Learning Management
Monthly
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read and modify all data accessible to the application. The flaw is rated CVSS 8.1 and tagged as an authentication bypass, meaning a limited account can escalate to full read/write over critical Learning Management data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the application after luring a victim into interacting. Rated CVSS 3.1 7.3 (High) with full confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the required user interaction moderates raw exploitability.
Unauthenticated remote access to Oracle Learning Management (E-Business Suite versions 12.2.3 through 12.2.15) enables attackers to read, insert, update, or delete subsets of application data via HTTP without any credentials. Tagged as an authentication bypass in the Internal Operations component, this vulnerability exposes organizations running these specific EBS versions to unauthorized data manipulation affecting confidentiality and integrity. No public exploit code or active exploitation has been identified at time of analysis, but the low-complexity, no-authentication attack profile warrants prompt patching under Oracle's August 2026 Critical Patch Update.
Import and Export component exploitation in Oracle Learning Management (Oracle E-Business Suite 12.2.3-12.2.15) allows a network-authenticated low-privileged user to partially read, manipulate, or delete LMS data and degrade service availability over HTTP. The flaw is rated CVSS 6.3 with low attack complexity and no user interaction required beyond a valid account. No public exploit code or CISA KEV listing has been identified at time of analysis, positioning this as a credible internal-threat-actor or compromised-credential risk rather than an opportunistic internet-facing attack.
Unauthorized data disclosure in Oracle Learning Management (E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to access critical or complete LMS data via the Import and Export component over HTTP. Tagged as an Authentication Bypass, the flaw enables privilege escalation beyond the attacker's granted access level, resulting in full confidentiality compromise of all Learning Management accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network vector make this straightforward to exploit once credentials are obtained.
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Setup). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: OTA Training Activities). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read and modify all data accessible to the application. The flaw is rated CVSS 8.1 and tagged as an authentication bypass, meaning a limited account can escalate to full read/write over critical Learning Management data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the application after luring a victim into interacting. Rated CVSS 3.1 7.3 (High) with full confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the required user interaction moderates raw exploitability.
Unauthenticated remote access to Oracle Learning Management (E-Business Suite versions 12.2.3 through 12.2.15) enables attackers to read, insert, update, or delete subsets of application data via HTTP without any credentials. Tagged as an authentication bypass in the Internal Operations component, this vulnerability exposes organizations running these specific EBS versions to unauthorized data manipulation affecting confidentiality and integrity. No public exploit code or active exploitation has been identified at time of analysis, but the low-complexity, no-authentication attack profile warrants prompt patching under Oracle's August 2026 Critical Patch Update.
Import and Export component exploitation in Oracle Learning Management (Oracle E-Business Suite 12.2.3-12.2.15) allows a network-authenticated low-privileged user to partially read, manipulate, or delete LMS data and degrade service availability over HTTP. The flaw is rated CVSS 6.3 with low attack complexity and no user interaction required beyond a valid account. No public exploit code or CISA KEV listing has been identified at time of analysis, positioning this as a credible internal-threat-actor or compromised-credential risk rather than an opportunistic internet-facing attack.
Unauthorized data disclosure in Oracle Learning Management (E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to access critical or complete LMS data via the Import and Export component over HTTP. Tagged as an Authentication Bypass, the flaw enables privilege escalation beyond the attacker's granted access level, resulting in full confidentiality compromise of all Learning Management accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network vector make this straightforward to exploit once credentials are obtained.
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Setup). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: OTA Training Activities). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.