecting all currently maintained release lines (3.1.10 and earlier through 5.0.2). With CVSS PR:H and a scope change (S:C), exploitation requires admin-level access to the actuator endpoint but can cascade integrity impacts across the entire Spring application context. No public exploit has been identified at time of analysis, and exploitation is gated on a non-default configuration requiring deliberate enablement of write access to the actuator endpoint.
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input escape the restricted SimpleEvaluationContext sandbox when the SpEL bytecode compiler is active, affecting Spring Framework 5.2.x through 7.0.8 across the 5.3, 6.0, 6.1, 6.2 and 7.0 lines. Because SimpleEvaluationContext is the API applications are told to use to safely evaluate untrusted expressions, this bypass can escalate a data-binding-only context into broader method invocation with high integrity and availability impact (CVSS 9.1, CWE-913). There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), indicating no observed mass exploitation yet.
Denial of Service exposure in Spring Framework's data binding infrastructure allows unauthenticated remote attackers to exhaust application resources by submitting crafted property path expressions to any endpoint that binds user-supplied paths onto Java target objects. Affected versions span the entire actively maintained Spring Framework lineage - 5.2.x through 7.0.x - making the aggregate exposure footprint very large. No public exploit is referenced and EPSS sits at 0.15% (4th percentile), indicating low current exploitation activity despite the high CVSS score of 7.5.
Insufficient input validation in Spring Security's OAuth2 Authorization Server module (versions 7.0.0-7.0.4) allows an attacker holding a valid Initial Access Token to register a malicious OAuth2 client with crafted metadata fields via the Dynamic Client Registration endpoint. Depending on server configuration and how the metadata is subsequently rendered or fetched, the impact spans Stored XSS (targeting administrator sessions), Privilege Escalation (through insufficiently constrained scopes or grant types), or SSRF against internal infrastructure. No public exploit code or CISA KEV listing exists at time of analysis, but the SSVC framework rates the technical impact as total, warranting priority remediation for any deployment with Dynamic Client Registration explicitly enabled.
Improper authorization in Spring Security's embedded UnboundID test LDAP server (UnboundIdContainer) exposes an administrative directory account to the network: the container unconditionally registers an admin credential and binds its listener to all local interfaces (0.0.0.0) rather than loopback. Affected releases span 5.7.0-5.7.25, 5.8.0-5.8.27, 6.4.0-6.4.18, 6.5.0-6.5.11, 7.0.0-7.0.6 and 7.1.0; any application that instantiates this container becomes reachable by remote unauthenticated clients that can then read and modify directory contents using the known admin bind. No public exploit has been identified, and EPSS is low (0.29%, 21st percentile).
Path traversal in Spring Cloud Config Server's native environment repository allows unauthenticated remote attackers to read arbitrary files outside the configured search-locations directory on the server filesystem. Affected deployments span four release lines - 3.1.14 and earlier, 4.0.0-4.2.8, 4.3.0-4.3.4, and 5.0.0-5.0.4 - and are limited to the native filesystem backend mode. No public exploit code has been identified and CISA KEV does not list this vulnerability, though the centralized role of Config Server as a secrets store elevates real-world impact beyond the raw EPSS percentile.
Spring WebFlux applications that enable WebSocket connections leak request headers - potentially containing Authorization tokens, session cookies, or API keys - through exception reason messages exposed over the WebSocket channel. All maintained Spring Framework release trains from 5.2.x through 7.0.x are affected, covering the vast majority of actively deployed Spring reactive applications. The vulnerability is classified as information disclosure (CWE-209), and while the CVSS score is 7.5, the EPSS score of 0.14% (4th percentile) indicates very low observed exploitation probability; no public exploit or CISA KEV listing exists at time of analysis.
Authorization bypass in Spring Framework WebFlux functional-endpoint applications deployed on DispatcherServlet allows an attacker to defeat header-based route predicates by sending a CORS pre-flight (OPTIONS) request, reaching routes that should have been gated by header conditions. It affects Spring Framework 5.2.5-5.2.25, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8 in the specific WebFlux-functional-plus-DispatcherServlet deployment mode. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.19%, 9th percentile).
Denial of service in Spring Framework WebFlux applications (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, 7.0.0-7.0.8) occurs when the Aalto XML processor is used to parse request bodies, because the maxInMemorySize buffering limit is not correctly enforced. Remote attackers can submit oversized XML to trigger unbounded in-memory buffering and exhaust heap memory. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile) and CISA SSVC lists exploitation status as none, though it rates the flaw automatable with total technical impact.
Cross-response information disclosure and stream corruption affects Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8 (both MVC and WebFlux) when applications serve Server-Sent Events (SSE) together with view fragments, letting remote attackers corrupt the event stream and potentially bleed data across responses. No public exploit is identified at time of analysis and CISA has not listed the flaw in KEV; EPSS is low at 0.15% (5th percentile). The vendor-assigned 9.8 rating sits uneasily against the CWE-93 root cause, the 'Information Disclosure' tagging, and the SSVC 'exploitation: none' status, suggesting the paper severity outruns observed real-world risk.
WebFlux applications in Spring Framework running on the Jetty 12 Core reactive adapter omit the SameSite cookie attribute from serialized response cookies, exposing session and authentication cookies to cross-site request contexts. Affected versions span Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8, covering a substantial footprint of reactive Java deployments on Jetty 12. The vulnerability carries a vendor CVSS of 7.5 with C:H reflecting potential session-token disclosure; no public exploit code or active exploitation (CISA KEV) has been identified, and EPSS places exploitation probability at 0.14% (4th percentile).
Memory exhaustion in Spring Framework's RSocket server implementation allows unauthenticated remote attackers to crash or degrade affected applications by sending malformed SETUP frames that trigger unreclaimed heap allocations. All actively maintained Spring Framework branches are affected - 5.2.x through 7.0.x - with the condition that the application must explicitly expose an RSocket endpoint. No public exploit code has been identified at time of analysis, and CISA SSVC confirms no current exploitation activity, though the attack is classified as automatable.
Uncontrolled resource consumption in Spring Framework's SpEL evaluator allows unauthenticated remote attackers to trigger a Denial of Service by submitting expressions using the power operator (^) with BigDecimal or BigInteger operands and arbitrarily large exponents, causing unbounded CPU and memory exhaustion in the JVM. All maintained Spring Framework release lines from 5.2.x through 7.0.x are affected, covering a large portion of the enterprise Java ecosystem. No public exploit has been identified and exploitation probability is very low (EPSS 0.15%, 4th percentile), though SSVC flags the attack class as automatable.
Spring WebFlux's PartEventHttpMessageReader fails to enforce the configured maxPartSize limit when maxInMemorySize is explicitly set to -1, allowing remote unauthenticated attackers to upload multipart request parts of arbitrary size in violation of application-defined policy. Affected are Spring Framework 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. No public exploit code has been identified at time of analysis and EPSS is very low at 0.15% (4th percentile), but the SSVC automatable flag means scanning and exploitation can be automated at scale against exposed endpoints.
Server-side request forgery and remote code execution affect the Spring Framework's XsltView component across the 5.2.x through 7.0.x branches (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8). When a Spring MVC application maps '/**' to view rendering and does not explicitly set a view name, an attacker can steer view resolution to XsltView and supply a path that triggers outbound requests and code execution. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%), but SSVC rates the technical impact as total and automatable.
Authentication bypass in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 lets unauthenticated remote attackers reach and compromise the application purely over HTTP, with a successful exploit resulting in complete takeover of the WebCenter Sites instance (CVSS 3.1 base score 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Per the assessed vector there are no prerequisites beyond network reachability to the affected service: no credentials, no user interaction, and low attack complexity, which Oracle itself characterizes as 'easily exploitable.' No public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was supplied in the available intelligence, so the immediate driver for prioritization is the 9.8 severity combined with unauthenticated network exploitability rather than confirmed active exploitation.
An authentication bypass in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 enables unauthenticated remote attackers to take over the application via HTTP requests, rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity and availability impact. The vulnerability sits in the WebCenter Sites component of Oracle Fusion Middleware and requires no credentials, no user interaction and no non-default configuration - only network reachability of the HTTP service - making any internet-exposed instance an immediate target. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing), but the trivial attack prerequisites mean exposed deployments should be treated as urgent; instances confined to internal networks or sitting behind an authenticating reverse proxy or WAF have materially reduced reachable attack surface.
A low-privileged authenticated attacker with network access over HTTP can achieve complete takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0, with a CVSS 3.1 base score of 9.9 - the scope-change flag (S:C) indicates that a successful compromise can also significantly impact other co-located Fusion Middleware and WebLogic components, not just Sites itself. No user interaction is required, though valid low-privilege credentials (or a low-privilege session that can be obtained) are a prerequisite, so this is not pre-authentication. There is no public exploit identified at time of analysis and no confirmed active exploitation, but the low attack complexity and full confidentiality, integrity, and availability impact make this a high-priority item for any organization running the affected versions.
Oracle Managed File Transfer (MFT) Runtime Server, the file-transfer component of Oracle Fusion Middleware, allows an authenticated low-privileged attacker with network HTTP access to create, delete, modify, and read critical data handled by MFT, and the scope change (S:C) means a successful attack can escape the MFT trust boundary and impact additional Oracle products. The flaw is trivially reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, base 9.6), requiring no user interaction, but it is not pre-authentication: the attacker must already hold valid low-privileged credentials and be able to reach a MFT Runtime Server HTTP endpoint on versions 12.2.1.4.0 or 14.1.2.0.0. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (no CISA KEV listing); the 9.6 score reflects the confidentiality/integrity impact and cross-boundary scope change rather than observed exploitation, and the Oracle advisory provides no technical root-cause detail or CWE.
Unauthenticated attackers on the same adjacent network segment can compromise the Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0), bypassing authentication to gain unauthorized read/write access to critical data, with scope change potentially affecting other Oracle products. This high-severity vulnerability (CVSS 9.3) requires local network adjacency but no credentials or user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can achieve full takeover of Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 by exploiting an authentication bypass in the Web Container component reachable over HTTP. The vulnerability carries a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), meaning no credentials, user interaction, or special preconditions are required beyond network reachability to the WebLogic HTTP listener; the Scope:Changed rating indicates successful exploitation can also compromise additional products beyond WebLogic itself. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), but the trivial attack preconditions and maximum severity rating make this a top-priority patch target for any internet-exposed deployment.
Unauthenticated remote attackers can achieve full takeover of Oracle Platform Security for Java (OPSS) versions 12.2.1.4.0 and 14.1.2.0.0, an authentication-bypass flaw (CWE-287) in the Centralized Thirdparty Jars component of Oracle Fusion Middleware that carries a maximum CVSS 3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Because the scope is marked as changed (S:C), Oracle warns that a successful compromise of OPSS - the shared security services layer that other Fusion Middleware components depend on - may significantly propagate impact to additional products, which is what elevates this above the otherwise near-identical 9.8-rated issue. No public exploit code has been identified and there is no CISA KEV listing at time of analysis, but Oracle characterises the flaw as 'easily exploitable' with no privileges or user interaction required, so the practical limiting factor is whether the affected middleware's HTTP surface is network-reachable - internet-exposed deployments are at the highest risk.
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privilege authenticated user with HTTP access to the Client Bundle component to read all data accessible to the Capture application, and - because the vulnerable component crosses a security scope boundary - potentially reach data in adjacent Oracle Fusion Middleware products. The flaw is rated CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and is confidentiality-only, with no integrity or availability impact; exploitation requires an existing low-privilege account, so despite being tagged 'Authentication Bypass' in threat-intelligence feeds, this is not reachable by a fully unauthenticated actor. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and lack of user interaction make it attractive for post-authentication data theft against internet-exposed Capture deployments.
Unauthenticated remote attackers with HTTP access to Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware can achieve full takeover of the service by exploiting a flaw in the bundled Centralized Thirdparty Jars component. Only versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected by Oracle's advisory. The flaw carries a CVSS 3.1 base score of 8.1 with a High attack complexity rating, and no public exploit code or CISA KEV entry has been identified at time of analysis, so real-world exploitation appears opportunistic rather than widespread.
Full takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is achievable by an authenticated, high-privileged attacker who can reach the Authentication Engine over HTTP, with a CVSS 3.1 base score of 9.1 due to low attack complexity, no user interaction, and scope change that can affect integrated identity/SSO products. The PR:H prerequisite means this is realistically an insider or post-compromise privilege-abuse path rather than a remote unauthenticated break-in. No public exploit code was identified at time of analysis and no CISA KEV listing is present in the provided intelligence.
Improper authentication in the Messaging Enabler component of Oracle Fusion Middleware Service Delivery Platform allows unauthenticated remote attackers to bypass authentication and fully take over the product, compromising confidentiality, integrity, and availability. Affected releases are Oracle SDP 12.2.1.4.0 and 14.1.2.0.0, and per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires only network reachability to the Messaging Enabler HTTP interface - no credentials, privileges, or user interaction are needed. There is no public exploit code identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the main real-world limiting factor is exposure, since SDP is niche carrier/telecom middleware typically deployed inside operator networks rather than on the public internet.
Authenticated, low-privileged attackers with network HTTP access to the Messaging Enabler component of Oracle Service Delivery Platform (Fusion Middleware) can achieve full takeover of the platform, and because the CVSS profile carries a scope change (S:C) the compromise can extend to additional connected products beyond SDP itself. Oracle rates the issue CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), affecting SDP 12.2.1.4.0 and 14.1.2.0.0; exploitation needs valid low-privilege credentials but no user interaction, at low attack complexity, and no public exploit code has been identified at time of analysis. The realistic limiting factors are the credential prerequisite, the narrow deployment base of this specialized telecom service-delivery platform rather than general-purpose middleware, and the fact that the vector is well-calibrated rather than inflated.
Takeover of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler component) is achievable by a low-privileged, network-positioned attacker, carrying a CVSS 3.1 base score of 9.9 with a scope change (S:C) that lets a successful compromise spill over into other products. The affected releases are 12.2.1.4.0 and 14.1.2.0.0, and the attack path is the T3 and IIOP listeners; per the assessed vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) the attacker must already hold a valid low-privileged account on the platform, but no user interaction is required and confidentiality, integrity and availability impacts are all High. There is no public exploit code identified at time of analysis and the vulnerability is not listed in CISA KEV, so urgency rests on the near-maximum score and the exposure of internal T3/IIOP ports rather than on observed exploitation; the residual risk drops sharply where those proprietary protocols are firewalled or the platform is segmented away from untrusted users.
Authenticated remote attackers who can reach the WebLogic T3 or IIOP remoting interfaces of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler) can take over the product entirely, with the compromise extending to connected Oracle components because of the scope change. The flaw affects Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - no user interaction is required, but a valid low-privileged account is a prerequisite, so it is exploitable (not unauthenticated). No public exploit code and no confirmed active exploitation were identified at time of analysis; practical exposure is further narrowed because T3/IIOP ports are commonly firewalled or not internet-facing in hardened WebLogic deployments.
Oracle Platform Security for Java (component: Centralized Thirdparty Jars) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with logon access to the host to fully compromise the component, resulting in high confidentiality, integrity, and availability impact. The flaw is locally exploitable (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and requires only a valid low-privileged account on the infrastructure where the component executes. No public exploit code or CISA KEV listing is identified at time of analysis, and the vendor advisory is available via Oracle's Critical Patch Update.
Authentication bypass in Oracle Platform Security for Java (OPSS) 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to reach the affected SOAP interface and achieve full takeover of the OPSS instance, with high confidentiality, integrity, and availability impact (CVSS 9.8). The flaw is classified as CWE-287 improper authentication and is tagged as an authentication bypass; per the Oracle-supplied CVSS vector, no credentials or user interaction are required. No public exploit identified at time of analysis, but any reachable vulnerable OPSS service should be treated as high risk because the practical limiting factor is network exposure of the SOAP endpoint rather than a configuration prerequisite.
Unauthenticated remote attackers who can reach an exposed LDAP authentication path in Oracle Platform Security for Java (OPSS) can achieve complete takeover of the OPSS security framework in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, with full confidentiality, integrity and availability impact (CWE-287 improper authentication, CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the Centralized Thirdparty Jars component and requires no credentials and no user interaction, but exploitability in practice depends on network reachability: OPSS is an embedded security framework consumed by Fusion Middleware applications rather than a standalone internet-facing service, so internal-only or firewalled OPSS/LDAP endpoints substantially reduce exposure. No public exploit code and no CISA KEV entry were identified at time of analysis, and no real-world exploitation telemetry is available, so the 9.8 severity reflects assessed potential rather than observed attack activity.
Unauthenticated remote attackers who can reach the Portlet Services component of Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 over HTTP can bypass authentication and achieve full takeover of the application, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 9.8; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is an improper-authentication defect (CWE-287) and, per the assessed vector, needs no credentials, no user interaction and no non-default configuration, so any instance with Portlet Services reachable is directly at risk. No public exploit code has been identified at time of analysis, and the principal real-world limiter is exposure, since WebCenter Portal is typically deployed behind an enterprise perimeter rather than openly on the internet; this is nevertheless a high-priority issue on every available static signal, with thin real-world exploitation evidence.
Authenticated attackers holding a low-privileged account can exploit the Authentication Engine in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 over HTTPS to read, create, delete, or modify all data reachable through the service, with CVSS 3.1 base score 9.6 reflecting high confidentiality and integrity impact and a scope change. The flaw is remotely reachable with low attack complexity and no user interaction, but it is not pre-authentication: a valid low-tier credential on the OAM instance is required, which is the main limiting factor on exploitation. No public exploit identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); Oracle's Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source.
Unauthenticated takeover of Oracle JDeveloper is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0 through the ADF Faces component, which is exposed over HTTP; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms remote, unauthenticated, low-complexity exploitation requiring no user interaction, with full confidentiality, integrity, and availability impact. The root cause is an authentication bypass (CWE-287) rather than a memory-safety or injection flaw, meaning an attacker who can reach the ADF Faces web tier may be able to act with privileges they were never granted. No public exploit code has been identified at time of analysis and the vulnerability is not listed as confirmed actively exploited (CISA KEV); the main real-world constraint is network exposure, since JDeveloper is primarily a Java development IDE and its ADF Faces web tier is not normally published to untrusted networks.
Unauthenticated network attackers can obtain complete confidentiality and integrity compromise of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 through the Portlet Services component, but only after a legitimate portal user is induced to interact with attacker-influenced content - exploitation is gated by the UI:R prerequisite, which requires human interaction from a person other than the attacker. With a CVSS 3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), the flaw allows unauthorized creation, deletion or modification of, and complete read access to, data accessible through the portal, and because scope changes (S:C) the impact can extend to additional integrated products. There is no KEV listing and no public exploit identified at time of analysis, so this is a high-severity issue whose real-world risk is bounded by the need to socially engineer a valid portal user and by the narrow set of affected releases.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can be taken over by an unauthenticated remote attacker who reaches the Composer component over HTTP, because the component fails to properly enforce authentication (CWE-287). Oracle scores this 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or non-default configuration are required - only network reachability of the WebCenter Portal HTTP interface, with the stated outcome being full takeover of the portal. At time of analysis there is no public exploit identified and the issue is not listed as confirmed actively exploited (CISA KEV), so the practical risk is driven by exposure: internet-facing instances are directly at risk, while deployments confined to internal networks or sitting behind an authenticating reverse proxy or WAF are materially harder to reach. This is assessed as well-calibrated maximum severity rather than an inflated score, since an unauthenticated authentication bypass leading to product takeover justifies the C:H/I:H/A:H impact set.
Improper authentication in the Portlet Services component of Oracle WebCenter Portal allows unauthenticated attackers with HTTP network access to the portal to bypass authentication and gain read and write access to all portal-accessible data, including the ability to create, delete, or modify critical content. Only versions 12.2.1.4.0 and 14.1.2.0.0 of this Oracle Fusion Middleware product are affected, and the flaw is rated high severity (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) with no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exploitation risk is driven primarily by internet or broad-network exposure of an unpatched portal.
Authentication bypass in the Oracle Access Manager (Fusion Middleware) Authentication Engine lets unauthenticated remote attackers with HTTP network access compromise OAM instances running 12.2.1.4.0 or 14.1.2.1.0, resulting in complete takeover of the affected service with high confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation of the CWE-287 flaw effectively grants the attacker the identity and authorization context the Authentication Engine is supposed to enforce, so any downstream application trusting OAM for single sign-on or access decisions is exposed to the same session. At the time of analysis there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified; the practical exposure is driven almost entirely by the network reachability of the OAM Authentication Engine endpoint, with internet-facing gateways the highest priority to patch.
Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the affected Access Manager instance, rated CVSS 3.1 9.8 (CWE-287, Improper Authentication) with high confidentiality, integrity, and availability impact. The vulnerable component is the Authentication Engine itself, and the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms no credentials, privileges, or user interaction are required, so any HTTP-reachable OAM deployment of those two versions is a candidate entry point. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); however, Oracle characterizes it as easily exploitable, so internet-exposed OAM instances should be treated as urgent.
Unauthenticated remote attackers can bypass authentication in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0, gaining full read and write access to all data managed by the affected component. This easily exploitable vulnerability (CVSS 9.1) requires only network access to the OAM authentication engine over HTTP and no credentials or user interaction. No public exploit code or active exploitation has been observed at the time of analysis, but the lack of authentication and high impact make it a critical risk for exposed instances.
Unauthenticated network attackers who can reach the T3 or IIOP listener fronting Oracle Access Manager's Authentication Engine on versions 12.2.1.4.0 or 14.1.2.1.0 can bypass authentication and take full control of the component, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No credentials or user interaction are required; the only meaningful precondition is that the T3/IIOP protocols are reachable from the attacker's position, so deployments that restrict those protocols to trusted internal networks are not externally exploitable. This vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis, but the combination of a perfect-exploitability CVSS vector, an authentication-bypass root cause, and default-exposed WebLogic remoting protocols makes it a high-priority patch target.
Authentication weaknesses in the Oracle Access Manager Authentication Engine expose deployments running 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware: an attacker with network access over HTTP and only a low-privileged foothold can bypass or subvert authentication to create, delete, or modify critical data and read data across the OAM-accessible estate, while also degrading service availability. Because the CVSS vector carries a scope change (S:C), a compromise of OAM can propagate to other products that rely on it as their single sign-on and identity provider, which is what pushes the base score to 9.9 rather than the more typical 8.x for an authenticated-only flaw. No user interaction is required and attack complexity is low, though the PR:L rating means the attacker must already hold at least minimal valid access or be able to reach an authenticated interface - this is not a fully unauthenticated pre-auth bypass. There is no CISA KEV listing and no public exploit code identified in the available intelligence, so exploitation is not confirmed actively exploited (CISA KEV) and no public exploit identified at time of analysis.
Unauthenticated remote takeover of Oracle WebLogic Server is achievable through its T3 and IIOP protocol listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Classified as CWE-287 (Improper Authentication) and scored CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw allows any network-reachable attacker - no credentials, no user interaction - to gain full confidentiality, integrity, and availability impact over the affected server, which Oracle itself rates 'easily exploitable'. Exploitation hinges on reachability of the T3/IIOP listeners, which are enabled by default on the WebLogic administration and managed-server listen ports, meaning most standard deployments are exposed unless those protocols are filtered, disabled, or network-segmented; no public exploit code or confirmed in-the-wild activity was identified at time of analysis, so exposure should be treated as high-impact and high-priority but not yet observed as actively exploited.
Authentication bypass in Oracle WebLogic Server (Core component) allows unauthenticated, network-positioned attackers to gain full takeover of the server, earning the maximum CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with complete confidentiality, integrity, and availability impact. All four supported branches are affected: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Exploitation requires reachability of the T3 or IIOP protocol listener (commonly port 7001) with no authentication and no user interaction, and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV, so exposure is primarily governed by whether T3/IIOP is reachable from untrusted networks.
Unauthenticated remote takeover of Oracle WebLogic Server is achievable via the T3 and IIOP listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, where an improper-authentication defect (CWE-287) in the Core component of Oracle Fusion Middleware lets a network attacker bypass login and obtain full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The only real precondition is reachability of the T3/IIOP listener, which is enabled by default and usually shares the WebLogic HTTP port (7001); no credentials and no user interaction are required, so environments that firewall, disable, or connection-filter T3/IIOP materially reduce exposure. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but this is a genuine high-priority vulnerability rather than a CVSS-inflated one.
Authorization bypass in Apache ZooKeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 lets remote attackers delete empty persistent, container, and TTL znodes by sending a raw deleteContainer opcode (20) to the client port - 2181 by default - without any credentials or ACL grant, because that code path skips both the session check and the DELETE ACL check enforced by the normal delete path. The official client exposes no API for this internal-only opcode, so exploitation requires hand-crafting the ZooKeeper wire protocol, and non-empty nodes cannot be removed directly. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) the impact is integrity-only, and no public exploit code has been identified at time of analysis with EPSS at 0.24% (16th percentile); practical risk is governed mainly by whether port 2181 is reachable from outside the trusted application or ensemble network.
Improper certificate hostname validation in Apache ZooKeeper's quorum TLS path allows a CA-trusted peer certificate whose SAN does not match the connected host to be accepted when FIPS mode and quorum hostname verification are enabled, letting the holder of such a certificate join quorum traffic, participate in leader election, and enter replication flows. Only deployments that simultaneously set sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true and ssl.quorum.clientHostnameVerification=true on affected releases (3.8.0 through 3.8.6 and 3.9.0 through 3.9.5) are exposed; plain TLS and non-quorum-TLS ensembles are unaffected. Exploitation additionally requires a certificate chaining to a CA already trusted by the quorum truststore, so the practical barrier is high; no public exploit code has been identified at time of analysis, and EPSS is 0.12% (2nd percentile). Unauthenticated remote attackers are in scope per the CVSS vector (PR:N), though the certificate precondition makes real-world abuse a targeted rather than opportunistic scenario.
Unsafe Java object deserialization in IBM MQ (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / 9.3.0.0-9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS / 9.4.0.0-9.4.5.1 CD, and 10.0.0.0) lets an authenticated attacker who can deliver a crafted message trigger JNDI injection and achieve arbitrary code execution inside the consuming client application rather than the queue manager itself. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.5) characterizes a network-reachable but authentication-gated (PR:L) and high-complexity (AC:H) path whose scope change (S:C) derives from the code execution landing in a downstream client. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available.
Remote code execution in IBM MQ is possible when the optional IVT (Installation Verification Test) application is deployed and network-reachable, because that component performs unsafe JNDI lookups that a remote, unauthenticated attacker (CVSS PR:N/UI:N) can redirect to an attacker-controlled endpoint. Affected builds are IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0, although the non-default, verification-only nature of IVT means exposure is confined to environments where it is actually running and exposed. IBM has released patches, there is no public exploit identified at time of analysis (CISA SSVC exploitation status: none), and while the vendor score of 9.8 reflects total technical impact, our independent assessment raises attack complexity to AC:H to account for the IVT deployment prerequisite.
IBM MQ versions 9.1.0.0 through 9.4.5.1 across LTS and CD streams and 10.0.0.0 are affected by a JNDI injection flaw that can lead to information disclosure or remote code execution. The issue arises from insufficient input validation before JNDI lookup (CWE-74), and according to the supplied CVSS vector it is remotely reachable without authentication (AV:N/AC:H/PR:N/UI:N), though exploitation requires the attacker to also control a network-reachable directory service and successfully resolve malicious object references in the MQ JVM. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none with automatable set to no; IBM has released patches per its advisory.
IBM MQ message queueing middleware fails to properly restrict XML external entity resolution while processing MQRFH2 message headers, letting an authenticated queue user read server-side files or resources and drive the broker and its Java clients into a denial-of-service state. Affected releases span the 9.1.x, 9.2.x, 9.3.x and 9.4.x LTS/CD streams plus 10.0.0.0 Classes for Java, so any environment running the JMS/XMS or Java messaging client against a current broker is in scope. IBM has published a vendor fix and there is no public exploit code or CISA KEV entry identified at time of analysis, but the confidentiality and availability impact are both rated High (CVSS 8.1, AV:N/AC:L/PR:L/UI:N).
Remote code execution in RuoYi-Vue-Plus 6.0.0 lets an authenticated low-privileged user run arbitrary Java code on the server through the workflow task-completion endpoint POST /workflow/task/completeTask, which flows through FlwTaskController.java into FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process and the Warm-Flow TaskService.skip path. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network reachability and complete confidentiality, integrity and availability impact, but it requires a valid authenticated session rather than being pre-auth. No public exploit code or CISA KEV entry was identified from the supplied intelligence, and no EPSS score was provided.
Expression Language injection in Activiti through 7.1.0.M6 allows authenticated users to execute arbitrary code within the Spring application context. The ExpressionResolver fails to validate hash-brace deferred expressions (#{...}) when stored as process variables, meaning crafted payloads bypass the existing expression filter. When a BPMN mail task subsequently evaluates a variable-backed body field, the stored #{...} expression is resolved in the full Spring EL context, enabling method invocation on any registered application bean. No public exploit has been identified at time of analysis, and exploitation requires an authenticated user with process variable write access.
HTTP/1.1 request smuggling in http4s blaze allows a remote client to desynchronize message boundaries between blaze's hand-written Java wire parser and a fronting proxy, enabling front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. All deployments of blaze prior to 0.23.18, and the 1.0.0 milestone line from 1.0.0-M1 through 1.0.0-M41, are affected via five independent parser laxities that are reachable from a default BlazeServerBuilder with no non-default configuration. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis; CISA SSVC records exploitation as none and automatable as no, and no EPSS score was supplied with the source data.
Local privilege escalation to root in Apache Storm's setuid-root `worker-launcher` binary (storm-core 3.0.0) allows a tenant user with code execution on a supervisor node to redirect root-owned `lchown` and `chmod` operations to arbitrary host files via a symlink race. The binary uses FTS to walk worker directories and then re-resolves pathnames at syscall time, creating a TOCTOU window exploitable by any topology user who can write to an intermediate directory component. Because worker relaunches and blob updates repeatedly re-trigger the walk, exploitation is low-cost and repeatable; this defeats the isolation boundary that `supervisor.run.worker.as.user` is designed to enforce. No public exploit is identified at time of analysis.
Out-of-bounds write in snappy-java through 1.1.10.8 allows unauthenticated remote attackers to crash the JVM by supplying valid compressed data whose decompressed size exceeds the caller-provided destination ByteBuffer capacity. The `Snappy.uncompress(ByteBuffer, ByteBuffer)` method passes the destination buffer directly to the native Snappy decompressor via JNI without first asserting that its capacity can accommodate the full decompressed output, causing native-layer writes past the buffer boundary and abrupt JVM process termination. No public exploit code or active exploitation has been identified at time of analysis, but the attack is trivially constructible by any attacker familiar with the Snappy wire format against applications that process untrusted compressed input through this specific API overload.
Denial of service in Apache OpenNLP 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 lets a remote unauthenticated attacker pin CPU or crash a worker thread by feeding crafted text to either of the two built-in RegexNameFinder patterns (EMAIL and URL) obtained via RegexNameFinderFactory.getDefaultRegexNameFinders(). The EMAIL pattern's ambiguous nested quantifiers cause quadratic catastrophic backtracking (~32 KB of local-part characters burns seconds of CPU per find() call), while the URL pattern's nested capturing repetition recurses once per query token, exhausting the thread stack and throwing StackOverflowError (~4 KB, or ~1 KB on -Xss512k worker threads). No public exploit was identified at time of analysis; this is availability-only with no code execution or data exposure.
SymSpellModelSerializer in Apache OpenNLP 3.0.0-M4 and 3.0.0-M5 crashes the host JVM with an OutOfMemoryError when deserializing a crafted SymSpell binary model file whose unigramCount or bigramCount field is set to Integer.MAX_VALUE, forcing a 4-8 GB heap allocation attempt. The root cause (CWE-789: Uncontrolled Memory Allocation) is that these two 32-bit count fields are validated only for non-negativity - no upper bound prevents attacker-controlled pre-sizing of a LinkedHashMap before any dictionary entries are consumed. The attack payload is described by the advisory as under 100 bytes, requires no prior authentication if the target application accepts externally supplied model bytes, and is effective against every deserialization code path in the opennlp-spellcheck extension. No public exploit has been identified at time of analysis, and exposure is substantially limited to the small population running pre-release milestone builds.
Unauthenticated configuration tampering in OpenNMS Horizon allows any attacker with network reach to the web interface to disable event definitions and SNMP data collection by sending HTTP PATCH requests to unprotected /api/v2 REST API endpoints. The Spring Security authorization policy in applicationContext-spring-security.xml defined intercept-url rules for GET, POST, PUT, and DELETE but omitted PATCH entirely, leaving /api/v2/eventconf/**, /api/v2/datacollectionconf/**, /api/v2/snmp-config/**, and /api/v2/trapd/** open to unauthenticated writes. Changes are persisted and reloaded into the running system, silently suppressing alarm generation and stopping metric collection - an attacker can blind the monitoring platform before conducting further operations.
Use-after-free in the reactive client-side encryption component of the MongoDB Java Driver allows a party that can cancel an in-flight encrypted operation to crash the hosting application process. The flaw surfaces only when the reactive encryption stack is active and KMS credentials are fetched on demand - a specific non-default configuration - making the affected population a subset of all Java Driver deployments. No public exploit code or active exploitation has been identified at time of analysis; impact is confined to availability (process termination), with no confidentiality or integrity consequence.
Integer overflow in Amazon Deep Java Library's tensor buffer validation component (versions 0.13.0 through 0.36.0) enables remote unauthenticated attackers to read from adjacent process memory or crash the serving process by submitting a crafted tensor payload. The CVSS 4.0 score of 8.8 reflects a straightforward network-exploitable path requiring no authentication and no preconditions (AV:N/AC:L/PR:N/UI:N), with dual confidentiality and availability impact. Vendor-released patch 0.37.0 is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands against the backend database. The vulnerability stems from unsafe `${}` string concatenation in MyBatis Mapper files - including AdminMapper.java, MerchantWithdrawRecordMapper.java, and MemberWithdrawRecordMapper.java - which bypasses parameterized query protections. Successful exploitation yields full confidentiality, integrity, and availability impact on the underlying database, confirmed by a proof-of-concept published on GitHub.
Remote code execution in Apache Impala 2.7.0 through 4.5.1 allows an authorized user with table-creation and remote-storage upload privileges to load and execute arbitrary Java classes on Impala daemon nodes by exploiting insufficient authorization controls over External Data Source tables. The vulnerability abuses Impala's legitimate extensibility feature - Data Source tables - which permits custom Java class loading from remote storage; insufficient authorization checks mean any user holding those two combined privileges can weaponize the feature for server-side code execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; upgrade to 4.5.2 is the vendor-confirmed fix.
Improper authentication handling in Spring Cloud Azure (versions 1.0.0 through releases before 7.4.0) allows an unauthenticated remote attacker to bypass authentication logic and elevate privileges within a Java application that embeds the library, yielding high confidentiality, integrity, and availability impact on the affected component and its Azure-connected resources. The 8.1 CVSS rating is moderated by a High attack-complexity metric, meaning the bypass hinges on a specific, non-trivial condition or configuration the attacker must satisfy rather than a single trivial request. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score is low at 0.64 percent (49th percentile), so the risk is driven by exposure of vulnerable deployments rather than observed attack activity.
Path traversal in Apache FreeMarker's template loading (versions 2.2.0 through 2.3.34) lets remote attackers who can influence the locale identifier passed to FreeMarker read templates outside the intended path when the default-enabled localized lookup feature is active. The actual reach is bounded by the configured TemplateLoader - FileTemplateLoader still blocks escape from its baseDir, while classloader- or servlet-context-backed loaders are limited to resources those mechanisms can reach. EPSS is low (0.21%, 11th percentile), no public exploit is identified at time of analysis, and it is not in CISA KEV.
Arbitrary command execution in SAP GUI for Java arises because the client does not correctly enforce its trust-level policy for certain functions that a connected backend can invoke. A low-privileged attacker who controls or compromises a backend SAP system can trigger the affected client-side functionality to run commands on the connected user's workstation, with high impact to confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.0 (scope-changed, requiring user interaction), it was reported by SAP with a fix note, and there is no public exploit identified at time of analysis.
Decompression bomb handling in Amazon ion-java before version 1.12.1 allows remote unauthenticated attackers to cause denial of service by submitting crafted GZIP-compressed Ion documents that expand to arbitrarily large sizes during automatic decompression. The vulnerability is a bypass of the incomplete fix for CVE-2026-75936, which introduced a GZIP auto-decompression opt-out that did not cover all decompression paths in the library. No public exploit has been identified at time of analysis, but the straightforward nature of decompression bomb construction makes the attack practically accessible to any attacker who can submit Ion data to a vulnerable application.
Local privilege escalation to root in Amazon's log4j-cve-2021-44228-hotpatch package (Amazon Linux before version 1.3-9) stems from an OS command injection flaw triggered when the hotpatch daemon processes a Java executable whose filesystem path contains embedded newline characters. A low-privileged local user can craft such a path and launch a Java process, causing the unpatched daemon to pass the unsanitized path into a shell command and execute the injected content with root privileges. Amazon has released a patched version (1.3-9) via ALAS2-2026-3784; no public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary OS command execution in GeoNetwork before 4.4.12 and 4.2.17 arises because the Saxon XSLT processor that renders formatters runs without FEATURE_SECURE_PROCESSING and with Java extension functions (ALLOW_EXTERNAL_FUNCTIONS) enabled. A user privileged enough to upload a formatter can supply a malicious .xsl stylesheet that invokes java.lang.Runtime.exec() or java.lang.ProcessBuilder, running commands as the GeoNetwork process user. No public exploit is identified at time of analysis, though the vendor GHSA advisory and public reporting describe the technique in detail.
Session cookie forgery in Dianping CAT (Central Application Tracking) through version 3.1.0 lets remote unauthenticated attackers mint valid administrator sessions. The server uses Java's String.hashCode() as the only integrity check on session cookies without any server-side secret key, so an attacker can compute a matching checksum entirely offline; combining this with a spoofed x-forwarded-for header to defeat IP-binding validation yields a full-access admin session over CAT's configuration. Reported by VulnCheck; no public exploit has been identified at time of analysis, but the technique is fully documented in the advisory and the vulnerable code (TokenBuilder.java, HttpUtils.java) is public.
Authorization bypass in Eclipse Arrowhead 5.0.0-5.2.1 allows any authenticated system - regardless of privilege level - to reach every protected management API endpoint by submitting percent-encoded paths that defeat the raw-URL substring check while still being routed by Spring MVC's decoded dispatcher. Exploiting the flaw is trivial: encoding a single character in '/mgmt/' (e.g. 'm' → '%6D') causes the filter to fall through without authorizing the request, yet Tomcat decodes and dispatches it normally. The highest-impact target is POST /authentication/mgmt/identities, which creates new sysop-level accounts, yielding full administrative takeover of the Arrowhead local cloud. No public exploit has been identified at time of analysis.
Remote code execution in Lutece Core (versions up to and including 7.1.7) allows an authenticated administrator to run arbitrary Java code on the server by abusing the XSL export management module. Because the XML/XSLT processor is configured without FEATURE_SECURE_PROCESSING, malicious XSL stylesheets can invoke Java extension functions; an admin uploads a crafted XSL transformation and triggers it during a user export. Rated CVSS 4.0 9.4 (critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side template injection in the Qute template engine's ReflectionValueResolver allows authenticated remote attackers with the ability to influence template content to bypass Java sandbox restrictions and execute arbitrary OS commands on the server. Affected Red Hat products include Red Hat Build of Quarkus, Red Hat Build of Apache Camel 4 for Quarkus 3, and the JBoss EAP Expansion Pack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the CVSS score of 8.8 and full C/I/A impact make this a high-priority patching target for any Quarkus deployment exposing user-influenced template rendering.
Per-file size and file-count upload limit enforcement in Apache Wicket 8.x through 10.x can be bypassed when a co-deployed servlet component pre-consumes the multipart request body before Wicket processes it. Affected deployments fall back to HttpServletRequest#getParts(), which silently skips Wicket's configured Form#setFileMaxSize and Form#setFileCountMax constraints, allowing remote unauthenticated submitters to upload files larger or more numerous than the application intends to permit. Parts omitting a Content-Type header are additionally loaded entirely into JVM heap during parsing, creating a secondary denial-of-service path limited only by external container allocation bounds. No public exploit or CISA KEV listing exists; EPSS stands at 0.20% (10th percentile), consistent with a conditional, architecturally specific flaw.
Unauthenticated XML External Entity (XXE) injection in MapFish Print's GML layer parser allows remote attackers to read arbitrary server-side files and conduct server-side request forgery (SSRF) via a single crafted HTTP POST to the /api/print3/print endpoint. All 3.x branches prior to 3.28.30, 3.30.32, 3.31.24, and 3.33.16, as well as 4.x prior to 4.0.5, are affected. A fully functional proof-of-concept exploit has been publicly disclosed in the GitHub Security Advisory GHSA-5v29-34h8-v68r, enabling exfiltration of Kubernetes service account tokens, OS credential files, and TLS certificates with no authentication required.
Log-record tampering in Graylog's FortiGate syslog parser enables unauthenticated network senders to overwrite or erase critical security-log fields - including srcip, dstip, date, time, and tz - or cause entire log messages to be silently discarded, creating a viable log-evasion primitive. Affected are Graylog Server versions prior to 6.3.12, 7.0.7, and 7.1.2 (all branches), and Graylog Forwarder prior to version 7.3, on any deployment ingesting FortiGate key-value syslog. No public exploit code exists and this is not in CISA KEV, but the attack requires no authentication and minimal crafting skill, making it a realistic threat to security-monitoring integrity in FortiGate-centric environments.
Remote code execution in Yamcs (yamcs-core <= 5.12.7 and 5.13.0-5.13.1) lets an authenticated, low-privileged user run arbitrary OS commands by injecting a StreamSQL LIKE pattern that breaks out of a generated Java string literal compiled at runtime by Janino. Because the pattern is embedded raw whether it arrives as a SQL literal or a bound '?' argument, the sink is reachable not only from the archiving endpoints but from routine read-only APIs (readRows, events search, activities listing), including the Events page search box. A detailed vendor-published proof of concept exists; this is not in CISA KEV, so it is publicly available exploit code rather than confirmed active exploitation.
Remote code execution in Yamcs (open-source mission-control server) versions <= 5.12.7 and 5.13.0-5.13.1 allows a caller with the CreateInstances privilege - or any unauthenticated user in the default no-security.yaml configuration where guest is superuser - to inject YAML into an instance template via the templateArgs parameter of POST /api/instances (and PATCH /api/instances/{instance}). Because arguments are written into the rendered config as raw, unescaped text and then loaded as YAML, an attacker can inject a services: entry that instantiates org.yamcs.ProcessRunner and executes an arbitrary command as the Yamcs service account. Publicly available exploit code exists (a full PoC with a reverse shell is published in the GitHub Security Advisory), and vendor patches are available in 5.12.8 and 5.13.2.
Unauthenticated directory traversal in Yamcs versions up to and including 5.8.6 (per advisory scope, < 5.11.13 per package metadata) allows any remote attacker to read arbitrary files from the underlying host operating system by sending a crafted HTTP request. The flaw resides in StaticFileHandler.java, which resolves user-supplied URL paths against a static file root without verifying the resolved path stays within that root - a double-slash prefix (e.g., //etc/passwd) is sufficient to escape the boundary. No public exploit identified at time of analysis, though the steps-to-reproduce are fully published in the GitHub Security Advisory and the vulnerability was demonstrated in a public CTF challenge at DEFCON 33.
Remote code execution in Yamcs (Mission Control) versions <= 5.12.7 and 5.13.0-5.13.1 allows an authenticated user holding the ControlArchiving system privilege to run arbitrary Java on the server host by embedding executable code in a StreamSQL column name. The malicious name is interpolated unescaped into Java source that Janino compiles without a sandbox when a sum() aggregate is evaluated over that column via POST /api/archive/{instance}:executeSql. This is a second, independent Janino sink sharing the root cause of CVE-2026-44632, which the earlier fix did not close; the advisory (GHSA-3g44-3m7x-cgg2) includes a full working PoC verified end-to-end against a real, security-enabled Yamcs 5.13.0, though there is no CISA KEV listing.
Remote code execution affects PaperCut MF and PaperCut NG through unsafe dynamic class loading in the database connection utilities, which instantiate JDBC driver classes from configurable driver names without validating them against an allowlist. An attacker who can control administrative system configuration parameters can force the server to load and execute arbitrary Java bytecode already present on the application classpath, running with the full privileges of the PaperCut server process. No public exploit identified at time of analysis, but the PR:H requirement and PaperCut's history of being targeted make prompt patching advisable.
Spring Integration's reactive message pipeline leaks reply routing and security headers across concurrent users when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering operator that emits raw payloads, causing one user's replyChannel, correlationId, and security or tenant headers to be applied to another concurrent user's response. Affected versions span the 5.5.x, 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines across the core Spring Integration library, as confirmed by VMware via the spring.io security advisory. The CVSS 8.2 score reflects network exploitability with no authentication required and high confidentiality impact; no public exploit has been identified at time of analysis.
Stored cross-site scripting in Spring Authorization Server's DefaultConsentPage allows network-accessible, unauthenticated attackers to inject arbitrary JavaScript into the OAuth2 consent screen presented to legitimate users. Affected versions span 1.4.0-1.4.11 and 1.5.0-1.5.8; the attack payload is embedded in a crafted OAuth2 authorization request, persisted server-side, and executed in the victim's browser when they view the consent dialog. No public exploit has been identified at time of analysis, but the low-complexity injection mechanism combined with a CVSS 8.2 base score and high confidentiality impact makes this an urgent remediation target for any deployment relying on the default consent page.
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across Spring Framework 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19 and 7.0.0-7.0.8, where unneutralized CRLF sequences (CWE-93) let an attacker inject into or corrupt the event stream. Reported by VMware/Spring and tagged as Information Disclosure, the flaw can break stream framing and potentially leak or splice data across SSE responses. No public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile), but the vendor-assigned CVSS of 9.8 (all-High impact) sits in tension with the information-disclosure framing and warrants scrutiny.
JdbcMessageStore deserialization allowlist protection in Spring Integration silently fails when the store is configured as a Spring-managed bean, rendering the security control entirely ineffective. Operators who call addAllowedPatterns() to restrict which Java classes can be deserialized from the JDBC message store receive no actual protection - any class remains deserializable despite the configured allowlist - leaving applications exposed to unsafe Java deserialization attacks while operators believe they have hardened the component. Affected across Spring Integration 6.4.x through 7.1.0; no public exploit identified at time of analysis.
Spring for GraphQL's Spring Data pagination integration blindly forwards client-supplied Connection field arguments to the underlying repository without enforcing resource limits, enabling an unauthenticated remote attacker to exhaust JVM heap memory or impose sustained load on the backing datastore via crafted GraphQL pagination queries. Three release branches are affected: 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9, as confirmed by EUVD-2026-67178 and the VMware/Spring security advisory. No public exploit has been identified and the EPSS probability is very low (0.16%, 5th percentile), though the unauthenticated, network-accessible attack path makes any openly exposed endpoint a viable denial-of-service target.
Cross-origin data exfiltration in Spring for GraphQL exposes confidential application data when a victim browses a crafted URL pointing to the bundled GraphiQL interface. The GraphiQL IDE, intended for development use, can be weaponized to direct the victim's authenticated browser session to send GraphQL queries whose responses are leaked to an attacker-controlled origin. All major release lines from 1.0.0 through 2.0.4 are affected; no public exploit has been identified and the EPSS score sits at the 4th percentile, but the high confidentiality impact (C:H) and scope change make this notable for any deployment with GraphiQL exposed beyond trusted networks.
Spring for GraphQL's bundled GraphiQL developer IDE loads third-party JavaScript libraries from a public CDN without Subresource Integrity (SRI) verification, allowing any attacker capable of tampering with CDN responses to inject and execute arbitrary JavaScript in any browser that loads the GraphiQL page. All four maintained release lines are affected (1.0.x through 2.0.4), as confirmed by the VMware/Spring security advisory and EUVD-2026-67175. No public exploit code has been identified at time of analysis, and EPSS at 0.11% (2nd percentile) reflects currently minimal exploitation activity.
Unsafe deserialization in Spring for GraphQL 2.0.0-2.0.4 exposes Java applications to potential remote code execution when processing paginated GraphQL queries. The flaw, classified as CWE-502, allows network-accessible, unauthenticated attackers to supply crafted payloads through pagination parameters that are deserialized server-side without adequate type safety. CVSS 8.1 with AC:H reflects that exploitation hinges on the presence of a suitable Java gadget chain on the application classpath; EPSS of 0.44% (36th percentile) and no KEV listing indicate no widespread exploitation has been observed at time of analysis.
Unrestricted property key injection via Spring Cloud Commons' writable /actuator/env endpoint allows authenticated administrators to POST arbitrary environment properties with no allow-list enforcement, affecting all currently maintained release lines (3.1.10 and earlier through 5.0.2). With CVSS PR:H and a scope change (S:C), exploitation requires admin-level access to the actuator endpoint but can cascade integrity impacts across the entire Spring application context. No public exploit has been identified at time of analysis, and exploitation is gated on a non-default configuration requiring deliberate enablement of write access to the actuator endpoint.
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input escape the restricted SimpleEvaluationContext sandbox when the SpEL bytecode compiler is active, affecting Spring Framework 5.2.x through 7.0.8 across the 5.3, 6.0, 6.1, 6.2 and 7.0 lines. Because SimpleEvaluationContext is the API applications are told to use to safely evaluate untrusted expressions, this bypass can escalate a data-binding-only context into broader method invocation with high integrity and availability impact (CVSS 9.1, CWE-913). There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), indicating no observed mass exploitation yet.
Denial of Service exposure in Spring Framework's data binding infrastructure allows unauthenticated remote attackers to exhaust application resources by submitting crafted property path expressions to any endpoint that binds user-supplied paths onto Java target objects. Affected versions span the entire actively maintained Spring Framework lineage - 5.2.x through 7.0.x - making the aggregate exposure footprint very large. No public exploit is referenced and EPSS sits at 0.15% (4th percentile), indicating low current exploitation activity despite the high CVSS score of 7.5.
Insufficient input validation in Spring Security's OAuth2 Authorization Server module (versions 7.0.0-7.0.4) allows an attacker holding a valid Initial Access Token to register a malicious OAuth2 client with crafted metadata fields via the Dynamic Client Registration endpoint. Depending on server configuration and how the metadata is subsequently rendered or fetched, the impact spans Stored XSS (targeting administrator sessions), Privilege Escalation (through insufficiently constrained scopes or grant types), or SSRF against internal infrastructure. No public exploit code or CISA KEV listing exists at time of analysis, but the SSVC framework rates the technical impact as total, warranting priority remediation for any deployment with Dynamic Client Registration explicitly enabled.
Improper authorization in Spring Security's embedded UnboundID test LDAP server (UnboundIdContainer) exposes an administrative directory account to the network: the container unconditionally registers an admin credential and binds its listener to all local interfaces (0.0.0.0) rather than loopback. Affected releases span 5.7.0-5.7.25, 5.8.0-5.8.27, 6.4.0-6.4.18, 6.5.0-6.5.11, 7.0.0-7.0.6 and 7.1.0; any application that instantiates this container becomes reachable by remote unauthenticated clients that can then read and modify directory contents using the known admin bind. No public exploit has been identified, and EPSS is low (0.29%, 21st percentile).
Path traversal in Spring Cloud Config Server's native environment repository allows unauthenticated remote attackers to read arbitrary files outside the configured search-locations directory on the server filesystem. Affected deployments span four release lines - 3.1.14 and earlier, 4.0.0-4.2.8, 4.3.0-4.3.4, and 5.0.0-5.0.4 - and are limited to the native filesystem backend mode. No public exploit code has been identified and CISA KEV does not list this vulnerability, though the centralized role of Config Server as a secrets store elevates real-world impact beyond the raw EPSS percentile.
Spring WebFlux applications that enable WebSocket connections leak request headers - potentially containing Authorization tokens, session cookies, or API keys - through exception reason messages exposed over the WebSocket channel. All maintained Spring Framework release trains from 5.2.x through 7.0.x are affected, covering the vast majority of actively deployed Spring reactive applications. The vulnerability is classified as information disclosure (CWE-209), and while the CVSS score is 7.5, the EPSS score of 0.14% (4th percentile) indicates very low observed exploitation probability; no public exploit or CISA KEV listing exists at time of analysis.
Authorization bypass in Spring Framework WebFlux functional-endpoint applications deployed on DispatcherServlet allows an attacker to defeat header-based route predicates by sending a CORS pre-flight (OPTIONS) request, reaching routes that should have been gated by header conditions. It affects Spring Framework 5.2.5-5.2.25, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8 in the specific WebFlux-functional-plus-DispatcherServlet deployment mode. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.19%, 9th percentile).
Denial of service in Spring Framework WebFlux applications (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, 7.0.0-7.0.8) occurs when the Aalto XML processor is used to parse request bodies, because the maxInMemorySize buffering limit is not correctly enforced. Remote attackers can submit oversized XML to trigger unbounded in-memory buffering and exhaust heap memory. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile) and CISA SSVC lists exploitation status as none, though it rates the flaw automatable with total technical impact.
Cross-response information disclosure and stream corruption affects Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8 (both MVC and WebFlux) when applications serve Server-Sent Events (SSE) together with view fragments, letting remote attackers corrupt the event stream and potentially bleed data across responses. No public exploit is identified at time of analysis and CISA has not listed the flaw in KEV; EPSS is low at 0.15% (5th percentile). The vendor-assigned 9.8 rating sits uneasily against the CWE-93 root cause, the 'Information Disclosure' tagging, and the SSVC 'exploitation: none' status, suggesting the paper severity outruns observed real-world risk.
WebFlux applications in Spring Framework running on the Jetty 12 Core reactive adapter omit the SameSite cookie attribute from serialized response cookies, exposing session and authentication cookies to cross-site request contexts. Affected versions span Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8, covering a substantial footprint of reactive Java deployments on Jetty 12. The vulnerability carries a vendor CVSS of 7.5 with C:H reflecting potential session-token disclosure; no public exploit code or active exploitation (CISA KEV) has been identified, and EPSS places exploitation probability at 0.14% (4th percentile).
Memory exhaustion in Spring Framework's RSocket server implementation allows unauthenticated remote attackers to crash or degrade affected applications by sending malformed SETUP frames that trigger unreclaimed heap allocations. All actively maintained Spring Framework branches are affected - 5.2.x through 7.0.x - with the condition that the application must explicitly expose an RSocket endpoint. No public exploit code has been identified at time of analysis, and CISA SSVC confirms no current exploitation activity, though the attack is classified as automatable.
Uncontrolled resource consumption in Spring Framework's SpEL evaluator allows unauthenticated remote attackers to trigger a Denial of Service by submitting expressions using the power operator (^) with BigDecimal or BigInteger operands and arbitrarily large exponents, causing unbounded CPU and memory exhaustion in the JVM. All maintained Spring Framework release lines from 5.2.x through 7.0.x are affected, covering a large portion of the enterprise Java ecosystem. No public exploit has been identified and exploitation probability is very low (EPSS 0.15%, 4th percentile), though SSVC flags the attack class as automatable.
Spring WebFlux's PartEventHttpMessageReader fails to enforce the configured maxPartSize limit when maxInMemorySize is explicitly set to -1, allowing remote unauthenticated attackers to upload multipart request parts of arbitrary size in violation of application-defined policy. Affected are Spring Framework 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. No public exploit code has been identified at time of analysis and EPSS is very low at 0.15% (4th percentile), but the SSVC automatable flag means scanning and exploitation can be automated at scale against exposed endpoints.
Server-side request forgery and remote code execution affect the Spring Framework's XsltView component across the 5.2.x through 7.0.x branches (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8). When a Spring MVC application maps '/**' to view rendering and does not explicitly set a view name, an attacker can steer view resolution to XsltView and supply a path that triggers outbound requests and code execution. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%), but SSVC rates the technical impact as total and automatable.