Oracle
Monthly
Authorization bypass in the Rucio `/credentials/signurl` REST endpoint lets any holder of a valid auth token obtain presigned read, write or delete URLs for arbitrary objects in cloud-backed storage. The endpoint performs its root-only permission check against the client-supplied `X-Rucio-Account` header rather than the token-authenticated identity, so a low-privilege user can simply send `X-Rucio-Account: root` and have the server sign a URL with the RSE's stored S3/GCS/Swift credentials. Exploitation requires an authenticated account (CVSS PR:L) and a cloud-backed RSE, with no user interaction; the advisory documents a proof-of-concept request, and no active exploitation is confirmed (not in CISA KEV).
Use of a hard-coded cryptographic key in Johnson Controls Kantech EntraPass before 9.20 enables a padding oracle crypto attack. Exploitation requires local access and low-level privileges (AV:L/PR:L per the vendor CVSS 4.0 vector), so the attacker must already have authenticated or local foothold on the EntraPass system rather than operating as a remote unauthenticated adversary; impact is high across confidentiality, integrity and availability of the affected system. No CISA KEV entry, public exploit code, or EPSS score was provided, and the product's fixed 9.20 release resolves the condition.
Remote unauthenticated compromise of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition is possible through the JSSE component when attacker-influenced data reaches the affected APIs. The listed affected builds include Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, and 27.0.1.0.2, plus GraalVM for JDK 17.0.21.0.2/21.0.13.0.2 and GraalVM Enterprise Edition 21.3.20.0.2. Per the assessed CVSS vector AV:N/AC:L/PR:N/UI:N, exploitation is remote, unauthenticated, and requires no user interaction on the API path, with high confidentiality and integrity impact and no availability impact; no CISA KEV entry, public exploit code, or EPSS score was supplied, and the vuln.today decision label is act_now.
Any authenticated control panel user in Craft CMS - regardless of privilege level - can escape the Twig sandbox through an element-search condition and use a boolean oracle to recover the site's GeneralConfig::securityKey character by character, then forge Craft's HMAC-signed parameters offline and reach unsandboxed View::renderObjectTemplate(), where Twig string-callable syntax invokes native PHP callables as the web server user. Default installations in the ranges 4.0.0 to before 4.18.9 and 5.0.0 to before 5.11.2 are affected; no non-default configuration is required and no user interaction is involved. The vendor-released fix is 4.18.9 (4.x) and 5.11.2 (5.x); exploitation is not confirmed in the wild and no EPSS or KEV signal was supplied, though the advisory documents a regression proof that invokes a harmless substr() callback rather than an OS command. The vulnerability is a genuine high-priority issue rather than a CVSS-inflated one, though the authentication prerequisite tempers it.
The RISC-V futex implementation in the Linux kernel fails to strip address tags from user-supplied pointers before executing atomic operations, allowing a local unprivileged process to make FUTEX_WAKE_OP write to an arbitrary kernel address. Affected systems must run RISC-V with CONFIG_RISCV_ISA_SUPM, have the tagged-address ABI enabled via PR_SET_TAGGED_ADDR_CTRL with a non-zero PMLEN, and use Sv57 paging with PMLEN=16 so that tag bits overlap canonical kernel address bits - on such configurations the flaw yields both kernel memory corruption and, through the FUTEX_OP_CMP_* result, a read oracle that discloses kernel memory. The vendor has published fixes in Linux 6.18.57, 7.2.11 and 7.3 (commits 8e48d8d51ab37b7decfbff3e2844e027a52ad6ea, 405290be962b32eec842776fbe3bdf81f15b1676 and 2e5c80bbc062a8dda33e687ebf7be8f074ee4f7d); no public exploit has been identified at time of analysis and EPSS is low at 0.21% (10th percentile), reflecting the narrow hardware/configuration prerequisites rather than the severity of the outcome.
Unauthenticated remote attackers can read and tamper with critical data handled by Oracle Java SE through its JSSE (Java Secure Socket Extension) component, rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N). Affected builds are Java SE 8u511 and 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, plus Oracle GraalVM for JDK 17.0.21 and 21.0.13 and GraalVM Enterprise Edition 21.3.20. Oracle's alert states the flaw is reachable via APIs of the affected component, such as a web service feeding untrusted data into JSSE, and adds a secondary sandbox-escape path for deployments running untrusted code in Java Web Start applications or applets; no public exploit code or active exploitation was identified at time of analysis, but the missing authentication prerequisite and network reachability make this a high-priority patch target rather than a paper finding.
Low-privileged authenticated attackers can achieve full takeover of Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 by sending SQL against the Dictionary Repository component over the network. Exploitation requires a valid low-privilege ODI account but no user interaction and only low attack complexity, with high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and no CISA KEV status was supplied.
Remote unauthenticated takeover of Oracle Essbase 21.8.3.0.0 is possible through the TCP-exposed Security component, with CVSS 3.1 scoring 9.8 and high confidentiality, integrity, and availability impact. Exploitation needs only network reachability to the affected service, no credentials, and no user interaction, so internet-facing or broadly reachable Essbase deployments carry the greatest risk. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Oracle Essbase 21.8.3.0.0 can be hung or repeatedly crashed by unauthenticated remote attackers who can reach the Security component over TCP, producing a complete denial of service with no confidentiality or integrity impact. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), so no credentials or user interaction are required according to the supplied assessment. No public exploit identified at time of analysis, and no CISA KEV entry is present; exposure is highest for internet-reachable or broadly accessible Essbase deployments.
Authenticated low-privileged attackers with network access to Oracle Essbase 21.8.3.0.0's T3/IIOP listeners can achieve full takeover of the Essbase instance, with scope change allowing significant impact on additional products. The vulnerability carries a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is considered high priority; no public exploit identified at time of analysis, and no CISA KEV confirmation was provided. Exploitation is gated by reachability to the T3/IIOP management protocols and possession of a low-privileged account.
Low-privileged authenticated users of Oracle Essbase 21.8.3.0.0 can reach beyond their assigned privilege boundary through the Security component over HTTP and read critical data they should not be able to see, including data exposed in downstream products because the vulnerability crosses a security scope boundary. Oracle scores this 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N): confidentiality-only, with no integrity or availability impact, and exploitation requires a valid low-privileged account rather than being unauthenticated. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in internet- or network-reachable Essbase deployments where low-level credentials are broadly distributed.
Oracle Essbase 21.8.3.0.0 exposes critical data through its Build component to an authenticated low-privileged attacker with HTTP network access. The flaw is easily exploitable (AC:L, no user interaction), can cross a scope boundary to affect additional products, and has a high confidentiality impact with no integrity or availability effect. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a mid-tier priority rather than an emergency.
Remote takeover of Oracle Essbase 21.8.3.0.0 is possible for low-privileged authenticated attackers with HTTP network access, due to a security flaw in the product's Security component. Successful exploitation can fully compromise confidentiality, integrity, and availability and, because of the scope change, may extend impact to additional connected products. This is a high-priority vulnerability; no public exploit identified at time of analysis, and the CVSS 3.1 base score is 9.9.
Low-privileged authenticated users can exploit the Federated Partitions component in Oracle Essbase 21.8.3.0.0 over HTTP to obtain broad read access to critical Essbase data, limited unauthorized insert/update/delete capability, and a partial denial of service. The critical 9.1 CVSS score is driven mainly by the scope change (S:C) and high confidentiality impact (C:H), meaning successful exploitation can also affect resources in connected products beyond Essbase itself. Attack complexity is low and no user interaction is required, but the flaw is not anonymously reachable - an attacker must already hold a valid low-privileged Essbase account (PR:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied with the source data.
Authenticated low-privileged attackers with HTTP network access to Oracle Essbase 21.8.3.0.0 can exploit a flaw in the Security component to read critical Essbase-accessible data, make limited unauthorized updates, inserts, or deletions, and cause a partial denial of service. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L), with the scope change indicating that successful exploitation can significantly affect additional connected products beyond Essbase. No public exploit identified at time of analysis; exploitation requires valid low-privileged credentials and reachability to the HTTP interface.
Critical data exposure and limited data modification in Oracle Essbase 21.8.3.0.0's Web Platform are possible for an authenticated low-privileged attacker with HTTP network access. The CVSS 3.1 score is 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), with scope change extending impact to additional products; no public exploit identified at time of analysis, and the supplied 'Authentication Bypass' tag conflicts with the vector's PR:L requirement.
Full takeover of Oracle Essbase 21.8.3.0.0 is achievable by a low-privileged, authenticated attacker reaching the Essbase Web Platform over HTTP, with Oracle's scope-change rating (S:C) warning that a compromise may significantly impact additional products beyond Essbase itself. Oracle characterizes the flaw as difficult to exploit (AC:H), so success depends on conditions outside the attacker's control rather than being reliably repeatable, and the prior-authentication requirement (PR:L) is the main limiting factor. No public exploit was identified at time of analysis, and the issue is addressed through Oracle's October 2026 Critical Patch Update.
Successful exploitation of Oracle Essbase 21.8.3.0.0 could allow a remote, unauthenticated attacker with TCP network access to take over the Essbase service, with high confidentiality, integrity, and availability impact. Oracle rates the issue difficult to exploit (CVSS 8.1, AC:H), and the specific precondition is not disclosed; no public exploit was identified at time of analysis. Realistic exposure depends heavily on whether the Essbase TCP listener is reachable from untrusted networks.
Unauthenticated remote attackers can exploit an authentication bypass in the Security component of Oracle Essbase 21.8.3.0.0 over HTTP, gaining unauthorized access to critical data and limited ability to modify it, with potential impact extending to connected Oracle products due to a scope change. The vulnerability carries a CVSS 9.3 base score; no public exploit identified at time of analysis, and no CISA KEV entry confirms active exploitation. Risk is highest for instances with internet-facing or otherwise network-reachable Essbase HTTP services, while segmented or access-restricted deployments are less exposed.
Oracle Essbase 21.8.3.0.0 exposes an HTTP-reachable Security component flaw that unauthenticated remote attackers can use to read a subset of data, modify or delete some records, and partially disrupt availability. CVSS 3.1 rates it 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), with no public exploit identified at time of analysis. The practical risk is highest where Essbase HTTP services are reachable from untrusted networks, because no authentication, user interaction, or special conditions are required.
Low-privileged authenticated users of Oracle Essbase 21.8.3.0.0 can exploit the Security component over HTTP to obtain unauthorized access to critical data, potentially extending beyond Essbase because of a scope change. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N: no user interaction is needed, but the attacker must already hold a valid low-privilege account and network access to the Essbase service. No public exploit was identified at time of analysis, and the 'Authentication Bypass' tag should not be read as allowing fully unauthenticated access given PR:L.
Oracle Essbase 21.8.3.0.0 (Security component) permits a low-privileged authenticated user to take full control of the Essbase deployment over HTTP, with high confidentiality, integrity, and availability impact and a scope change that can extend compromise to integrated products. Exploitation requires network reachability to the Essbase HTTP interface plus valid low-level credentials (CVSS PR:L, AC:L, UI:N), so anonymous attacks are not indicated - the attacker must already hold some account on the server. Our assessment rates this as a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk paper tiger; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. No CWE was published, so the precise root-cause class is not confirmed from available data.
Oracle Essbase 21.8.3.0.0 contains an easily exploitable flaw in its Security component that lets a low-privileged, network-positioned attacker take over the Essbase deployment over HTTP. The CVSS 3.1 base score is 9.9 with scope change (S:C), meaning a compromise is not contained to Essbase and can significantly affect other products sharing the deployment. Authentication requirements are confirmed from the vector as low-privileged (PR:L) with no user interaction (UI:N); no public exploit code or CISA KEV active exploitation is identified in the available data.
Oracle Essbase 21.8.3.0.0 exposes critical data to any holder of a valid low-privilege account, who can reach the Security component over HTTP and read information far beyond their intended authorization - up to all data the Essbase instance can access. The scope-change rating means the disclosure is not confined to Essbase itself and can extend into other connected Oracle products, making this an elevated-priority integrity-of-confidentiality issue rather than a CVSS-inflated one. Exploitation requires authenticated network access (CVSS PR:L, AV:N, AC:L, UI:N), so the practical barrier is obtaining or abusing a low-privilege account; no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV.
Unauthenticated network attackers can achieve full takeover of Oracle Essbase 21.8.3.0.0 by reaching the product's WebLogic T3 and/or IIOP remoting listeners, with complete confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1, C:H/I:H/A:H). The flaw sits in the Security component and is rated difficult to exploit (AC:H), meaning the attacker must satisfy conditions outside their direct control beyond simply reaching the port; no user interaction is required (PR:N/UI:N). There is no public exploit code and no confirmed active exploitation at time of analysis, but exposure is real wherever T3/IIOP is reachable from untrusted networks - the October 2026 Oracle Critical Patch Update is the only fix path identified in the available data.
Oracle Essbase 21.8.3.0.0 contains a confidentiality flaw in its Security component that lets a low-privileged, authenticated attacker reach critical data over the HTTP interface, with CVSS 3.1 scoring it 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Because the scope is changed, the exposure can extend past the Essbase instance to products wired into it, so stolen data may include far more than the attacker's own account should see. Our assessment rates this a genuine mid-tier priority rather than an emergency: the deciding constraint is that a valid low-privilege Essbase account is required, so no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation to full takeover of Oracle Communications Billing and Revenue Management (BRM) is possible on the Platform component of versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. An attacker who already holds interactive logon access to the BRM host with low-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8) can achieve high confidentiality, integrity and availability impact - Oracle describes the outcome as 'takeover' of the product - with low attack complexity and no user interaction. The attack is not remotely reachable: no path exists for an unauthenticated network attacker, so exposure depends entirely on how tightly shell/local access to BRM infrastructure is controlled; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated network attackers can read critical data and make limited unauthorized changes in Oracle Agile Product Lifecycle Management for Process 6.2.4 through the Product Quality Management component. The flaw is remotely reachable over HTTP with low attack complexity, no credentials, and no user interaction, yielding high confidentiality impact and low integrity impact; availability is not affected. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a high-priority patch item rather than a confirmed active exploitation event.
Oracle Agile Product Lifecycle Management for Process 6.2.4 exposes critical data to unauthenticated remote attackers through an HTTP-reachable Product Quality Management component, allowing high-impact confidentiality and integrity compromise with a CVSS 3.1 score of 9.1. The flaw is assessed as remotely exploitable with no privileges or user interaction, but no CISA KEV listing and no public exploit code were identified at time of analysis. No EPSS score or SSVC decision data was supplied, so exploitation probability is not quantified.
Oracle Agile Product Lifecycle Management for Process 6.2.4 exposes an unauthenticated HTTP attack surface in its Product Quality Management component that permits high-impact confidentiality and integrity compromise, with CVSS 3.1 scored at 7.4 (HIGH). Per Oracle's advisory, exploitation is rated difficult (AC:H) because success requires conditions outside the attacker's control, but no privileges (PR:N) or user interaction (UI:N) are needed once those conditions align, and there is no availability impact. No EPSS score, CISA KEV listing, or public exploit code was identified at time of analysis, so exposure is driven by whether the PLM HTTP interface is reachable from untrusted networks rather than by observed attack activity.
Oracle Agile Product Lifecycle Management for Process 6.2.4 contains a remotely reachable, unauthenticated weakness that lets an attacker who first persuades a legitimate user to open a crafted link or view attacker-controlled content gain unauthorized creation, deletion, and modification of critical PLM data alongside full read access to it, with impact potentially extending into connected products because the CVSS scope is changed (base 9.3). The attacker cannot complete the chain alone - the vector requires that second user's interaction (UI:R), and availability is unaffected (A:N) - so exposure is concentrated in internet- or intranet-reachable 6.2.4 deployments whose users can be socially engineered. No public exploit code was identified and the issue is not confirmed actively exploited (not in CISA KEV) at the time of analysis, so the 9.3 severity reflects theoretical impact rather than observed attacks.
Authenticated low-privileged attackers can achieve full takeover of Oracle REST Data Services in versions 24.2.0 through 26.2.2 by sending crafted HTTP requests to the ORDS interface, with high impact to confidentiality, integrity and availability (CVSS 8.8). Oracle rates the flaw easy to exploit - no user interaction, no race condition and no non-default configuration is required - so the practical barriers are simply any valid low-privilege ORDS account plus network reachability of the ORDS listener. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so active exploitation is not confirmed; realistic risk is concentrated in internet-exposed ORDS deployments that issue accounts broadly.
Oracle BI Publisher exposes sensitive data to unauthenticated network attackers through its Web Server component, affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Successful exploitation yields complete confidentiality impact over HTTP with no user interaction, matching a CVSS 7.5 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. No public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation and application takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4: an authenticated attacker holding only low-privileged credentials can reach the Product Quality Management component over HTTP and, if the difficult exploitation conditions are met, gain full control of the application with high confidentiality, integrity and availability impact. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and the high attack complexity points to a narrow, condition-dependent trigger rather than a straightforward request. No public exploit code or confirmed active exploitation was identified at time of analysis, and only version 6.2.4 is listed as affected in Oracle's October 2026 Critical Patch Update.
Adjacent-network attackers can achieve takeover of Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 26.01.0.0.0 through a high-complexity Platform Security flaw, with no authentication or user interaction required; CVSS 8.3 reflects high confidentiality, integrity, and availability impact plus scope change. Oracle rates exploitation as difficult and requires access to the physical or adjacent communication segment attached to the OBIEE host, not the open internet. No public exploit was identified at time of analysis.
Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 can be taken over by unauthenticated remote attackers who persuade a victim to interact with a crafted HTTP-delivered resource in the BI Platform Security component. The CVSS 3.1 score is 8.8 with high confidentiality, integrity, and availability impact, but exploitation requires human interaction (UI:R) and network reachability to the BI Publisher endpoint. No public exploit code or CISA KEV confirmation was identified at time of analysis.
Unauthenticated network attackers can access critical data and make limited unauthorized changes in Oracle Agile Product Lifecycle Management for Process 6.2.4 through the Product Quality Management component, yielding a CVSS 3.1 score of 8.2 with high confidentiality and low integrity impact. The CVSS vector indicates network reachability to the HTTP interface with no credentials, user interaction, or special configuration required, though real-world risk depends on whether the application is internet-facing or only reachable from trusted internal networks. No public exploit identified at time of analysis; this is a credible mid-to-high priority for organizations running the affected version.
Oracle Database Server's RDBMS component (versions 23.4.0 through 23.26.3) lets a low-privileged database account holding the near-universal Create Session privilege read critical data - potentially all RDBMS-accessible data - over Oracle Net, and the scope-change rating means the impact can extend to other Oracle products sharing the instance. Oracle's October 2026 Critical Patch Update is the referenced fix; no public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 7.7 score reflects a confidentiality-only impact (C:H/I:N/A:N) that requires an authenticated session (PR:L).
Oracle Database's OLAP component in versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 can be compromised by an authenticated, low-privileged database user who holds the DBMS_AW privilege and can reach the Oracle Net listener; successful exploitation can result in takeover of Oracle OLAP with high confidentiality, integrity, and availability impact (CVSS 8.8). The attack requires network access via Oracle Net but no user interaction, and the main exposure control is limiting who receives DBMS_AW and how broadly the listener is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
Takeover of Oracle BI EE 12.2.1.4.0 is possible for an authenticated, low-privileged attacker who already has local logon to the infrastructure hosting the BI Foundation component, though high attack complexity makes reliable exploitation dependent on conditions beyond the attacker's control. The issue carries CVSS 3.1 base score 7.0 with full confidentiality, integrity, and availability impact, but it is not remotely or unauthenticated exploitable. No public exploit is identified at time of analysis, so risk is concentrated on hosts where semi-trusted users hold local accounts.
Unauthenticated remote attackers can read critical data from Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 over HTTP, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, base 7.5) indicating a low-complexity, no-prerequisites confidentiality breach with no integrity or availability impact. The flaw is classified by the reporter under an authentication-bypass tag, meaning access controls on a WebCenter Sites interface can be sidestepped rather than brute-forced, exposing all data the application can reach. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV, so there is no confirmed active exploitation, though the combination of unauthenticated network reachability and high confidentiality impact makes this a genuine priority for internet-facing deployments rather than an inflated score.
Authenticated takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4: a low-privileged attacker with HTTP network access to the Product Quality Management component can compromise confidentiality, integrity, and availability at high impact (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The PR:L authentication prerequisite is the main limiting factor - an attacker must already hold or obtain a valid low-privileged account, so this is not anonymous exploitation, but once inside no user interaction or special configuration is required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); the intelligence signals are sparse, resting on a single Oracle CPU reference with no CWE mapping or CPE data.
Takeover of Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 12.2.1.4.0 is possible when an attacker who already holds a local OS-level logon on the Analytics Server host can get a different user to open or process attacker-supplied content. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no OBIEE application credentials are needed, but host access and user interaction are hard prerequisites. No public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated attackers with network reach to Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can potentially achieve full takeover of the platform through the BI Foundation component over HTTP, with high impact across confidentiality, integrity and availability (CVSS 3.1 base 8.1). The high attack complexity reflects Oracle's own 'difficult to exploit' classification, meaning success hinges on timing, state or environmental preconditions outside the attacker's direct control rather than a single reliable request. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so practical risk is gated primarily by whether the BI HTTP interface is exposed to untrusted networks.
Oracle BI EE 8.2.0.0.0 and 12.2.1.4.0 can be taken over through a low-complexity Platform Security flaw that an unauthenticated attacker triggers after obtaining interactive logon access to the host and persuading another user to perform an action. The local attack path (AV:L) and user-interaction requirement (UI:R) keep it from being remotely wormable against default internet-facing deployments, despite high confidentiality, integrity, and availability impact and a 7.8 CVSS score. No public exploit was identified at time of analysis, and CISA KEV does not list this CVE.
Unauthenticated HTTP requests to Oracle WebCenter Sites can disclose critical content and site data in versions 12.2.1.4.0 and 14.1.2.0.0 because of an authentication bypass, rated CVSS 7.5 with confidentiality-only impact. Exploitation requires only network reachability to the WebCenter Sites interface - no credentials or user interaction - but the flaw does not permit data modification or service disruption. No public exploit code and no CISA KEV entry were identified at time of analysis.
Takeover of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can be achieved by a low-privileged attacker with an existing interactive logon on the OBIEE host, through the Presentation Services component. The local CVSS 3.1 vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact, but the need for local access and valid low-privilege credentials keeps this a genuine, not emergency-grade, priority. No public exploit was identified at time of analysis, and no KEV confirmation is present in the provided data.
Local privilege escalation in Oracle Solaris 11.4 can let a low-privileged attacker with an existing logon compromise the host, with high confidentiality, integrity, and availability impact. The flaw is in the Utility component and has a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit has been identified at time of analysis. Exposure is limited to systems where untrusted users can obtain local interactive access.
Authenticated low-privilege users can achieve takeover of Oracle Business Intelligence Enterprise Edition through its BI Search component, with high confidentiality, integrity, and availability impact. Affected deployments include versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0; exploitation requires network access over HTTP and a valid low-privileged account but no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, though low attack complexity makes prompt patching important.
Unauthenticated HTTP requests to the Analytics Web General component of Oracle Business Intelligence Enterprise Edition can drive the service into a hang or repeatable crash, giving a complete denial of service while also permitting limited reads and limited inserts/updates/deletes against a subset of BI EE data. The flaw is rated CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) and affects releases 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0; Oracle characterizes it as easily exploitable by a remote attacker with network access and no credentials. There is no CISA KEV listing and no public exploit identified at time of analysis, so prioritization should be driven by internet or broad-network exposure of the analytics web tier rather than by observed attack activity.
Authenticated low-privileged attackers can take over Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP, with high confidentiality, integrity, and availability impact. The flaw is network-reachable, requires no user interaction, and has low attack complexity, but it is not unauthenticated: an attacker must already hold a valid low-privileged account on the EBS instance. No public exploit was identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; the main barrier to mass exploitation is the authentication prerequisite.
Oracle ZFS Storage Appliance Kit 8.8 can be taken over by a low-privileged, authenticated attacker who can reach the appliance's HTTP management interface, with full confidentiality, integrity, and availability impact. Exploitation is network-reachable, low complexity, and requires no user interaction, but valid low-privilege credentials are required; no public exploit was identified at time of analysis. The authentication prerequisite and the appliance's typical placement on internal management networks are the main practical constraints.
Authenticated low-privileged attackers can achieve full takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 by sending crafted HTTP requests to the Product Quality Management component. The flaw is network-exploitable, requires no user interaction, and yields complete compromise of confidentiality, integrity, and availability (CVSS 8.8). No public exploit code has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.
Authenticated low-privileged users can take over Oracle Agile Product Lifecycle Management for Process 6.2.4 through the Product Quality Management component, achieving full confidentiality, integrity, and availability compromise (CVSS 8.8). Oracle describes the flaw as easily exploitable and requiring no user interaction, so a valid low-tier account or compromised low-privileged credentials is the main prerequisite. No public exploit code or confirmed active exploitation was identified at time of analysis.
Adjacent-network attackers can achieve takeover of Oracle Management Pack for Oracle GoldenGate (EM Plugin) versions 13.4.1.0.1 through 13.5.2.0.6, with high confidentiality, integrity, and availability impact, provided they can reach the communication segment attached to the host and a legitimate operator performs a required interaction. No authentication is required and attack complexity is low, but the AV:A and UI:R requirements sharply limit exposure compared with an internet-reachable flaw. The supplied intelligence contains no public exploit code and no CISA KEV entry, so there is no public exploit identified at time of analysis.
Full application takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible through its Product Quality Management component, with high confidentiality, integrity, and availability impact. The attack path requires network access to the HTTP interface and valid low-privileged credentials, and Oracle rates exploitation as difficult (AC:H), so risk is concentrated in exposed, access-controlled deployments where an attacker already has a foothold. No public exploit was identified at time of analysis; this is a genuine but second-tier priority rather than an emergency patch item.
Oracle Agile Product Lifecycle Management for Process 6.2.4 can be taken over through its Product Quality Management component by an attacker holding high-privilege credentials and network HTTP access. The CVSS 7.2 rating reflects high confidentiality, integrity, and availability impact, but the PR:H prerequisite confines practical exposure to malicious insiders or attackers who have already compromised a privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update.
Unauthorized read of critical Oracle Purchasing data, plus limited insert/update/delete capability, is achievable by a low-privileged authenticated user of Oracle E-Business Suite 12.2.3 through 12.2.15 who can reach the Internal Operations component over HTTP and satisfy non-trivial preconditions (high attack complexity). Scope is changed, so a successful attack can ripple into other Oracle products sharing the EBS deployment rather than staying confined to Purchasing. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, which keeps it a moderate-priority patching item worked through the normal Critical Patch Update cycle rather than an emergency.
Compromise of Oracle EBS Workflow 12.2.3 through 12.2.15 is possible for unauthenticated network attackers via HTTP, with successful exploitation yielding high confidentiality, integrity, and availability impact and takeover of the Workflow component. The flaw is rated CVSS 8.1 but is difficult to exploit (AC:H), meaning success depends on a server condition or timing window the attacker cannot fully control. No public exploit code or CISA KEV active-exploitation signal is present at time of analysis, so exposure is primarily a function of whether Workflow Notification Mailer HTTP endpoints are reachable from untrusted networks.
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible for authenticated low-privileged attackers with network access via HTTP, according to Oracle's October 2026 Critical Patch Update. The Content Portal Suite component flaw is rated CVSS 7.5 with high attack complexity and no user interaction, giving high confidentiality, integrity, and availability impact; it is serious but not top-tier urgent. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Oracle Database Server in versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 lets an authenticated low-privileged user who holds the Create Table privilege subvert the Virtual Private Database (VPD) row-level security feature over Oracle Net, gaining unauthorized read, creation, modification, and deletion access to data those VPD policies are supposed to protect. Successful exploitation yields high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no user interaction required; the attacker must already have a valid database account and network reachability to the database listener. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the source data, so the practical risk is concentrated in environments where low-privilege accounts are routinely granted Create Table.
Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contains a Core component flaw that unauthenticated network attackers can reach through the TLS listener, allowing limited read, update/insert/delete, and partial denial-of-service impact (CVSS 7.3). Oracle describes the issue as easily exploitable with no user interaction; exposure is greatest for internet-facing or broadly reachable WebLogic instances, while segmented admin/TLS interfaces materially reduce risk. No public exploit identified at time of analysis.
Privilege escalation in Oracle Database 23ai (versions 23.4.0 through 23.26.3) allows a low-privileged database account holding the DBMS_VECTOR privilege to take over the RDBMS over Oracle Net, with full confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.8). The attack is network-reachable and requires no user interaction, but is gated by the DBMS_VECTOR grant that ships with the Oracle AI Vector Search feature, so environments that do not use vector search or that tightly control this privilege are not exposed to arbitrary low-privileged users. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; Oracle disclosed it in its October 2026 Critical Patch Update.
Authenticated low-privileged users can take over Oracle E-Business Suite Workflow (versions 12.2.3 through 12.2.15) by attacking the Workflow Notification Mailer component over HTTP, with high impact across confidentiality, integrity, and availability (CVSS 3.1 base score 7.5). Oracle rates the flaw difficult to exploit, and the CVSS vector's high attack complexity (AC:H) indicates a specific server state or precondition must be met rather than a simple request being sufficient, although no user interaction is required. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Oracle addresses the issue in its October 2026 Critical Patch Update. This is a moderate-priority item for EBS estates that expose the notification mailer, not an emergency unauthenticated remote compromise.
Remote, unauthenticated takeover of Oracle WebCenter Content is possible through the Content Server component over HTTP, with CVSS 3.1 score 9.8 affecting versions 12.2.1.4.0 and 14.1.2.0.0. The attack requires only network reachability to the Content Server endpoint and no credentials or user interaction, yielding high confidentiality, integrity and availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, but the exposure is serious for internet-facing instances and should be prioritized.
Unauthenticated network attackers can potentially read and modify critical data handled by Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 through the LDAP Gateway component, with no user interaction required. Oracle rates the flaw as 'difficult to exploit' (CVSS 7.4, AC:H), meaning the attacker must satisfy preconditions outside their direct control before a reliable attack is possible; confidentiality and integrity of all connector-accessible data are both fully impacted, while availability is unaffected. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a genuine but second-tier priority that should be remediated in the normal Critical Patch Update cycle.
Unauthenticated LDAP requests to the LDAP Gateway in Oracle IDM Connector 12.2.1.4.0 and 14.1.2.1.0 can expose critical connector-accessible data, giving remote attackers a confidentiality-only read primitive rated CVSS 7.5. The flaw is network-reachable and requires no credentials or user interaction, but exploitation depends on the gateway being deployed and accessible over LDAP. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is bounded by network exposure rather than by confirmed active exploitation.
Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0, specifically the SAP ERP+ component, exposes an unauthenticated HTTP attack surface that can lead to authentication bypass and unauthorized creation, deletion, modification, or access of critical connector data, with scope change potentially affecting connected systems. The issue is serious but constrained: exploitation is difficult (AC:H) and requires reachable HTTP access to a deployment that actually uses the SAP ERP+ connector. No public exploit identified at time of analysis, and no CISA KEV confirmation was supplied.
Unauthenticated network access to the LDAP Gateway in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can result in full compromise of the connector, with high confidentiality, integrity, and availability impact (CVSS 9.8). The vector is AV:N/AC:L/PR:N/UI:N, so reachability of the LDAP service is the main prerequisite; deployments that expose it only to trusted networks materially reduce exposure. No CISA KEV status is supplied and no public exploit identified at time of analysis, but the severity and ease of exploitation warrant urgent patching or network restriction.
Unauthenticated network attackers can read and modify critical data through the LDAP Gateway component of Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0, which permits LDAP operations without enforcing authentication. With a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H), exploitation requires only reachability to the exposed LDAP listener and no user interaction. Oracle's October 2026 Critical Patch Update references the fix; no public exploit code or confirmed active exploitation was identified at time of analysis, so risk is concentrated in environments where the LDAP Gateway is network-accessible.
Oracle Identity Manager Connector (LDAP Gateway component) in versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged user who already has interactive logon to the connector host to read, create, delete, or modify all data reachable through the LDAP Gateway, per Oracle's October 2026 Critical Patch Update. The 7.1 score reflects high confidentiality and integrity impact with no availability impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), so exploitation is straightforward but strictly gated behind existing local access and low-level privileges, making this a bounded insider or post-compromise risk rather than a remote threat. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Oracle IDM Connector 12.2.1.4.0 and 14.1.2.1.0 contains a locally exploitable flaw in its Generic REST component that lets an attacker with an existing low-privileged logon on the connector host read, create, delete, or modify critical connector-accessible data (CVSS 3.1 base 7.1; C:H/I:H). The vector is AV:L/PR:L/UI:N, so exploitation is not remote or unauthenticated; the 'Authentication Bypass' tag is inconsistent with the PR:L requirement and should be verified against Oracle's advisory. No public exploit code or CISA KEV entry was identified at time of analysis.
Java sandbox boundary flaw in Oracle Java SE 8u503 and 8u503-perf client deployments can let a low-privileged local attacker obtain high confidentiality and integrity impact, with scope change to additional products, but only in legacy sandboxed Java Web Start or applet scenarios that execute untrusted code. The 7.5 HIGH score is tempered by the local attack vector, high attack complexity, and required low-privileged logon; server deployments running only trusted administrator-installed code are explicitly out of scope. No public exploit identified at time of analysis, and exploitation is not confirmed in CISA KEV.
Local processing of attacker-supplied files by Oracle Outside In Technology 8.5.8 can lead to full compromise of the affected parsing instance, with high confidentiality, integrity, and availability impact. The flaw is rated CVSS 7.8 and requires local access plus a victim action to open or convert a crafted document, so only deployments that feed untrusted content into OIT are realistically exposed; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated low-privilege users of Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 can achieve full takeover of the Strategic Sourcing component over HTTP, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). Exploitation requires only network reachability to the application tier and a valid low-privilege PeopleSoft account - no user interaction and no elevated privileges - so any provisioned user who can reach the Strategic Sourcing interface could attempt it. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vulnerability is addressed in Oracle's October 2026 Critical Patch Update advisory, and risk is concentrated in internet-exposed or broadly provisioned instances.
Local takeover of Oracle HTTP Server 12.2.1.4.0 is achievable by an authenticated low-privileged user who can log on to the host running the Web Listener, yielding high confidentiality, integrity and availability impact (CVSS 7.8). The AV:L/PR:L/UI:N vector confines realistic exploitation to insiders or attackers who already hold a foothold on the server, and only version 12.2.1.4.0 is listed as affected; no public exploit code exists and there is no CISA KEV entry, so the status is no public exploit identified at time of analysis.
Unauthenticated data disclosure in PeopleSoft FIN Common Objects Argentina 9.1 allows network attackers using Oracle Net to read critical or complete application data. The Integration component flaw requires only network reachability to the Oracle Net endpoint, with no credentials or user interaction, and its impact is limited to confidentiality. No public exploit code or CISA KEV entry was identified at time of analysis, and exposure is sharply reduced where Oracle Net is restricted to trusted internal segments.
Local file-processing exploitation in Oracle Outside In Technology 8.5.8 (Outside In Image Export SDK) can let an attacker who can log on to the host take over the component when a crafted file is opened or processed by another user or automated workflow. The CVSS 3.1 score is 7.8 with high confidentiality, integrity, and availability impact; the vector is local (AV:L), requires user interaction (UI:R), and does not require privileges for the vulnerable component itself (PR:N). No public exploit was identified at time of analysis, and the provided data does not indicate CISA KEV status.
Full compromise of Oracle Outside In Technology 8.5.8's Image Export SDK requires local logon access plus a victim opening a malicious file, yielding high confidentiality, integrity, and availability impact at CVSS 7.8. The CVSS vector is AV:L/AC:L/PR:N/UI:R, so the attacker needs logon to the host where Outside In runs, needs no privileges, and must convince another person to open or process a crafted file. No CISA KEV entry or public exploit code was identified at time of analysis.
Opening a crafted document through Oracle Outside In Technology 8.5.8 can let an unauthenticated local attacker seize control of the affected runtime, with high impact across confidentiality, integrity and availability (CVSS 3.1 score 7.8). Because the flaw sits in the Outside In Core parsing component, the practical attack path is delivery of a malicious file that a victim then opens or processes on the host - the attacker cannot trigger it remotely and must rely on user interaction. Only version 8.5.8 is listed as affected; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vulnerability is addressed in Oracle's October 2026 Critical Patch Update.
Local file-processing flaws in the Outside In Image Export SDK shipped with Oracle Outside In Technology 8.5.8 let an attacker who can log on to the host achieve full takeover of the affected SDK process by convincing another user or service to open a crafted file. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms this is a local, unauthenticated attack that requires victim interaction rather than something reachable over the network, and only the Image Export SDK component of the 8.5.8 release is in scope. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a moderate-priority issue that is chiefly dangerous where the SDK is exposed to untrusted documents on shared or multi-tenant conversion hosts.
Unauthenticated, remote attackers can read and modify critical data in the Server Infrastructure component of Oracle Siebel CRM Deployment across supported versions 17.0 through 26.9, with a CVSS 3.1 base score of 7.4 (High) driven entirely by high confidentiality and integrity impact. Oracle rates the flaw as 'difficult to exploit' (AC:H), meaning success depends on conditions outside the attacker's control - server state, timing, or an unspecified precondition - which tempers the headline score and argues for a lower real-world priority than the 7.4 suggests; no public exploit code and no KEV listing were identified at time of analysis. Authentication and user interaction are not required (PR:N, UI:N), and the advisory metadata tags the issue as an authentication bypass, so exposure should be scoped by network reachability to the deployment server rather than by credential controls. The fix is delivered through Oracle's October 2026 Critical Patch Update.
Unauthenticated remote attackers who can reach the Siebel HTTP interface can read, create, delete, or modify critical data held in Oracle Siebel CRM Deployment versions 17.0 through 26.9, although Oracle rates the issue as difficult to exploit (AC:H), meaning successful abuse depends on conditions outside the attacker's direct control such as specific server configuration, state, or timing rather than a single deterministic request against a default install. Confidentiality and integrity of Deployment-accessible data are both fully compromised, while availability is unaffected and no scope change to other systems occurs. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a genuine but second-tier priority to be scheduled alongside the October 2026 Oracle Critical Patch Update rather than treated as an emergency.
Unauthenticated remote attackers can read critical data from Oracle Siebel CRM Deployment (Server Infrastructure component) in supported versions 17.0 through 26.9 via HTTP, with low attack complexity and no user interaction, yielding a CVSS 3.1 score of 7.5 (High) and confidentiality-only impact. No public exploit identified at time of analysis, and no CISA KEV active exploitation is reported. Remediate by applying Oracle's October 2026 Critical Patch Update referenced in the vendor advisory.
Unauthenticated remote attackers can read critical data from Oracle Siebel CRM Deployment (Server Infrastructure component) in supported versions 17.0 through 26.9 by sending HTTP requests, due to an authentication bypass flaw (CVSS 3.1 base score 7.5). The vulnerability is network-reachable with low complexity and no user interaction, but impacts only confidentiality (C:H/I:N/A:N), so it enables data disclosure rather than data modification, denial of service, or code execution. No public exploit code or active exploitation (CISA KEV) was identified at time of analysis; exposure is limited to deployments whose Siebel HTTP endpoint is reachable from the attacker's network position.
Unauthenticated network attackers can access critical data and perform limited data modification in Oracle Siebel CRM End User versions 17.0 through 26.9 via the Communications Panel/Dashboard component. The vulnerability is easily exploitable (CVSS 8.2, AV:N/AC:L/PR:N/UI:N) and requires only HTTP reachability to the Siebel web tier. No public exploit code or active exploitation has been identified at time of analysis, but internet- or intranet-exposed deployments should prioritize patching.
Authenticated low-privileged users can achieve takeover of Oracle Siebel CRM Deployment (Server Infrastructure) in versions 17.0 through 26.9 through the HTTP interface, with high impact to confidentiality, integrity, and availability (CVSS 8.8). The requirement for a valid low-tier CRM session is the main barrier, but no user interaction or special attack complexity is indicated; no public exploit was identified at time of analysis.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 allow a low-privileged authenticated user with HTTP network access to read critical data and partially modify records they should not be able to touch, yielding a CVSS 3.1 score of 7.1 (C:H/I:L/A:N). The weakness is an authorization/access-control failure rather than an authentication bypass, so exploitation requires the attacker to already hold a valid low-privileged account; no user interaction is needed and attack complexity is low. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, so exposure is bounded by the number of provisioned accounts and whether the Siebel HTTP interface is reachable from untrusted networks.
High-privileged attackers who can reach Oracle Siebel CRM's Deployment Server Infrastructure over HTTP can create, delete, or modify critical data and read all data accessible through that component, with the scope change (S:C) meaning successful exploitation can also affect other connected Oracle products beyond Siebel CRM. Supported releases 17.0 through 26.9 are affected; Oracle rates the flaw CVSS 3.1 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), with confidentiality and integrity fully compromised but no availability impact. The pre-existing administrative privilege requirement (PR:H) is the principal limiting factor, making malicious insiders or already-compromised admin accounts the realistic threat actors; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Oracle Siebel CRM Field Service (Smart Answer) versions 17.0 through 26.9 can be fully taken over by an authenticated, high-privileged attacker with HTTP access, with high confidentiality, integrity, and availability impact (CVSS 7.2). The vector requires existing high privileges (PR:H) and low complexity with no user interaction, so real-world exposure is concentrated in insider or post-compromise escalation scenarios rather than unauthenticated attacks. No CISA KEV confirmation and no public exploit identified at time of analysis.
Authorization bypass in the Rucio `/credentials/signurl` REST endpoint lets any holder of a valid auth token obtain presigned read, write or delete URLs for arbitrary objects in cloud-backed storage. The endpoint performs its root-only permission check against the client-supplied `X-Rucio-Account` header rather than the token-authenticated identity, so a low-privilege user can simply send `X-Rucio-Account: root` and have the server sign a URL with the RSE's stored S3/GCS/Swift credentials. Exploitation requires an authenticated account (CVSS PR:L) and a cloud-backed RSE, with no user interaction; the advisory documents a proof-of-concept request, and no active exploitation is confirmed (not in CISA KEV).
Use of a hard-coded cryptographic key in Johnson Controls Kantech EntraPass before 9.20 enables a padding oracle crypto attack. Exploitation requires local access and low-level privileges (AV:L/PR:L per the vendor CVSS 4.0 vector), so the attacker must already have authenticated or local foothold on the EntraPass system rather than operating as a remote unauthenticated adversary; impact is high across confidentiality, integrity and availability of the affected system. No CISA KEV entry, public exploit code, or EPSS score was provided, and the product's fixed 9.20 release resolves the condition.
Remote unauthenticated compromise of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition is possible through the JSSE component when attacker-influenced data reaches the affected APIs. The listed affected builds include Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, and 27.0.1.0.2, plus GraalVM for JDK 17.0.21.0.2/21.0.13.0.2 and GraalVM Enterprise Edition 21.3.20.0.2. Per the assessed CVSS vector AV:N/AC:L/PR:N/UI:N, exploitation is remote, unauthenticated, and requires no user interaction on the API path, with high confidentiality and integrity impact and no availability impact; no CISA KEV entry, public exploit code, or EPSS score was supplied, and the vuln.today decision label is act_now.
Any authenticated control panel user in Craft CMS - regardless of privilege level - can escape the Twig sandbox through an element-search condition and use a boolean oracle to recover the site's GeneralConfig::securityKey character by character, then forge Craft's HMAC-signed parameters offline and reach unsandboxed View::renderObjectTemplate(), where Twig string-callable syntax invokes native PHP callables as the web server user. Default installations in the ranges 4.0.0 to before 4.18.9 and 5.0.0 to before 5.11.2 are affected; no non-default configuration is required and no user interaction is involved. The vendor-released fix is 4.18.9 (4.x) and 5.11.2 (5.x); exploitation is not confirmed in the wild and no EPSS or KEV signal was supplied, though the advisory documents a regression proof that invokes a harmless substr() callback rather than an OS command. The vulnerability is a genuine high-priority issue rather than a CVSS-inflated one, though the authentication prerequisite tempers it.
The RISC-V futex implementation in the Linux kernel fails to strip address tags from user-supplied pointers before executing atomic operations, allowing a local unprivileged process to make FUTEX_WAKE_OP write to an arbitrary kernel address. Affected systems must run RISC-V with CONFIG_RISCV_ISA_SUPM, have the tagged-address ABI enabled via PR_SET_TAGGED_ADDR_CTRL with a non-zero PMLEN, and use Sv57 paging with PMLEN=16 so that tag bits overlap canonical kernel address bits - on such configurations the flaw yields both kernel memory corruption and, through the FUTEX_OP_CMP_* result, a read oracle that discloses kernel memory. The vendor has published fixes in Linux 6.18.57, 7.2.11 and 7.3 (commits 8e48d8d51ab37b7decfbff3e2844e027a52ad6ea, 405290be962b32eec842776fbe3bdf81f15b1676 and 2e5c80bbc062a8dda33e687ebf7be8f074ee4f7d); no public exploit has been identified at time of analysis and EPSS is low at 0.21% (10th percentile), reflecting the narrow hardware/configuration prerequisites rather than the severity of the outcome.
Unauthenticated remote attackers can read and tamper with critical data handled by Oracle Java SE through its JSSE (Java Secure Socket Extension) component, rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N). Affected builds are Java SE 8u511 and 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, plus Oracle GraalVM for JDK 17.0.21 and 21.0.13 and GraalVM Enterprise Edition 21.3.20. Oracle's alert states the flaw is reachable via APIs of the affected component, such as a web service feeding untrusted data into JSSE, and adds a secondary sandbox-escape path for deployments running untrusted code in Java Web Start applications or applets; no public exploit code or active exploitation was identified at time of analysis, but the missing authentication prerequisite and network reachability make this a high-priority patch target rather than a paper finding.
Low-privileged authenticated attackers can achieve full takeover of Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 by sending SQL against the Dictionary Repository component over the network. Exploitation requires a valid low-privilege ODI account but no user interaction and only low attack complexity, with high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and no CISA KEV status was supplied.
Remote unauthenticated takeover of Oracle Essbase 21.8.3.0.0 is possible through the TCP-exposed Security component, with CVSS 3.1 scoring 9.8 and high confidentiality, integrity, and availability impact. Exploitation needs only network reachability to the affected service, no credentials, and no user interaction, so internet-facing or broadly reachable Essbase deployments carry the greatest risk. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Oracle Essbase 21.8.3.0.0 can be hung or repeatedly crashed by unauthenticated remote attackers who can reach the Security component over TCP, producing a complete denial of service with no confidentiality or integrity impact. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), so no credentials or user interaction are required according to the supplied assessment. No public exploit identified at time of analysis, and no CISA KEV entry is present; exposure is highest for internet-reachable or broadly accessible Essbase deployments.
Authenticated low-privileged attackers with network access to Oracle Essbase 21.8.3.0.0's T3/IIOP listeners can achieve full takeover of the Essbase instance, with scope change allowing significant impact on additional products. The vulnerability carries a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is considered high priority; no public exploit identified at time of analysis, and no CISA KEV confirmation was provided. Exploitation is gated by reachability to the T3/IIOP management protocols and possession of a low-privileged account.
Low-privileged authenticated users of Oracle Essbase 21.8.3.0.0 can reach beyond their assigned privilege boundary through the Security component over HTTP and read critical data they should not be able to see, including data exposed in downstream products because the vulnerability crosses a security scope boundary. Oracle scores this 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N): confidentiality-only, with no integrity or availability impact, and exploitation requires a valid low-privileged account rather than being unauthenticated. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in internet- or network-reachable Essbase deployments where low-level credentials are broadly distributed.
Oracle Essbase 21.8.3.0.0 exposes critical data through its Build component to an authenticated low-privileged attacker with HTTP network access. The flaw is easily exploitable (AC:L, no user interaction), can cross a scope boundary to affect additional products, and has a high confidentiality impact with no integrity or availability effect. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a mid-tier priority rather than an emergency.
Remote takeover of Oracle Essbase 21.8.3.0.0 is possible for low-privileged authenticated attackers with HTTP network access, due to a security flaw in the product's Security component. Successful exploitation can fully compromise confidentiality, integrity, and availability and, because of the scope change, may extend impact to additional connected products. This is a high-priority vulnerability; no public exploit identified at time of analysis, and the CVSS 3.1 base score is 9.9.
Low-privileged authenticated users can exploit the Federated Partitions component in Oracle Essbase 21.8.3.0.0 over HTTP to obtain broad read access to critical Essbase data, limited unauthorized insert/update/delete capability, and a partial denial of service. The critical 9.1 CVSS score is driven mainly by the scope change (S:C) and high confidentiality impact (C:H), meaning successful exploitation can also affect resources in connected products beyond Essbase itself. Attack complexity is low and no user interaction is required, but the flaw is not anonymously reachable - an attacker must already hold a valid low-privileged Essbase account (PR:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied with the source data.
Authenticated low-privileged attackers with HTTP network access to Oracle Essbase 21.8.3.0.0 can exploit a flaw in the Security component to read critical Essbase-accessible data, make limited unauthorized updates, inserts, or deletions, and cause a partial denial of service. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L), with the scope change indicating that successful exploitation can significantly affect additional connected products beyond Essbase. No public exploit identified at time of analysis; exploitation requires valid low-privileged credentials and reachability to the HTTP interface.
Critical data exposure and limited data modification in Oracle Essbase 21.8.3.0.0's Web Platform are possible for an authenticated low-privileged attacker with HTTP network access. The CVSS 3.1 score is 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), with scope change extending impact to additional products; no public exploit identified at time of analysis, and the supplied 'Authentication Bypass' tag conflicts with the vector's PR:L requirement.
Full takeover of Oracle Essbase 21.8.3.0.0 is achievable by a low-privileged, authenticated attacker reaching the Essbase Web Platform over HTTP, with Oracle's scope-change rating (S:C) warning that a compromise may significantly impact additional products beyond Essbase itself. Oracle characterizes the flaw as difficult to exploit (AC:H), so success depends on conditions outside the attacker's control rather than being reliably repeatable, and the prior-authentication requirement (PR:L) is the main limiting factor. No public exploit was identified at time of analysis, and the issue is addressed through Oracle's October 2026 Critical Patch Update.
Successful exploitation of Oracle Essbase 21.8.3.0.0 could allow a remote, unauthenticated attacker with TCP network access to take over the Essbase service, with high confidentiality, integrity, and availability impact. Oracle rates the issue difficult to exploit (CVSS 8.1, AC:H), and the specific precondition is not disclosed; no public exploit was identified at time of analysis. Realistic exposure depends heavily on whether the Essbase TCP listener is reachable from untrusted networks.
Unauthenticated remote attackers can exploit an authentication bypass in the Security component of Oracle Essbase 21.8.3.0.0 over HTTP, gaining unauthorized access to critical data and limited ability to modify it, with potential impact extending to connected Oracle products due to a scope change. The vulnerability carries a CVSS 9.3 base score; no public exploit identified at time of analysis, and no CISA KEV entry confirms active exploitation. Risk is highest for instances with internet-facing or otherwise network-reachable Essbase HTTP services, while segmented or access-restricted deployments are less exposed.
Oracle Essbase 21.8.3.0.0 exposes an HTTP-reachable Security component flaw that unauthenticated remote attackers can use to read a subset of data, modify or delete some records, and partially disrupt availability. CVSS 3.1 rates it 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), with no public exploit identified at time of analysis. The practical risk is highest where Essbase HTTP services are reachable from untrusted networks, because no authentication, user interaction, or special conditions are required.
Low-privileged authenticated users of Oracle Essbase 21.8.3.0.0 can exploit the Security component over HTTP to obtain unauthorized access to critical data, potentially extending beyond Essbase because of a scope change. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N: no user interaction is needed, but the attacker must already hold a valid low-privilege account and network access to the Essbase service. No public exploit was identified at time of analysis, and the 'Authentication Bypass' tag should not be read as allowing fully unauthenticated access given PR:L.
Oracle Essbase 21.8.3.0.0 (Security component) permits a low-privileged authenticated user to take full control of the Essbase deployment over HTTP, with high confidentiality, integrity, and availability impact and a scope change that can extend compromise to integrated products. Exploitation requires network reachability to the Essbase HTTP interface plus valid low-level credentials (CVSS PR:L, AC:L, UI:N), so anonymous attacks are not indicated - the attacker must already hold some account on the server. Our assessment rates this as a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk paper tiger; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. No CWE was published, so the precise root-cause class is not confirmed from available data.
Oracle Essbase 21.8.3.0.0 contains an easily exploitable flaw in its Security component that lets a low-privileged, network-positioned attacker take over the Essbase deployment over HTTP. The CVSS 3.1 base score is 9.9 with scope change (S:C), meaning a compromise is not contained to Essbase and can significantly affect other products sharing the deployment. Authentication requirements are confirmed from the vector as low-privileged (PR:L) with no user interaction (UI:N); no public exploit code or CISA KEV active exploitation is identified in the available data.
Oracle Essbase 21.8.3.0.0 exposes critical data to any holder of a valid low-privilege account, who can reach the Security component over HTTP and read information far beyond their intended authorization - up to all data the Essbase instance can access. The scope-change rating means the disclosure is not confined to Essbase itself and can extend into other connected Oracle products, making this an elevated-priority integrity-of-confidentiality issue rather than a CVSS-inflated one. Exploitation requires authenticated network access (CVSS PR:L, AV:N, AC:L, UI:N), so the practical barrier is obtaining or abusing a low-privilege account; no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV.
Unauthenticated network attackers can achieve full takeover of Oracle Essbase 21.8.3.0.0 by reaching the product's WebLogic T3 and/or IIOP remoting listeners, with complete confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1, C:H/I:H/A:H). The flaw sits in the Security component and is rated difficult to exploit (AC:H), meaning the attacker must satisfy conditions outside their direct control beyond simply reaching the port; no user interaction is required (PR:N/UI:N). There is no public exploit code and no confirmed active exploitation at time of analysis, but exposure is real wherever T3/IIOP is reachable from untrusted networks - the October 2026 Oracle Critical Patch Update is the only fix path identified in the available data.
Oracle Essbase 21.8.3.0.0 contains a confidentiality flaw in its Security component that lets a low-privileged, authenticated attacker reach critical data over the HTTP interface, with CVSS 3.1 scoring it 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Because the scope is changed, the exposure can extend past the Essbase instance to products wired into it, so stolen data may include far more than the attacker's own account should see. Our assessment rates this a genuine mid-tier priority rather than an emergency: the deciding constraint is that a valid low-privilege Essbase account is required, so no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation to full takeover of Oracle Communications Billing and Revenue Management (BRM) is possible on the Platform component of versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. An attacker who already holds interactive logon access to the BRM host with low-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8) can achieve high confidentiality, integrity and availability impact - Oracle describes the outcome as 'takeover' of the product - with low attack complexity and no user interaction. The attack is not remotely reachable: no path exists for an unauthenticated network attacker, so exposure depends entirely on how tightly shell/local access to BRM infrastructure is controlled; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated network attackers can read critical data and make limited unauthorized changes in Oracle Agile Product Lifecycle Management for Process 6.2.4 through the Product Quality Management component. The flaw is remotely reachable over HTTP with low attack complexity, no credentials, and no user interaction, yielding high confidentiality impact and low integrity impact; availability is not affected. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a high-priority patch item rather than a confirmed active exploitation event.
Oracle Agile Product Lifecycle Management for Process 6.2.4 exposes critical data to unauthenticated remote attackers through an HTTP-reachable Product Quality Management component, allowing high-impact confidentiality and integrity compromise with a CVSS 3.1 score of 9.1. The flaw is assessed as remotely exploitable with no privileges or user interaction, but no CISA KEV listing and no public exploit code were identified at time of analysis. No EPSS score or SSVC decision data was supplied, so exploitation probability is not quantified.
Oracle Agile Product Lifecycle Management for Process 6.2.4 exposes an unauthenticated HTTP attack surface in its Product Quality Management component that permits high-impact confidentiality and integrity compromise, with CVSS 3.1 scored at 7.4 (HIGH). Per Oracle's advisory, exploitation is rated difficult (AC:H) because success requires conditions outside the attacker's control, but no privileges (PR:N) or user interaction (UI:N) are needed once those conditions align, and there is no availability impact. No EPSS score, CISA KEV listing, or public exploit code was identified at time of analysis, so exposure is driven by whether the PLM HTTP interface is reachable from untrusted networks rather than by observed attack activity.
Oracle Agile Product Lifecycle Management for Process 6.2.4 contains a remotely reachable, unauthenticated weakness that lets an attacker who first persuades a legitimate user to open a crafted link or view attacker-controlled content gain unauthorized creation, deletion, and modification of critical PLM data alongside full read access to it, with impact potentially extending into connected products because the CVSS scope is changed (base 9.3). The attacker cannot complete the chain alone - the vector requires that second user's interaction (UI:R), and availability is unaffected (A:N) - so exposure is concentrated in internet- or intranet-reachable 6.2.4 deployments whose users can be socially engineered. No public exploit code was identified and the issue is not confirmed actively exploited (not in CISA KEV) at the time of analysis, so the 9.3 severity reflects theoretical impact rather than observed attacks.
Authenticated low-privileged attackers can achieve full takeover of Oracle REST Data Services in versions 24.2.0 through 26.2.2 by sending crafted HTTP requests to the ORDS interface, with high impact to confidentiality, integrity and availability (CVSS 8.8). Oracle rates the flaw easy to exploit - no user interaction, no race condition and no non-default configuration is required - so the practical barriers are simply any valid low-privilege ORDS account plus network reachability of the ORDS listener. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so active exploitation is not confirmed; realistic risk is concentrated in internet-exposed ORDS deployments that issue accounts broadly.
Oracle BI Publisher exposes sensitive data to unauthenticated network attackers through its Web Server component, affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Successful exploitation yields complete confidentiality impact over HTTP with no user interaction, matching a CVSS 7.5 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. No public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation and application takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4: an authenticated attacker holding only low-privileged credentials can reach the Product Quality Management component over HTTP and, if the difficult exploitation conditions are met, gain full control of the application with high confidentiality, integrity and availability impact. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and the high attack complexity points to a narrow, condition-dependent trigger rather than a straightforward request. No public exploit code or confirmed active exploitation was identified at time of analysis, and only version 6.2.4 is listed as affected in Oracle's October 2026 Critical Patch Update.
Adjacent-network attackers can achieve takeover of Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 26.01.0.0.0 through a high-complexity Platform Security flaw, with no authentication or user interaction required; CVSS 8.3 reflects high confidentiality, integrity, and availability impact plus scope change. Oracle rates exploitation as difficult and requires access to the physical or adjacent communication segment attached to the OBIEE host, not the open internet. No public exploit was identified at time of analysis.
Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 can be taken over by unauthenticated remote attackers who persuade a victim to interact with a crafted HTTP-delivered resource in the BI Platform Security component. The CVSS 3.1 score is 8.8 with high confidentiality, integrity, and availability impact, but exploitation requires human interaction (UI:R) and network reachability to the BI Publisher endpoint. No public exploit code or CISA KEV confirmation was identified at time of analysis.
Unauthenticated network attackers can access critical data and make limited unauthorized changes in Oracle Agile Product Lifecycle Management for Process 6.2.4 through the Product Quality Management component, yielding a CVSS 3.1 score of 8.2 with high confidentiality and low integrity impact. The CVSS vector indicates network reachability to the HTTP interface with no credentials, user interaction, or special configuration required, though real-world risk depends on whether the application is internet-facing or only reachable from trusted internal networks. No public exploit identified at time of analysis; this is a credible mid-to-high priority for organizations running the affected version.
Oracle Database Server's RDBMS component (versions 23.4.0 through 23.26.3) lets a low-privileged database account holding the near-universal Create Session privilege read critical data - potentially all RDBMS-accessible data - over Oracle Net, and the scope-change rating means the impact can extend to other Oracle products sharing the instance. Oracle's October 2026 Critical Patch Update is the referenced fix; no public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 7.7 score reflects a confidentiality-only impact (C:H/I:N/A:N) that requires an authenticated session (PR:L).
Oracle Database's OLAP component in versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 can be compromised by an authenticated, low-privileged database user who holds the DBMS_AW privilege and can reach the Oracle Net listener; successful exploitation can result in takeover of Oracle OLAP with high confidentiality, integrity, and availability impact (CVSS 8.8). The attack requires network access via Oracle Net but no user interaction, and the main exposure control is limiting who receives DBMS_AW and how broadly the listener is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
Takeover of Oracle BI EE 12.2.1.4.0 is possible for an authenticated, low-privileged attacker who already has local logon to the infrastructure hosting the BI Foundation component, though high attack complexity makes reliable exploitation dependent on conditions beyond the attacker's control. The issue carries CVSS 3.1 base score 7.0 with full confidentiality, integrity, and availability impact, but it is not remotely or unauthenticated exploitable. No public exploit is identified at time of analysis, so risk is concentrated on hosts where semi-trusted users hold local accounts.
Unauthenticated remote attackers can read critical data from Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 over HTTP, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, base 7.5) indicating a low-complexity, no-prerequisites confidentiality breach with no integrity or availability impact. The flaw is classified by the reporter under an authentication-bypass tag, meaning access controls on a WebCenter Sites interface can be sidestepped rather than brute-forced, exposing all data the application can reach. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV, so there is no confirmed active exploitation, though the combination of unauthenticated network reachability and high confidentiality impact makes this a genuine priority for internet-facing deployments rather than an inflated score.
Authenticated takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4: a low-privileged attacker with HTTP network access to the Product Quality Management component can compromise confidentiality, integrity, and availability at high impact (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The PR:L authentication prerequisite is the main limiting factor - an attacker must already hold or obtain a valid low-privileged account, so this is not anonymous exploitation, but once inside no user interaction or special configuration is required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); the intelligence signals are sparse, resting on a single Oracle CPU reference with no CWE mapping or CPE data.
Takeover of Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 12.2.1.4.0 is possible when an attacker who already holds a local OS-level logon on the Analytics Server host can get a different user to open or process attacker-supplied content. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no OBIEE application credentials are needed, but host access and user interaction are hard prerequisites. No public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated attackers with network reach to Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can potentially achieve full takeover of the platform through the BI Foundation component over HTTP, with high impact across confidentiality, integrity and availability (CVSS 3.1 base 8.1). The high attack complexity reflects Oracle's own 'difficult to exploit' classification, meaning success hinges on timing, state or environmental preconditions outside the attacker's direct control rather than a single reliable request. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so practical risk is gated primarily by whether the BI HTTP interface is exposed to untrusted networks.
Oracle BI EE 8.2.0.0.0 and 12.2.1.4.0 can be taken over through a low-complexity Platform Security flaw that an unauthenticated attacker triggers after obtaining interactive logon access to the host and persuading another user to perform an action. The local attack path (AV:L) and user-interaction requirement (UI:R) keep it from being remotely wormable against default internet-facing deployments, despite high confidentiality, integrity, and availability impact and a 7.8 CVSS score. No public exploit was identified at time of analysis, and CISA KEV does not list this CVE.
Unauthenticated HTTP requests to Oracle WebCenter Sites can disclose critical content and site data in versions 12.2.1.4.0 and 14.1.2.0.0 because of an authentication bypass, rated CVSS 7.5 with confidentiality-only impact. Exploitation requires only network reachability to the WebCenter Sites interface - no credentials or user interaction - but the flaw does not permit data modification or service disruption. No public exploit code and no CISA KEV entry were identified at time of analysis.
Takeover of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can be achieved by a low-privileged attacker with an existing interactive logon on the OBIEE host, through the Presentation Services component. The local CVSS 3.1 vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact, but the need for local access and valid low-privilege credentials keeps this a genuine, not emergency-grade, priority. No public exploit was identified at time of analysis, and no KEV confirmation is present in the provided data.
Local privilege escalation in Oracle Solaris 11.4 can let a low-privileged attacker with an existing logon compromise the host, with high confidentiality, integrity, and availability impact. The flaw is in the Utility component and has a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit has been identified at time of analysis. Exposure is limited to systems where untrusted users can obtain local interactive access.
Authenticated low-privilege users can achieve takeover of Oracle Business Intelligence Enterprise Edition through its BI Search component, with high confidentiality, integrity, and availability impact. Affected deployments include versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0; exploitation requires network access over HTTP and a valid low-privileged account but no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, though low attack complexity makes prompt patching important.
Unauthenticated HTTP requests to the Analytics Web General component of Oracle Business Intelligence Enterprise Edition can drive the service into a hang or repeatable crash, giving a complete denial of service while also permitting limited reads and limited inserts/updates/deletes against a subset of BI EE data. The flaw is rated CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) and affects releases 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0; Oracle characterizes it as easily exploitable by a remote attacker with network access and no credentials. There is no CISA KEV listing and no public exploit identified at time of analysis, so prioritization should be driven by internet or broad-network exposure of the analytics web tier rather than by observed attack activity.
Authenticated low-privileged attackers can take over Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP, with high confidentiality, integrity, and availability impact. The flaw is network-reachable, requires no user interaction, and has low attack complexity, but it is not unauthenticated: an attacker must already hold a valid low-privileged account on the EBS instance. No public exploit was identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; the main barrier to mass exploitation is the authentication prerequisite.
Oracle ZFS Storage Appliance Kit 8.8 can be taken over by a low-privileged, authenticated attacker who can reach the appliance's HTTP management interface, with full confidentiality, integrity, and availability impact. Exploitation is network-reachable, low complexity, and requires no user interaction, but valid low-privilege credentials are required; no public exploit was identified at time of analysis. The authentication prerequisite and the appliance's typical placement on internal management networks are the main practical constraints.
Authenticated low-privileged attackers can achieve full takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 by sending crafted HTTP requests to the Product Quality Management component. The flaw is network-exploitable, requires no user interaction, and yields complete compromise of confidentiality, integrity, and availability (CVSS 8.8). No public exploit code has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.
Authenticated low-privileged users can take over Oracle Agile Product Lifecycle Management for Process 6.2.4 through the Product Quality Management component, achieving full confidentiality, integrity, and availability compromise (CVSS 8.8). Oracle describes the flaw as easily exploitable and requiring no user interaction, so a valid low-tier account or compromised low-privileged credentials is the main prerequisite. No public exploit code or confirmed active exploitation was identified at time of analysis.
Adjacent-network attackers can achieve takeover of Oracle Management Pack for Oracle GoldenGate (EM Plugin) versions 13.4.1.0.1 through 13.5.2.0.6, with high confidentiality, integrity, and availability impact, provided they can reach the communication segment attached to the host and a legitimate operator performs a required interaction. No authentication is required and attack complexity is low, but the AV:A and UI:R requirements sharply limit exposure compared with an internet-reachable flaw. The supplied intelligence contains no public exploit code and no CISA KEV entry, so there is no public exploit identified at time of analysis.
Full application takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible through its Product Quality Management component, with high confidentiality, integrity, and availability impact. The attack path requires network access to the HTTP interface and valid low-privileged credentials, and Oracle rates exploitation as difficult (AC:H), so risk is concentrated in exposed, access-controlled deployments where an attacker already has a foothold. No public exploit was identified at time of analysis; this is a genuine but second-tier priority rather than an emergency patch item.
Oracle Agile Product Lifecycle Management for Process 6.2.4 can be taken over through its Product Quality Management component by an attacker holding high-privilege credentials and network HTTP access. The CVSS 7.2 rating reflects high confidentiality, integrity, and availability impact, but the PR:H prerequisite confines practical exposure to malicious insiders or attackers who have already compromised a privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update.
Unauthorized read of critical Oracle Purchasing data, plus limited insert/update/delete capability, is achievable by a low-privileged authenticated user of Oracle E-Business Suite 12.2.3 through 12.2.15 who can reach the Internal Operations component over HTTP and satisfy non-trivial preconditions (high attack complexity). Scope is changed, so a successful attack can ripple into other Oracle products sharing the EBS deployment rather than staying confined to Purchasing. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, which keeps it a moderate-priority patching item worked through the normal Critical Patch Update cycle rather than an emergency.
Compromise of Oracle EBS Workflow 12.2.3 through 12.2.15 is possible for unauthenticated network attackers via HTTP, with successful exploitation yielding high confidentiality, integrity, and availability impact and takeover of the Workflow component. The flaw is rated CVSS 8.1 but is difficult to exploit (AC:H), meaning success depends on a server condition or timing window the attacker cannot fully control. No public exploit code or CISA KEV active-exploitation signal is present at time of analysis, so exposure is primarily a function of whether Workflow Notification Mailer HTTP endpoints are reachable from untrusted networks.
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible for authenticated low-privileged attackers with network access via HTTP, according to Oracle's October 2026 Critical Patch Update. The Content Portal Suite component flaw is rated CVSS 7.5 with high attack complexity and no user interaction, giving high confidentiality, integrity, and availability impact; it is serious but not top-tier urgent. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Oracle Database Server in versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 lets an authenticated low-privileged user who holds the Create Table privilege subvert the Virtual Private Database (VPD) row-level security feature over Oracle Net, gaining unauthorized read, creation, modification, and deletion access to data those VPD policies are supposed to protect. Successful exploitation yields high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no user interaction required; the attacker must already have a valid database account and network reachability to the database listener. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the source data, so the practical risk is concentrated in environments where low-privilege accounts are routinely granted Create Table.
Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contains a Core component flaw that unauthenticated network attackers can reach through the TLS listener, allowing limited read, update/insert/delete, and partial denial-of-service impact (CVSS 7.3). Oracle describes the issue as easily exploitable with no user interaction; exposure is greatest for internet-facing or broadly reachable WebLogic instances, while segmented admin/TLS interfaces materially reduce risk. No public exploit identified at time of analysis.
Privilege escalation in Oracle Database 23ai (versions 23.4.0 through 23.26.3) allows a low-privileged database account holding the DBMS_VECTOR privilege to take over the RDBMS over Oracle Net, with full confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.8). The attack is network-reachable and requires no user interaction, but is gated by the DBMS_VECTOR grant that ships with the Oracle AI Vector Search feature, so environments that do not use vector search or that tightly control this privilege are not exposed to arbitrary low-privileged users. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; Oracle disclosed it in its October 2026 Critical Patch Update.
Authenticated low-privileged users can take over Oracle E-Business Suite Workflow (versions 12.2.3 through 12.2.15) by attacking the Workflow Notification Mailer component over HTTP, with high impact across confidentiality, integrity, and availability (CVSS 3.1 base score 7.5). Oracle rates the flaw difficult to exploit, and the CVSS vector's high attack complexity (AC:H) indicates a specific server state or precondition must be met rather than a simple request being sufficient, although no user interaction is required. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Oracle addresses the issue in its October 2026 Critical Patch Update. This is a moderate-priority item for EBS estates that expose the notification mailer, not an emergency unauthenticated remote compromise.
Remote, unauthenticated takeover of Oracle WebCenter Content is possible through the Content Server component over HTTP, with CVSS 3.1 score 9.8 affecting versions 12.2.1.4.0 and 14.1.2.0.0. The attack requires only network reachability to the Content Server endpoint and no credentials or user interaction, yielding high confidentiality, integrity and availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, but the exposure is serious for internet-facing instances and should be prioritized.
Unauthenticated network attackers can potentially read and modify critical data handled by Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 through the LDAP Gateway component, with no user interaction required. Oracle rates the flaw as 'difficult to exploit' (CVSS 7.4, AC:H), meaning the attacker must satisfy preconditions outside their direct control before a reliable attack is possible; confidentiality and integrity of all connector-accessible data are both fully impacted, while availability is unaffected. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a genuine but second-tier priority that should be remediated in the normal Critical Patch Update cycle.
Unauthenticated LDAP requests to the LDAP Gateway in Oracle IDM Connector 12.2.1.4.0 and 14.1.2.1.0 can expose critical connector-accessible data, giving remote attackers a confidentiality-only read primitive rated CVSS 7.5. The flaw is network-reachable and requires no credentials or user interaction, but exploitation depends on the gateway being deployed and accessible over LDAP. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is bounded by network exposure rather than by confirmed active exploitation.
Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0, specifically the SAP ERP+ component, exposes an unauthenticated HTTP attack surface that can lead to authentication bypass and unauthorized creation, deletion, modification, or access of critical connector data, with scope change potentially affecting connected systems. The issue is serious but constrained: exploitation is difficult (AC:H) and requires reachable HTTP access to a deployment that actually uses the SAP ERP+ connector. No public exploit identified at time of analysis, and no CISA KEV confirmation was supplied.
Unauthenticated network access to the LDAP Gateway in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can result in full compromise of the connector, with high confidentiality, integrity, and availability impact (CVSS 9.8). The vector is AV:N/AC:L/PR:N/UI:N, so reachability of the LDAP service is the main prerequisite; deployments that expose it only to trusted networks materially reduce exposure. No CISA KEV status is supplied and no public exploit identified at time of analysis, but the severity and ease of exploitation warrant urgent patching or network restriction.
Unauthenticated network attackers can read and modify critical data through the LDAP Gateway component of Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0, which permits LDAP operations without enforcing authentication. With a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H), exploitation requires only reachability to the exposed LDAP listener and no user interaction. Oracle's October 2026 Critical Patch Update references the fix; no public exploit code or confirmed active exploitation was identified at time of analysis, so risk is concentrated in environments where the LDAP Gateway is network-accessible.
Oracle Identity Manager Connector (LDAP Gateway component) in versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged user who already has interactive logon to the connector host to read, create, delete, or modify all data reachable through the LDAP Gateway, per Oracle's October 2026 Critical Patch Update. The 7.1 score reflects high confidentiality and integrity impact with no availability impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), so exploitation is straightforward but strictly gated behind existing local access and low-level privileges, making this a bounded insider or post-compromise risk rather than a remote threat. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Oracle IDM Connector 12.2.1.4.0 and 14.1.2.1.0 contains a locally exploitable flaw in its Generic REST component that lets an attacker with an existing low-privileged logon on the connector host read, create, delete, or modify critical connector-accessible data (CVSS 3.1 base 7.1; C:H/I:H). The vector is AV:L/PR:L/UI:N, so exploitation is not remote or unauthenticated; the 'Authentication Bypass' tag is inconsistent with the PR:L requirement and should be verified against Oracle's advisory. No public exploit code or CISA KEV entry was identified at time of analysis.
Java sandbox boundary flaw in Oracle Java SE 8u503 and 8u503-perf client deployments can let a low-privileged local attacker obtain high confidentiality and integrity impact, with scope change to additional products, but only in legacy sandboxed Java Web Start or applet scenarios that execute untrusted code. The 7.5 HIGH score is tempered by the local attack vector, high attack complexity, and required low-privileged logon; server deployments running only trusted administrator-installed code are explicitly out of scope. No public exploit identified at time of analysis, and exploitation is not confirmed in CISA KEV.
Local processing of attacker-supplied files by Oracle Outside In Technology 8.5.8 can lead to full compromise of the affected parsing instance, with high confidentiality, integrity, and availability impact. The flaw is rated CVSS 7.8 and requires local access plus a victim action to open or convert a crafted document, so only deployments that feed untrusted content into OIT are realistically exposed; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated low-privilege users of Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 can achieve full takeover of the Strategic Sourcing component over HTTP, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). Exploitation requires only network reachability to the application tier and a valid low-privilege PeopleSoft account - no user interaction and no elevated privileges - so any provisioned user who can reach the Strategic Sourcing interface could attempt it. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vulnerability is addressed in Oracle's October 2026 Critical Patch Update advisory, and risk is concentrated in internet-exposed or broadly provisioned instances.
Local takeover of Oracle HTTP Server 12.2.1.4.0 is achievable by an authenticated low-privileged user who can log on to the host running the Web Listener, yielding high confidentiality, integrity and availability impact (CVSS 7.8). The AV:L/PR:L/UI:N vector confines realistic exploitation to insiders or attackers who already hold a foothold on the server, and only version 12.2.1.4.0 is listed as affected; no public exploit code exists and there is no CISA KEV entry, so the status is no public exploit identified at time of analysis.
Unauthenticated data disclosure in PeopleSoft FIN Common Objects Argentina 9.1 allows network attackers using Oracle Net to read critical or complete application data. The Integration component flaw requires only network reachability to the Oracle Net endpoint, with no credentials or user interaction, and its impact is limited to confidentiality. No public exploit code or CISA KEV entry was identified at time of analysis, and exposure is sharply reduced where Oracle Net is restricted to trusted internal segments.
Local file-processing exploitation in Oracle Outside In Technology 8.5.8 (Outside In Image Export SDK) can let an attacker who can log on to the host take over the component when a crafted file is opened or processed by another user or automated workflow. The CVSS 3.1 score is 7.8 with high confidentiality, integrity, and availability impact; the vector is local (AV:L), requires user interaction (UI:R), and does not require privileges for the vulnerable component itself (PR:N). No public exploit was identified at time of analysis, and the provided data does not indicate CISA KEV status.
Full compromise of Oracle Outside In Technology 8.5.8's Image Export SDK requires local logon access plus a victim opening a malicious file, yielding high confidentiality, integrity, and availability impact at CVSS 7.8. The CVSS vector is AV:L/AC:L/PR:N/UI:R, so the attacker needs logon to the host where Outside In runs, needs no privileges, and must convince another person to open or process a crafted file. No CISA KEV entry or public exploit code was identified at time of analysis.
Opening a crafted document through Oracle Outside In Technology 8.5.8 can let an unauthenticated local attacker seize control of the affected runtime, with high impact across confidentiality, integrity and availability (CVSS 3.1 score 7.8). Because the flaw sits in the Outside In Core parsing component, the practical attack path is delivery of a malicious file that a victim then opens or processes on the host - the attacker cannot trigger it remotely and must rely on user interaction. Only version 8.5.8 is listed as affected; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vulnerability is addressed in Oracle's October 2026 Critical Patch Update.
Local file-processing flaws in the Outside In Image Export SDK shipped with Oracle Outside In Technology 8.5.8 let an attacker who can log on to the host achieve full takeover of the affected SDK process by convincing another user or service to open a crafted file. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms this is a local, unauthenticated attack that requires victim interaction rather than something reachable over the network, and only the Image Export SDK component of the 8.5.8 release is in scope. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a moderate-priority issue that is chiefly dangerous where the SDK is exposed to untrusted documents on shared or multi-tenant conversion hosts.
Unauthenticated, remote attackers can read and modify critical data in the Server Infrastructure component of Oracle Siebel CRM Deployment across supported versions 17.0 through 26.9, with a CVSS 3.1 base score of 7.4 (High) driven entirely by high confidentiality and integrity impact. Oracle rates the flaw as 'difficult to exploit' (AC:H), meaning success depends on conditions outside the attacker's control - server state, timing, or an unspecified precondition - which tempers the headline score and argues for a lower real-world priority than the 7.4 suggests; no public exploit code and no KEV listing were identified at time of analysis. Authentication and user interaction are not required (PR:N, UI:N), and the advisory metadata tags the issue as an authentication bypass, so exposure should be scoped by network reachability to the deployment server rather than by credential controls. The fix is delivered through Oracle's October 2026 Critical Patch Update.
Unauthenticated remote attackers who can reach the Siebel HTTP interface can read, create, delete, or modify critical data held in Oracle Siebel CRM Deployment versions 17.0 through 26.9, although Oracle rates the issue as difficult to exploit (AC:H), meaning successful abuse depends on conditions outside the attacker's direct control such as specific server configuration, state, or timing rather than a single deterministic request against a default install. Confidentiality and integrity of Deployment-accessible data are both fully compromised, while availability is unaffected and no scope change to other systems occurs. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a genuine but second-tier priority to be scheduled alongside the October 2026 Oracle Critical Patch Update rather than treated as an emergency.
Unauthenticated remote attackers can read critical data from Oracle Siebel CRM Deployment (Server Infrastructure component) in supported versions 17.0 through 26.9 via HTTP, with low attack complexity and no user interaction, yielding a CVSS 3.1 score of 7.5 (High) and confidentiality-only impact. No public exploit identified at time of analysis, and no CISA KEV active exploitation is reported. Remediate by applying Oracle's October 2026 Critical Patch Update referenced in the vendor advisory.
Unauthenticated remote attackers can read critical data from Oracle Siebel CRM Deployment (Server Infrastructure component) in supported versions 17.0 through 26.9 by sending HTTP requests, due to an authentication bypass flaw (CVSS 3.1 base score 7.5). The vulnerability is network-reachable with low complexity and no user interaction, but impacts only confidentiality (C:H/I:N/A:N), so it enables data disclosure rather than data modification, denial of service, or code execution. No public exploit code or active exploitation (CISA KEV) was identified at time of analysis; exposure is limited to deployments whose Siebel HTTP endpoint is reachable from the attacker's network position.
Unauthenticated network attackers can access critical data and perform limited data modification in Oracle Siebel CRM End User versions 17.0 through 26.9 via the Communications Panel/Dashboard component. The vulnerability is easily exploitable (CVSS 8.2, AV:N/AC:L/PR:N/UI:N) and requires only HTTP reachability to the Siebel web tier. No public exploit code or active exploitation has been identified at time of analysis, but internet- or intranet-exposed deployments should prioritize patching.
Authenticated low-privileged users can achieve takeover of Oracle Siebel CRM Deployment (Server Infrastructure) in versions 17.0 through 26.9 through the HTTP interface, with high impact to confidentiality, integrity, and availability (CVSS 8.8). The requirement for a valid low-tier CRM session is the main barrier, but no user interaction or special attack complexity is indicated; no public exploit was identified at time of analysis.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 allow a low-privileged authenticated user with HTTP network access to read critical data and partially modify records they should not be able to touch, yielding a CVSS 3.1 score of 7.1 (C:H/I:L/A:N). The weakness is an authorization/access-control failure rather than an authentication bypass, so exploitation requires the attacker to already hold a valid low-privileged account; no user interaction is needed and attack complexity is low. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, so exposure is bounded by the number of provisioned accounts and whether the Siebel HTTP interface is reachable from untrusted networks.
High-privileged attackers who can reach Oracle Siebel CRM's Deployment Server Infrastructure over HTTP can create, delete, or modify critical data and read all data accessible through that component, with the scope change (S:C) meaning successful exploitation can also affect other connected Oracle products beyond Siebel CRM. Supported releases 17.0 through 26.9 are affected; Oracle rates the flaw CVSS 3.1 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), with confidentiality and integrity fully compromised but no availability impact. The pre-existing administrative privilege requirement (PR:H) is the principal limiting factor, making malicious insiders or already-compromised admin accounts the realistic threat actors; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Oracle Siebel CRM Field Service (Smart Answer) versions 17.0 through 26.9 can be fully taken over by an authenticated, high-privileged attacker with HTTP access, with high confidentiality, integrity, and availability impact (CVSS 7.2). The vector requires existing high privileges (PR:H) and low complexity with no user interaction, so real-world exposure is concentrated in insider or post-compromise escalation scenarios rather than unauthenticated attacks. No CISA KEV confirmation and no public exploit identified at time of analysis.