Oracle
Monthly
Unauthenticated remote attackers with HTTP access to the Reports component of Oracle Siebel CRM End User (versions 17.0 through 26.7) can bypass intended access controls and read data they should not be able to reach, giving them unauthorized access to critical data or the full set of data accessible to the Siebel CRM End User application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), meaning it is trivially reachable and requires no credentials or user interaction, but it does not permit data modification or denial of service. No public proof-of-concept, EPSS score, or CISA KEV listing was supplied with this report, so active exploitation is not confirmed at time of analysis.
Application takeover in Oracle Siebel CRM's Self Service module (Helpdesk/Training component) affects versions 17.0 through 26.7 and lets a low-privileged, network-positioned attacker who holds an ordinary Self Service account fully compromise the application. Because the flaw is reachable over HTTP with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), an authenticated but unprivileged user can escalate to control over confidentiality, integrity and availability of the whole Self Service deployment. No public exploit code or active exploitation is identified at time of analysis, and neither EPSS nor CISA KEV data was supplied with this report.
A privilege-escalation flaw in the Server Infrastructure component of Oracle Siebel CRM Deployment lets an attacker who already holds a low-privileged logon on the host where Siebel Deployment runs take full control of that deployment. Affected releases span Siebel CRM 17.0 through 26.7, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact). Exploitation status is currently unconfirmed: no public exploit code and no CISA KEV listing were provided at time of analysis, and Oracle does not publish PoC details with its Critical Patch Update advisories.
A low-privileged, authenticated attacker with network access can fully take over Oracle Siebel CRM Deployment (versions 17.0 through 26.7) by abusing SQL handling in the Server Infrastructure component, achieving high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw is trivially exploitable once any valid low-privilege account is obtained — no user interaction and no elevated privileges beyond a standard login are required. Oracle released a fix in its Critical Security Patch Update (cspusep2026); there is no CISA KEV listing and no public exploit code identified at time of analysis, so current exploitation appears opportunistic rather than confirmed in the wild.
A low-privileged, authenticated attacker with HTTP access to the Workflow component of Oracle Siebel CRM Development can fully take over the affected deployment, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). All supported Siebel CRM Development releases from 17.0 through 26.7 are affected per Oracle and ENISA EUVD-2026-79561. No public exploit code or CISA KEV entry is reported in the supplied intelligence, and no EPSS score or CWE classification was provided, so real-world exploitation activity is currently unconfirmed.
Oracle Siebel CRM Deployment (Migration component), versions 17.0 through 26.7, can be fully taken over by a low-privileged attacker who reaches the component over the network and supplies crafted SQL. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N, all three impact metrics High), meaning a single authenticated low-privilege account is enough to gain high confidentiality, integrity and availability impact across the deployment. At time of analysis there is no public exploit identified and no CISA KEV listing, though no EPSS score was supplied, so real-world exploitation likelihood could not be quantified from the provided intelligence.
Oracle Siebel CRM Development (Integration - Scripting component), versions 17.0 through 26.7, can be crashed and partially read or modified by a low-privileged, authenticated attacker who can reach the application over HTTP. Successful exploitation yields a repeatable denial of service (hang or crash) plus unauthorized read of a subset of data and unauthorized insert/update/delete of some records, giving a CVSS 3.1 base score of 7.6. No public exploit code or CISA KEV entry is currently associated with this CVE, and no EPSS score was supplied, so the practical risk is driven mainly by the breadth of affected versions and the low privilege bar rather than by confirmed in-the-wild activity.
Takeover of Oracle Banking Corporate Lending Process Management (component: Base, versions 14.5.0.0.0 through 14.9.0.0.0) is possible for a low-privileged attacker who reaches the application over HTTP and convinces another user to interact with attacker-supplied content, resulting in full loss of confidentiality, integrity and availability of the product. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:R) — network reachable but hard to exploit, requiring an existing low-privilege account and victim interaction. No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV entry was supplied in the source data.
Low-privileged attackers with network access via HTTP can fully compromise the Oracle Applications Framework component (Personalization) of Oracle E-Business Suite 12.2.3 through 12.2.15, achieving complete loss of confidentiality, integrity and availability of that component (CWE not assigned). The vulnerability is trivially exploitable — network vector, low complexity, no user interaction — and carries a CVSS 3.1 base score of 8.8. No public exploit code or CISA KEV listing was reported in the supplied intelligence, and no EPSS score was provided; Oracle's own advisory (cspusep2026) is the authoritative source and a patched update is expected through the relevant Critical Patch Update.
An attacker holding a low-privileged Oracle E-Business Suite account with network access to the Oracle Sourcing 'Internal Operations' component can take over Oracle Sourcing in supported releases 12.2.3 through 12.2.15, achieving full loss of confidentiality, integrity, and availability within that module (CVSS 3.1 base score 7.5, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle characterizes the issue as difficult to exploit (AC:H), meaning specific timing, state, or configuration preconditions must be satisfied rather than a single unauthenticated request; authentication is mandatory (PR:L) and no user interaction is required (UI:N). There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV), so the practical risk is a moderate-to-serious patching priority rather than an emergency pre-auth compromise scenario.
Unauthenticated network attackers can reach the Open UI component of Oracle Siebel CRM End User (versions 17.0 through 26.7) over HTTP and gain unauthorized read access to critical data, limited insert/update/delete access, and the ability to partially degrade availability. Oracle rates the issue CVSS 3.1 base 8.6 (AV:N/AC:L/PR:N/UI:N), meaning no credentials or user interaction are needed; the accompanying tags indicate an authentication-bypass class flaw. There is no CISA KEV entry, no EPSS score, and no public exploit identified at time of analysis, and Oracle has published the fix through its Critical Security Patch Update advisory.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets an unauthenticated remote attacker reach the HTTP interface and take full read/write control of deployment data. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (score 9.1) confirms no credentials, no user interaction, and no non-default configuration are required; impact is confined to confidentiality and integrity, so data can be stolen or tampered with but the service cannot be disrupted (A:N). No public exploit code has been identified at time of analysis and CISA SSVC rates exploitation as 'none', though the flaw is rated automatable with total technical impact - making exposure reduction the key control while patching.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7) lets an unauthenticated remote attacker reach critical CRM data over HTTP and read, create, delete, or modify it at will. Rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and classified CWE-287, the flaw requires no credentials and no user interaction - the only meaningful barrier is network reachability of the Siebel HTTP interface. No public exploit code exists and there is no confirmed active exploitation (CISA SSVC exploitation: none), but the issue is assessed as automatable with total technical impact, so exposure should be treated as urgent for internet-facing deployments; EPSS data was not provided for this CVE.
Takeover of Oracle Siebel CRM Deployment is possible for any low-privileged, authenticated attacker who can reach the Server Infrastructure component over HTTP, affecting supported versions 17.0 through 26.7. Oracle rates the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning a single valid low-privilege account is enough to gain full confidentiality, integrity and availability impact on the deployment — no user interaction or privilege escalation step is required. No CISA KEV entry, EPSS score or public exploit code was present in the supplied intelligence, so this is currently 'no public exploit identified at time of analysis', though Oracle's advisory language ('easily exploitable') and the low attack complexity make it an attractive post-authentication target.
Oracle Siebel CRM's Financial Services module (Financial Accounts component) can be compromised by an unauthenticated attacker with network access over HTTP, exposing critical Financial Accounts data and enabling a hang or repeatable crash of the affected service. Supported versions 17.0 through 26.7 are impacted, and the assessed vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is possible without credentials, user interaction, or non-default configuration, with impact limited to confidentiality and availability (no data modification). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); practical exposure is governed mainly by whether the Siebel HTTP endpoint is reachable from untrusted networks, since many deployments are intranet-facing.
Privileged compromise of the Server Infrastructure component in Oracle Siebel CRM Deployment (versions 17.0 through 26.7) allows an attacker who already holds administrative-level access to escalate into a full takeover of the Deployment environment over HTTP. Oracle scores it CVSS 3.1 9.1 with a scope change (S:C), meaning a successful attack can significantly impact additional products reachable from the affected deployment, with high confidentiality, integrity and availability impact. Because the vector requires high privileges (PR:H), this is a post-authentication escalation and lateral-movement risk rather than an anonymous remote compromise; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Full takeover of Oracle Siebel CRM Deployment is achievable by attackers who already hold high-privileged accounts and can reach the deployment server's TCP interface, affecting Siebel CRM Deployment versions 17.0 through 26.7. Oracle rates the flaw CVSS 7.2 with complete loss of confidentiality, integrity and availability, but the PR:H metric means a valid privileged account is a prerequisite, keeping this out of the unauthenticated mass-exploitation class. No public exploit code or CISA KEV entry appears in the supplied intelligence, and no EPSS score was provided.
Any authenticated low-privileged user who can reach the Oracle Depot Repair module over HTTP can fully compromise it in Oracle E-Business Suite versions 12.2.10 through 12.2.15, gaining read, modify and delete access across the module. Oracle rates the issue 8.8 with a network vector, low complexity, low privileges required and no user interaction, and has published a Critical Security Patch Update addressing it. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Low-privileged attackers who already hold a logon to the infrastructure hosting Oracle Siebel CRM's Life Sciences module (versions 17.0 through 26.7) can achieve full takeover of that module, with high confidentiality, integrity, and availability impact. Exploitation is not remote: it requires local interactive access plus a separate human user to perform some action (CVSS:3.1/AV:L/AC:L/PR:L/UI:R, base 7.3). No public exploit code or CISA KEV listing was present in the supplied intelligence, so this is assessed as a patch-now enterprise hardening issue rather than an actively exploited threat.
Oracle Siebel CRM End User (Open UI component) versions 17.0 through 26.7 can be taken over by an unauthenticated, network-positioned attacker who reaches the Open UI HTTP interface, and who manages to satisfy the high-complexity conditions of the flaw. Oracle's own CVSS 3.1 rating is 8.1 with high confidentiality, integrity and availability impact, reflecting full application compromise rather than a narrow data leak. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so the practical urgency stems from the breadth of the affected version range and the criticality of CRM data rather than from observed attacks.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.7, can be fully taken over by an unauthenticated network attacker who reaches the deployment's TCP service and successfully exploits a difficult-to-trigger flaw. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H, score 8.1) confirms no credentials or user interaction are required, but the high attack complexity means the attacker must satisfy a narrow, non-trivial condition to succeed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was supplied; Oracle published the fix in its Critical Security Patch Update advisory referenced below.
Full takeover of the Siebel CRM Deployment component (Oracle Siebel CRM Server Infrastructure, supported versions 17.0 through 26.7) is possible for a low-privileged user who can log on to the host where the deployment service runs, provided a person other than the attacker can be induced to perform an interaction. Oracle rates it 7.3 under CVSS 3.1 (AV:L/AC:L/PR:L/
A broken authorization flaw in the Proxy User Delegation component of Oracle User Management (Oracle E-Business Suite 12.2.3 through 12.2.15) lets an authenticated, low-privileged user reach the application over HTTP and fully take over the module, with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Because delegation features inherently exercise impersonation logic, a bypass here can translate directly into acting as a higher-privileged user across the suite. No CISA KEV listing, no public exploit code and no EPSS score were supplied with the input; exploitation status is therefore 'no public exploit identified at time of analysis'.
Full takeover of Oracle Depot Repair — the field-service and repair-management module of Oracle E-Business Suite — is possible in versions 12.2.3 through 12.2.15 for any attacker who already holds a high-privileged account and can reach the application over HTTP. The flaw sits in the module's Internal Operations component and permits complete loss of confidentiality, integrity and availability of Depot Repair data and functions. There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is currently limited to actors who obtain or already possess elevated EBS credentials.
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an application-layer access-control weakness that lets a low-privileged user with network access to the EBS HTTP interface create, delete or modify critical calendar data and read a subset of calendar records. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), meaning no user interaction is needed but a valid low-privileged account is a prerequisite. No public exploit code or CISA KEV listing was provided in the source data, and no EPSS score was supplied, so active exploitation is currently unconfirmed.
Low-privileged users with network access to Oracle E-Business Suite 12.2.3 through 12.2.15 can tamper with, create, or delete Applications Calendar data they should not control, and can partially degrade the availability of that component (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N, integrity high and availability low, no confidentiality impact). The flaw sits in the Oracle Common Applications Calendar module of EBS and is rated 'easily exploitable' by the vendor, but it is not a pre-authentication bug: an attacker must already hold a valid low-privileged account and HTTP reachability to the EBS application tier. No CISA KEV listing, EPSS score, or public exploit code was provided with the advisory data, so there is currently no public exploit identified at time of analysis.
Oracle Common Applications, a shared framework component of Oracle E-Business Suite (CRM User Management Framework), fails to properly restrict actions for low-privileged users in versions 12.2.3 through 12.2.15, allowing them to create, delete, or modify critical CRM data and read data they should not access. Exploitation is network-based over HTTP with low complexity, but requires the attacker to already hold a valid low-privileged account and to persuade another user to interact with a crafted request (CVSS 7.3, AV:N/AC:L/PR:L/UI:R). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was provided in the source data.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Core component of the Application Object Library that allows a remote, unauthenticated attacker with HTTP access to bypass authentication and gain unauthorized read and write access to critical application data. Oracle rates the issue 7.4 with a high attack complexity, reflecting that exploitation is possible over the network without credentials but requires conditions an attacker must engineer or discover. No public exploit code has been identified and the issue is not listed in CISA KEV, so at time of analysis this is a patch-now, high-impact confidentiality and integrity risk rather than a confirmed active campaign.
Unauthenticated denial of service in Oracle Siebel CRM Deployment (Server Infrastructure component) affecting release levels 17.0 through 26.7. An attacker who can reach the deployment infrastructure over HTTP can send crafted requests that hang or repeatedly crash the service, producing a complete denial of service with no confidentiality or integrity impact. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied; the risk is driven by the low attack complexity and lack of required credentials rather than by observed exploitation.
Authenticated low-privileged attackers with network reachability can fully take over Oracle Siebel CRM Development (versions 17.0 through 26.7) by exploiting the Configuration Tools component through SQL-based input, resulting in complete loss of confidentiality, integrity, and availability on the affected deployment. Oracle rates this 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a hard-to-execute but network-reachable flaw that requires only a low-privileged account and no user interaction. There is no public exploit identified at time of analysis, no EPSS score supplied, and no CISA KEV listing, so this is currently a patch-cycle priority rather than an observed active campaign.
Unauthenticated remote attackers can reach the Workspaces component of Oracle Siebel CRM Development over HTTP and obtain unauthorized read access to critical application data while also degrading service availability (CVSS 3.1 base 8.2, AV:N/AC:L/PR:N/UI:N). Affected are all Siebel CRM Development releases from 17.0 through 26.7. There is no public exploit code or CISA KEV listing confirmed in the supplied intelligence, so the practical priority depends on whether the Workspaces HTTP interface is exposed beyond trusted internal networks.
Full compromise of Oracle Siebel CRM Deployment (Server Infrastructure component, versions 17.0 through 26.7) is achievable by an authenticated low-privileged user who can reach the deployment tier over HTTP. Oracle's own advisory rates it 8.8 with complete confidentiality, integrity, and availability impact, meaning a single low-privilege account can escalate to takeover of the deployment rather than merely reading data. No CISA KEV listing, no public exploit code, and no EPSS score were included in the source data, so the current exploitation status is unconfirmed and the immediate risk is driven by the breadth of the affected version range combined with trivial attack complexity.
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker who already holds a valid account and can reach the application over HTTP. Successful exploitation gives the attacker unauthorized read, creation, modification, and deletion access to Calendar data and can also cause a partial denial of service, though Oracle rates the flaw as difficult to exploit (CVSS 3.1 7.1, AV:N/AC:H/PR:L/UI:N). No public exploit code or CISA KEV entry was provided in the intelligence feed, and the only authoritative reference is Oracle's Critical Patch Update advisory cspusep2026.
Authenticated high-privilege abuse in Oracle Application Object Library (AOL) Core, the shared foundation component of Oracle E-Business Suite 12.2.3 through 12.2.15, lets an attacker who already holds elevated EBS application privileges reach a vulnerable code path over HTTP and achieve full takeover of the AOL component itself. Exploitation is rated difficult (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.0), so success depends on conditions outside the attacker's direct control, and the high-privilege prerequisite sharply limits who can mount the attack. The offsetting aggravator is the scope change: a successful compromise can significantly impact additional integrated EBS products beyond AOL, and no public exploit code has been identified at time of analysis, so this is a genuine but hard-to-reach post-authentication risk rather than an opportunistic remote flaw.
Low-privileged users of Oracle One-to-One Fulfillment (the Documents component of Oracle E-Business Suite 12.2.3 through 12.2.15) can read, create, delete, or modify critical fulfillment and document data over HTTP without any user interaction. Oracle assigns it a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning the attacker only needs network reachability plus a low-privileged account, not administrative rights. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data.
Oracle E-Business Suite's Common Applications module (CRM User Management Framework component) in supported releases 12.2.3 through 12.2.15 can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP, resulting in complete loss of confidentiality, integrity and availability of that component. Oracle rates it CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so the network attack path is simple but the privilege bar is high. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied in the input data.
Improper authorization in the Application Framework component of Oracle CRM Technical Foundation (Oracle E-Business Suite 12.2.3–12.2.15) lets a low-privileged user with ordinary HTTP access to the instance read and alter critical CRM data that should be restricted to higher-privileged roles — integrity and confidentiality are both rated High, availability is unaffected. Oracle scores it 8.1 (AV:N/AC:L/PR:L/UI:N), meaning exploitation is straightforward but requires a valid low-privilege account rather than anonymous access. No public exploit code or active exploitation has been reported in the supplied intelligence, and no EPSS value was provided, so it should be treated as a patch-priority issue rather than an emergency.
Oracle One-to-One Fulfillment, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes unauthorized access to critical data and can be partially disrupted by an attacker holding only a low-privileged account with HTTP access to the application. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/A:L), the issue requires authentication but no user interaction, and yields high confidentiality loss plus a limited availability impact. There is no public exploit code and no CISA KEV entry at time of analysis, and no EPSS score was supplied; the vendor patch is published in the September 2026 Critical Patch Update advisory.
Oracle Sales Online, a component of Oracle E-Business Suite, is affected by an easily exploitable flaw in versions 12.2.3 through 12.2.15 that lets a low-privileged attacker with HTTP network access compromise the application and reach data outside its intended boundary (scope change). Successful exploitation can expose critical data or all Oracle Sales Online-accessible data, plus allow unauthorized insert, update, or delete of some records. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle's Critical Security Patch Update advisory (cspusep2026.html) is the authoritative fix reference and the CVSS 3.1 base score of 8.5 reflects high confidentiality and low integrity impact.
Authenticated low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the One-to-One Fulfillment 'Documents' component to read critical data outside their authorized scope and partially degrade availability of the module. The vendor-assigned CVSS 3.1 base score is 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L), reflecting high confidentiality impact with no integrity impact and only partial denial of service; the scope-change flag indicates that exploitation can significantly affect resources beyond the vulnerable component. There is no CISA KEV listing, no public proof-of-concept identified, and no EPSS data supplied, so exploitation is not confirmed to be active at time of analysis.
An adjacent-network attacker holding a low-privileged Oracle E-Business Suite account can fully take over the Oracle One-to-One Fulfillment module (Documents component) in EBS releases 12.2.3 through 12.2.15, with high confidentiality, integrity and availability impact. Exploitation requires the attacker to sit on the physical communication segment serving the host where One-to-One Fulfillment runs, but needs no user interaction and no elevated privileges once there, making a single craftable request sufficient for complete compromise of the module. No public exploit code and no CISA KEV listing were present in the available intelligence at time of analysis, and no EPSS score was supplied to quantify real-world exploitation likelihood.
Unauthenticated attackers who can reach the One-to-One Fulfillment module of Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP can achieve complete takeover of that component, with high confidentiality, integrity, and availability impact (CVSS 8.1). Oracle characterizes the flaw as difficult to exploit (AC:H), which tempers the unauthenticated network attack vector, and the issue resides in the module's Java Server layer. No public exploit code and no CISA KEV listing were identified at time of analysis, and Oracle published the fix as part of its September 2026 Critical Security Patch Update.
Oracle Applications Manager, the web-based management console shipped with Oracle E-Business Suite 12.2.3 through 12.2.15, contains an easily exploitable flaw in its Oracle Diagnostics Interfaces component that lets a low-privileged attacker with network access over HTTPS seize control of the console. Successful exploitation yields full compromise of confidentiality, integrity and availability (CVSS 8.8) and effectively hands over the EBS management plane to the attacker. No public exploit code or CISA KEV listing was present in the available intelligence at the time of analysis, so exploitation status remains unconfirmed.
An unauthenticated remote attacker with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can bypass access controls in the Oracle Application Object Library (FND) Core component and read critical application data, per Oracle's own disclosure (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/C:H/I:N/AN). The flaw is fully automatable — no credentials, no user interaction, low complexity — making it attractive for mass scanning, though its impact is limited to confidentiality (no integrity or availability loss). No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, but no EPSS score was supplied, so real-world exploitation probability is unquantified.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a broken-authorization flaw in the Customer Interaction History module (Outcome-Result component) that allows a low-privileged user with HTTP access to read data well outside their intended privileges. Exploitation is trivial once an attacker holds any valid low-privileged EBS account, and Oracle's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) marks it as an easily exploitable, confidentiality-only issue whose scope change means other EBS modules can be affected. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical risk is driven by the enormous blast radius of an ERP holding financial, HR and customer records rather than by confirmed active exploitation.
Oracle E-Business Suite releases 12.2.3 through 12.2.15 allow a low-privileged, authenticated user with network access to the HTTPS interface to take over the Customer Interaction History module, compromising confidentiality, integrity and availability of that component's data. No public exploit code has been identified and the CVE is not listed in CISA KEV, but the attack is network-reachable with low complexity and no user interaction, so a single valid account is the only real barrier. Exploitation probability metrics (EPSS) were not supplied with this record, so real-world activity cannot be quantified from the available data.
Authenticated low-privileged users can fully compromise the Customer Interaction History module (Outcome-Result component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 over HTTP, achieving complete loss of confidentiality, integrity and availability of that module. Oracle rates the issue 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker needs only a valid low-privilege account and no user interaction, making the barrier to exploitation low for anyone who already holds any EBS login. No public exploit code has been identified and the flaw does not appear in CISA KEV at time of analysis, but the Oracle Critical Patch Update reference (cspusep2026.html) indicates a vendor fix is published and patching should follow normal CPU urgency for internet-facing EBS deployments.
Network-reachable file-upload flaws in Oracle E-Business Suite's Application Object Library (Attachments component, versions 12.2.3 through 12.2.15) allow a low-privileged authenticated user to take over the affected component, earning a CVSS 3.1 base score of 8.8 with High confidentiality, integrity and availability impact and no user interaction. Exploitation needs only a valid low-privilege EBS account plus HTTP access — no privileged role, no crash, no victim action — which makes it an attractive post-authentication escalation path inside ERP deployments. No public exploit code or CISA KEV entry has been identified at time of analysis, and Oracle's cspusep2026 Critical Patch Update is the authoritative fix source.
Unauthenticated attackers able to reach the HTTPS interface of Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the Oracle Application Object Library (Core component) to create, delete, or modify critical data and to read data they should never see. The CVSS 3.1 base score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), meaning no credentials or user interaction are needed but successful exploitation depends on conditions the attacker must satisfy. No public exploit code has been identified and the flaw is not listed in CISA KEV, so it should be treated as a high-severity patch obligation rather than an actively exploited emergency.
Authenticated low-privileged users can compromise Oracle Project Intelligence within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) over HTTP, gaining unauthorized create, delete, and modify access to critical data along with read access to a subset of application data. Oracle rates the issue CVSS 3.1 base 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), reflecting a trivial-to-execute, low-privilege attack whose dominant impact is data integrity rather than availability or broad disclosure. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so exploitation status is unconfirmed.
Oracle Database Server releases 23.4.0 through 23.26.3 contain a flaw in the RDBMS component that allows a low-privileged database account holding the Create Table privilege to escalate to full takeover of the database engine over Oracle Net. The attack is network-reachable, requires no user interaction, and carries high confidentiality, integrity and availability impact, producing a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied in the source data, so the immediate driver is the combination of a low privilege bar and complete database compromise rather than confirmed in-the-wild activity.
Oracle E-Business Suite's Applications DBA component (ADPatch) contains a flaw in versions 12.2.3 through 12.2.15 that allows an attacker who already holds a logon on the host infrastructure to take over Applications DBA without presenting Oracle application credentials. Exploitation requires the attacker to persuade another person to perform some interaction (UI:R) and is scored 7.8 with full confidentiality, integrity and availability impact. No public exploit code, EPSS score, or CISA KEV entry was provided in the available intelligence, so active exploitation is unconfirmed at time of analysis.
Oracle E-Business Suite Applications Manager 12.2.3 through 12.2.15 lets a low-privileged attacker who already holds a logon on the host running Applications Manager read and tamper with critical data through the Command Line - RapidClone component. The flaw is a local-only, low-complexity authorization weakness (CVSS 7.1, AV:L/PR:L/UI:N) that yields high confidentiality and integrity impact with no availability impact, and no scoped privilege escalation beyond the component. No public exploit code has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.
Command-line processing in Oracle Applications Manager, a component of Oracle E-Business Suite 12.2.3 through 12.2.15, can be abused by a high-privileged attacker with network access over HTTP to take full control of the Applications Manager host and, because of a scope change, to significantly impact other linked EBS products. Oracle's own vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates that exploitation is difficult and requires an already-elevated account (a privileged operator, administrator, or equivalent account with access to the RapidClone command-line functionality), and no public exploit code or CISA KEV listing has been identified at time of analysis. No EPSS score was supplied with the source data, so the probability of real-world exploitation cannot be quantified from the available intelligence.
A flaw in the Oracle XML Developers Kit (XDK) component bundled with Oracle Database Server lets a low-privileged database account holding the XDKC privilege execute a network-delivered Oracle Net attack that can lead to full takeover of the XDK component, with high confidentiality, integrity and availability impact. Supported releases 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3 are affected. Oracle classifies the issue as difficult to exploit (AC:H) and no public exploit code or CISA KEV entry has been identified at time of analysis, though any user able to obtain XDKC rights is a viable candidate attacker.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contains an easily exploitable flaw that lets a low-privileged attacker positioned on the physical communication segment adjacent to the Siebel Deployment host read critical data and repeatedly crash the service. Successful exploitation yields complete confidentiality loss of all data accessible to Siebel CRM Deployment plus a repeatable denial-of-service condition, per the Oracle CPU advisory. No public exploit code or CISA KEV listing was identified at time of analysis, and EPSS data was not supplied for this CVE.
Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication in Oracle Siebel CRM End User versions 17.0 through 26.7 and obtain full read, create, modify, and delete access to all data reachable through the affected component. Rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw requires no credentials, no user interaction, and has low attack complexity, though it carries no availability impact (A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, so the primary real-world risk driver is whether the SOAP endpoint of a given deployment is exposed beyond trusted networks.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 can be fully taken over by a low-privileged attacker who can reach the deployment server over HTTPS, with high impact to confidentiality, integrity and availability. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) and describes it as easily exploitable, meaning a valid low-privilege account plus network reachability to the Deployment tier is sufficient — no user interaction and no elevated privileges are required. No public exploit code or CISA KEV entry is associated with this CVE in the supplied intelligence, and no technical root-cause detail (CWE) has been published, so exploitation in the wild is not confirmed.
Improper authorization control in the Oracle Project Intelligence module of Oracle E-Business Suite allows a low-privileged authenticated user with network access to read, create, modify, or delete data across the module, including records the account should never reach. Affected releases are 12.2.3 through 12.2.15; the vendor's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N, base 8.1) indicates the flaw is trivially automatable once credentials exist, because no user interaction is needed. No public exploit code, KEV listing, or EPSS estimate was supplied with the available intelligence, so active exploitation should be treated as unconfirmed rather than assumed.
Unauthenticated attackers with network access to the SOAP interface of Oracle Service Delivery Platform (SDP) versions 12.2.1.4.0 and 14.1.2.0.0 can bypass authentication and achieve full takeover of the product, per CWE-287 and a CVSS 3.1 base score of 9.8. The flaw is remotely exploitable without privileges or user interaction (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. Real-world risk is concentrated in telecom environments where the Messaging Enabler component is deployed and network-reachable.
Local attackers who can log on to a host running Oracle Application Testing Suite 13.3.0.1 can achieve full takeover of the application, with high impact to confidentiality, integrity and availability. The flaw requires human interaction from someone other than the attacker and is rated high complexity, meaning a foothold on the machine plus a successful social-engineering or timing condition is needed rather than a simple remote request. There is no confirmed CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the source data, so current risk is driven by the local-access precondition and Oracle's own assessment rather than evidence of active exploitation.
Oracle Application Testing Suite 13.3.0.1 allows an authenticated attacker holding only the low-privilege 'Test Manager for Web Apps' role to obtain unauthorized access to critical data, perform unauthorized inserts, updates, or deletes, and cause a partial denial of service, with a scope change (S:C) indicating that a successful attack can significantly affect other products beyond the tested application. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) reflects low attack complexity and no user interaction over HTTP, but the low-privileged account requirement is the primary limiter - an anonymous or externally unauthenticated attacker cannot exploit this, and exposure is confined to deployments running 13.3.0.1 with the Web Apps test component deployed and network-reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by an attacker who already controls a low-privileged account holding the 'Test Manager for Web Apps' role: a crafted HTTP request traverses a privilege boundary and grants control of the platform with high confidentiality, integrity and availability impact (CVSS 8.8). Because the vector is AV:N/AC:L/PR:L/UI:N, exploitation is network-reachable and needs no user interaction but does require valid low-privilege credentials, so credential theft or reuse is the practical entry point. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied with this record.
Local privilege escalation and full takeover in Oracle PeopleSoft Enterprise FIN Inventory Brazil 9.1, where any attacker holding a valid low-privileged logon to the host running the application can compromise confidentiality, integrity and availability of the Inventory component entirely. Because the flaw is reached via local access (AV:L, PR:L, UI:N) with low attack complexity, it is most relevant to insider threat, shared-host environments and post-compromise lateral movement on PeopleSoft infrastructure rather than to internet-facing attackers. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied.
Oracle Siebel CRM 17.0 through 26.7 exposes a flaw in the Open UI component that lets a low-privileged, network-positioned attacker compromise a victim's Siebel CRM End User session once that victim is persuaded to interact with attacker-supplied content. Successful exploitation yields unauthorized read, creation, deletion or modification of critical and otherwise inaccessible CRM data, and the scope-change (S:C) rating means the fallout can extend to products beyond Siebel CRM End User itself. Rated CVSS 7.7 with high attack complexity, the bug is difficult to exploit reliably, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Low-privileged attackers with network access to the Siebel Apps - Customer Order Management module (Order Management component) in Oracle Siebel CRM versions 17.0 through 26.7 can craft HTTP requests that, once a second user is induced to interact, allow unauthorized read, creation, modification, and deletion of critical order data, with a scope change that can propagate impact to connected products. The flaw carries a CVSS 3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), but no EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so active exploitation is not confirmed (no public exploit identified at time of analysis). It is an easily exploitable, low-complexity issue, making patch deployment a high priority for any organization running an affected Siebel release.
Low-privileged abuse of the Order Management component in Oracle Siebel CRM (Siebel Apps - Customer Order Management, versions 17.0 through 26.7) allows an authenticated network attacker to create, delete, or modify critical order data and to read data beyond their authorization, provided a victim user is persuaded to interact with attacker-supplied content. The flaw is rated CVSS 3.1 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) on the strength of its high confidentiality and integrity impact and its scope change, which means a successful attack executed in the victim's context can reach additional connected Oracle products; there is no availability impact. Despite the 'Authentication Bypass' tag applied by the reporter, the assessed vector confirms a valid low-privileged account is required and there is no pre-authentication path, and no public exploit code has been identified at time of analysis - the practical risk is therefore conditional on phishing a different, typically higher-privileged user into viewing or acting on crafted order-management content.
Unauthenticated network attackers can bypass authentication in the eDetailing component of the Siebel Apps - Life Sciences module shipped with Oracle Siebel CRM, affecting versions 17.0 through 26.7, and gain both read and write access to critical CRM data — provided a human other than the attacker is induced to interact with a crafted HTTP request. Oracle scores this 8.1 (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:N), reflecting full confidentiality and integrity compromise but no availability impact and only the Life Sciences vertical exposed. No public exploit code or active exploitation has been identified at time of analysis, and the vendor advisory is Oracle's September 2026 Critical Security Patch Update (cspusep2026.html).
Improper access control in Oracle Proposals, a module of Oracle E-Business Suite (component: Internal Operations), lets a low-privileged, authenticated attacker reach data outside their authorization boundary over HTTP. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields unauthorized read access to critical Oracle Proposals data with a scope change that can extend impact to other EBS-backed products. Oracle rates the issue 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code or CISA KEV entry is present in the supplied intelligence, so it should be treated as an unpatched-window exposure rather than a confirmed in-the-wild campaign.
Low-privileged, network-reachable users of Oracle Field Service can read data far beyond their authorized scope in Oracle E-Business Suite releases 12.2.3 through 12.2.15, potentially reaching critical data across additional products because the flaw crosses a security scope boundary (CVSS 3.1 7.7, C:H only). The vulnerability is exploitable over HTTP with no user interaction once a low-privileged session exists, and no public exploit code or active exploitation is identified at time of analysis. Oracle has published a Critical Security Patch Update advisory covering this issue; there is no CISA KEV listing and no EPSS score was supplied in the source data.
A high-severity flaw in the Internal Operations component of Oracle Spares Management, part of Oracle E-Business Suite, lets a high-privileged attacker who already holds a valid EBS account and HTTP network access take over the Spares Management module and pivot into connected products. All supported 12.2.3 through 12.2.15 releases are affected, and because the flaw is rated hard to exploit (AC:H) the window for a successful attack depends on satisfying a specific, currently undisclosed technical precondition. No CISA KEV listing, public exploit code, or EPSS score was provided, so the risk is driven by the CVSS 8.0 impact profile and the breadth of EBS deployments rather than by observed exploitation.
Oracle Spares Management, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged authenticated user with HTTP network access take full control of the module. Versions 12.2.3 through 12.2.15 are affected, with a CVSS 3.1 base score of 8.8 reflecting high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis, and no EPSS score was provided, so real-world exploitation status cannot be confirmed from available data.
Authenticated but only low-privileged access to the Oracle Spares Management module in Oracle E-Business Suite 12.2.3 through 12.2.15 is sufficient to seize full control of that module, with high confidentiality, integrity and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The weakness sits in the module's Internal Operations component and is reachable over HTTP with no user interaction required, which makes it practically exploitable by anyone who already holds a valid EBS account. No CISA KEV entry, public exploit code or EPSS score was supplied, so active exploitation and real-world prevalence of attacks remain unconfirmed
Oracle iStore, the e-commerce/shopping cart module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exposed to a cross-site style attack in which a low-privileged authenticated attacker with HTTP network access can induce a second user to interact with crafted content and thereby gain unauthorized read, create, modify, and delete access to iStore data — with the vendor warning the impact can extend to other EBS products. With CVSS 3.1 base 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), the flaw is trivially automatable once an attacker holds any low-privileged account, but exploitation still hinges on victim interaction, which materially lowers real-world risk. No public proof-of-concept, EPSS estimate, or CISA KEV entry was present in the supplied intelligence, so exploitation is assessed as not confirmed in the wild at time of analysis.
Low-privileged users of Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can reach data they should not be able to read through the Shopping Cart component over HTTP. Successful exploitation results in unauthorized access to critical data or complete read access to everything the iStore application can reach, and because the flaw carries a scope change it can also significantly affect other E-Business Suite products. Oracle rates it CVSS 3.1 7.7 (confidentiality only, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated information disclosure in Oracle iStore (Shopping Cart component) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a remote attacker with plain HTTP access read critical data exposed through the storefront, up to and including all data reachable by the iStore application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is trivially automatable given the network vector and lack of credentials or user interaction. No CISA KEV entry, EPSS score, or public proof-of-concept was present in the supplied intelligence, so exploitation is assessed as possible but not confirmed in the wild at time of analysis.
Authenticated, low-privileged attackers with HTTP access to Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can read, create, modify, or delete critical shopping-cart, order, and customer data, giving them full read and write reach into all iStore-accessible records. The flaw sits in the Shopping Cart component and is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is remotely reachable over HTTP with no user interaction and only a low-privilege account. No CISA KEV listing and no public exploit code were identified at time of analysis, so exploitation is currently presumed opportunistic rather than confirmed in the wild.
Oracle Web Applications Desktop Integrator (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) exposes a file download weakness that lets a low-privileged, network-connected user retrieve data they should not be able to reach. Exploitation is rated 'easily exploitable' by Oracle — HTTPS network vector, low complexity, no user interaction — and because the flaw can cross a security boundary (CVSS scope change), successful abuse may expose critical data belonging to other EBS components, not just the Desktop Integrator. CVSS 3.1 base score is 7.7 with confidentiality-only impact; no public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Integrity compromise in Oracle Site Hub, a module of Oracle E-Business Suite, affects supported releases 12.2.3 through 12.2.15 and lets a low-privileged authenticated attacker reach the Internal Operations component over HTTP to create, delete, or modify critical Site Hub data while also reading a subset of that data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) confirms network reachability with no user interaction, but the PR:L metric means credentials are required, so this is not a pre-auth or anonymous attack path despite the 'Authentication Bypass' tag carried by the reporting feed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and exploitation is further constrained by the relatively narrow deployment footprint of the Site Hub module within EBS.
Oracle Sales, the sales module of Oracle E-Business Suite (supported versions 12.2.3 through 12.2.15), exposes critical business data to any low-privileged authenticated user who can reach its HTTP interface. A crafted request against the Internal Operations component bypasses the intended access boundary, and because the CVSS vector carries a scope change (S:C), the exposure is not limited to Oracle Sales — data reachable through additional Oracle products can be read as well. Oracle classifies it as 'easily exploitable' (AV:N/AC:L/PR:L/UI:N, CVSS 3.1 base 7.7, confidentiality-only impact); no public exploit code, EPSS score, or CISA KEV entry was provided in the source data.
Unauthenticated remote attackers with HTTP access to Oracle Sales Offline, a module of Oracle E-Business Suite, can read any data the application exposes on affected versions 12.2.3 through 12.2.15. The flaw sits in the Internal Operations component and requires no credentials, no user interaction and no non-default configuration, yielding a 7.5 confidentiality-only CVSS base score. Exploitation is highly automatable and attractive for bulk data theft, though at the time of analysis there is no public exploit code and no confirmed exploitation (no CISA KEV listing); EPSS is not available in the supplied intelligence.
Oracle Sales Offline, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged authenticated user with HTTP access read critical data far beyond their intended authorization, and Oracle's own scoring marks the impact as a scope change, meaning the flaw in this component can also reach data owned by other EBS products. The CVSS 3.1 base score is 7.7 with high confidentiality impact and no integrity or availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis.
Low-privileged attackers with network access over HTTP can compromise Oracle Sales Online in Oracle E-Business Suite releases 12.2.3 through 12.2.15, exposing critical sales data and allowing limited modification of records. Exploitation requires that a low-privileged account already be held and that a second person (not the attacker) be induced to interact with the application, yet the flaw's scope change means a successful attack can ripple into other E-Business Suite components beyond Sales Online itself. It carries a CVSS 3.1 base score of 7.6, but there is no CISA KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied in the intelligence feed.
Oracle Report Manager, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP. The flaw sits in the Internal Operations component and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity, and availability for the Report Manager component with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data, but the low privilege bar and network reachability make this a strong candidate for post-authentication lateral movement inside an EBS environment.
Oracle Sales Online, a module of Oracle E-Business Suite, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP; the flaw sits in the 'Internal Operations' component and is rated 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with high confidentiality, integrity and availability impact across versions 12.2.3 through 12.2.15. Exploitation needs no user interaction and no elevated privileges, only a valid low-privilege login, making any internet- or partner-facing EBS deployment with this module enabled a realistic target. No public exploit code and no CISA KEV listing were identified at time of analysis, so the immediate driver is exposure and patch lag rather than observed in-the-wild activity.
Oracle Report Manager, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes an internal-operations flaw that lets a low-privileged attacker with HTTPS network access read critical data and degrade service availability. Successful exploitation yields high confidentiality impact against all Report Manager-accessible data plus partial denial of service, giving the flaw a 7.1 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is not confirmed to be active; risk is concentrated in internet- or broadly-reachable EBS Report Manager deployments where ordinary authenticated users exist.
Oracle Report Manager — the reporting and output-management product within Oracle E-Business Suite — can be taken over by an attacker who already holds a low-privileged account on the same instance and can reach the application tier over HTTPS. Affected releases are E-Business Suite 12.2.3 through 12.2.15, covering a very long-lived branch of the ERP platform (per the EUVD record and Oracle's Critical Security Patch Update advisory). Successful exploitation yields full read, write and denial-of-service impact on the Report Manager component (CVSS 3.1 base 8.8: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no EPSS score, CISA KEV entry, or public proof-of-concept is present in the supplied intelligence, so exploitation status should be treated as unconfirmed.
Oracle Marketing, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), contains an easily exploitable flaw in its Audience component that lets a low-privileged attacker with HTTP network access fully compromise the application, resulting in complete loss of confidentiality, integrity, and availability. Oracle's own advisory classifies the issue as takeover-level, and because the attack requires only an authenticated low-privilege account with no user interaction, any tenant with self-service or limited marketing roles should treat it as a priority. No public exploit code or CISA KEV entry was provided in the source data, so active exploitation is not confirmed at time of analysis.
Oracle Alert, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be taken over by an attacker holding only a low-privileged account with HTTP access to the application. Because the flaw sits in the Internal Operations component and requires no user interaction, any valid low-privilege EBS user can reach it and obtain full read/write control over Alert data and functionality, with high confidentiality, integrity and availability impact (CVSS 8.8). There is currently no public exploit code or confirmed in-the-wild exploitation (no CISA KEV listing), but Oracle's out-of-band Critical Security Patch Update is the only authoritative fix, and internet-exposed EBS deployments should treat the missing authentication boundary as the primary risk.
A low-privileged, network-reachable flaw in the Internal Operations component of Oracle User Management (part of Oracle E-Business Suite 12.2.6 through 12.2.15) lets an attacker who already holds a valid low-privileged account take full control of the User Management module. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N), effectively amounting to a takeover of the user-provisioning and authorization layer of the ERP. No public exploit code and no CISA KEV listing were identified at time of analysis, so this should be treated as a patch-now, high-severity issue rather than a confirmed active campaign.
Unauthenticated remote attackers with HTTP access to the Reports component of Oracle Siebel CRM End User (versions 17.0 through 26.7) can bypass intended access controls and read data they should not be able to reach, giving them unauthorized access to critical data or the full set of data accessible to the Siebel CRM End User application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), meaning it is trivially reachable and requires no credentials or user interaction, but it does not permit data modification or denial of service. No public proof-of-concept, EPSS score, or CISA KEV listing was supplied with this report, so active exploitation is not confirmed at time of analysis.
Application takeover in Oracle Siebel CRM's Self Service module (Helpdesk/Training component) affects versions 17.0 through 26.7 and lets a low-privileged, network-positioned attacker who holds an ordinary Self Service account fully compromise the application. Because the flaw is reachable over HTTP with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), an authenticated but unprivileged user can escalate to control over confidentiality, integrity and availability of the whole Self Service deployment. No public exploit code or active exploitation is identified at time of analysis, and neither EPSS nor CISA KEV data was supplied with this report.
A privilege-escalation flaw in the Server Infrastructure component of Oracle Siebel CRM Deployment lets an attacker who already holds a low-privileged logon on the host where Siebel Deployment runs take full control of that deployment. Affected releases span Siebel CRM 17.0 through 26.7, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact). Exploitation status is currently unconfirmed: no public exploit code and no CISA KEV listing were provided at time of analysis, and Oracle does not publish PoC details with its Critical Patch Update advisories.
A low-privileged, authenticated attacker with network access can fully take over Oracle Siebel CRM Deployment (versions 17.0 through 26.7) by abusing SQL handling in the Server Infrastructure component, achieving high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw is trivially exploitable once any valid low-privilege account is obtained — no user interaction and no elevated privileges beyond a standard login are required. Oracle released a fix in its Critical Security Patch Update (cspusep2026); there is no CISA KEV listing and no public exploit code identified at time of analysis, so current exploitation appears opportunistic rather than confirmed in the wild.
A low-privileged, authenticated attacker with HTTP access to the Workflow component of Oracle Siebel CRM Development can fully take over the affected deployment, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). All supported Siebel CRM Development releases from 17.0 through 26.7 are affected per Oracle and ENISA EUVD-2026-79561. No public exploit code or CISA KEV entry is reported in the supplied intelligence, and no EPSS score or CWE classification was provided, so real-world exploitation activity is currently unconfirmed.
Oracle Siebel CRM Deployment (Migration component), versions 17.0 through 26.7, can be fully taken over by a low-privileged attacker who reaches the component over the network and supplies crafted SQL. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N, all three impact metrics High), meaning a single authenticated low-privilege account is enough to gain high confidentiality, integrity and availability impact across the deployment. At time of analysis there is no public exploit identified and no CISA KEV listing, though no EPSS score was supplied, so real-world exploitation likelihood could not be quantified from the provided intelligence.
Oracle Siebel CRM Development (Integration - Scripting component), versions 17.0 through 26.7, can be crashed and partially read or modified by a low-privileged, authenticated attacker who can reach the application over HTTP. Successful exploitation yields a repeatable denial of service (hang or crash) plus unauthorized read of a subset of data and unauthorized insert/update/delete of some records, giving a CVSS 3.1 base score of 7.6. No public exploit code or CISA KEV entry is currently associated with this CVE, and no EPSS score was supplied, so the practical risk is driven mainly by the breadth of affected versions and the low privilege bar rather than by confirmed in-the-wild activity.
Takeover of Oracle Banking Corporate Lending Process Management (component: Base, versions 14.5.0.0.0 through 14.9.0.0.0) is possible for a low-privileged attacker who reaches the application over HTTP and convinces another user to interact with attacker-supplied content, resulting in full loss of confidentiality, integrity and availability of the product. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:R) — network reachable but hard to exploit, requiring an existing low-privilege account and victim interaction. No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV entry was supplied in the source data.
Low-privileged attackers with network access via HTTP can fully compromise the Oracle Applications Framework component (Personalization) of Oracle E-Business Suite 12.2.3 through 12.2.15, achieving complete loss of confidentiality, integrity and availability of that component (CWE not assigned). The vulnerability is trivially exploitable — network vector, low complexity, no user interaction — and carries a CVSS 3.1 base score of 8.8. No public exploit code or CISA KEV listing was reported in the supplied intelligence, and no EPSS score was provided; Oracle's own advisory (cspusep2026) is the authoritative source and a patched update is expected through the relevant Critical Patch Update.
An attacker holding a low-privileged Oracle E-Business Suite account with network access to the Oracle Sourcing 'Internal Operations' component can take over Oracle Sourcing in supported releases 12.2.3 through 12.2.15, achieving full loss of confidentiality, integrity, and availability within that module (CVSS 3.1 base score 7.5, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle characterizes the issue as difficult to exploit (AC:H), meaning specific timing, state, or configuration preconditions must be satisfied rather than a single unauthenticated request; authentication is mandatory (PR:L) and no user interaction is required (UI:N). There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV), so the practical risk is a moderate-to-serious patching priority rather than an emergency pre-auth compromise scenario.
Unauthenticated network attackers can reach the Open UI component of Oracle Siebel CRM End User (versions 17.0 through 26.7) over HTTP and gain unauthorized read access to critical data, limited insert/update/delete access, and the ability to partially degrade availability. Oracle rates the issue CVSS 3.1 base 8.6 (AV:N/AC:L/PR:N/UI:N), meaning no credentials or user interaction are needed; the accompanying tags indicate an authentication-bypass class flaw. There is no CISA KEV entry, no EPSS score, and no public exploit identified at time of analysis, and Oracle has published the fix through its Critical Security Patch Update advisory.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets an unauthenticated remote attacker reach the HTTP interface and take full read/write control of deployment data. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (score 9.1) confirms no credentials, no user interaction, and no non-default configuration are required; impact is confined to confidentiality and integrity, so data can be stolen or tampered with but the service cannot be disrupted (A:N). No public exploit code has been identified at time of analysis and CISA SSVC rates exploitation as 'none', though the flaw is rated automatable with total technical impact - making exposure reduction the key control while patching.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7) lets an unauthenticated remote attacker reach critical CRM data over HTTP and read, create, delete, or modify it at will. Rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and classified CWE-287, the flaw requires no credentials and no user interaction - the only meaningful barrier is network reachability of the Siebel HTTP interface. No public exploit code exists and there is no confirmed active exploitation (CISA SSVC exploitation: none), but the issue is assessed as automatable with total technical impact, so exposure should be treated as urgent for internet-facing deployments; EPSS data was not provided for this CVE.
Takeover of Oracle Siebel CRM Deployment is possible for any low-privileged, authenticated attacker who can reach the Server Infrastructure component over HTTP, affecting supported versions 17.0 through 26.7. Oracle rates the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning a single valid low-privilege account is enough to gain full confidentiality, integrity and availability impact on the deployment — no user interaction or privilege escalation step is required. No CISA KEV entry, EPSS score or public exploit code was present in the supplied intelligence, so this is currently 'no public exploit identified at time of analysis', though Oracle's advisory language ('easily exploitable') and the low attack complexity make it an attractive post-authentication target.
Oracle Siebel CRM's Financial Services module (Financial Accounts component) can be compromised by an unauthenticated attacker with network access over HTTP, exposing critical Financial Accounts data and enabling a hang or repeatable crash of the affected service. Supported versions 17.0 through 26.7 are impacted, and the assessed vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is possible without credentials, user interaction, or non-default configuration, with impact limited to confidentiality and availability (no data modification). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); practical exposure is governed mainly by whether the Siebel HTTP endpoint is reachable from untrusted networks, since many deployments are intranet-facing.
Privileged compromise of the Server Infrastructure component in Oracle Siebel CRM Deployment (versions 17.0 through 26.7) allows an attacker who already holds administrative-level access to escalate into a full takeover of the Deployment environment over HTTP. Oracle scores it CVSS 3.1 9.1 with a scope change (S:C), meaning a successful attack can significantly impact additional products reachable from the affected deployment, with high confidentiality, integrity and availability impact. Because the vector requires high privileges (PR:H), this is a post-authentication escalation and lateral-movement risk rather than an anonymous remote compromise; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Full takeover of Oracle Siebel CRM Deployment is achievable by attackers who already hold high-privileged accounts and can reach the deployment server's TCP interface, affecting Siebel CRM Deployment versions 17.0 through 26.7. Oracle rates the flaw CVSS 7.2 with complete loss of confidentiality, integrity and availability, but the PR:H metric means a valid privileged account is a prerequisite, keeping this out of the unauthenticated mass-exploitation class. No public exploit code or CISA KEV entry appears in the supplied intelligence, and no EPSS score was provided.
Any authenticated low-privileged user who can reach the Oracle Depot Repair module over HTTP can fully compromise it in Oracle E-Business Suite versions 12.2.10 through 12.2.15, gaining read, modify and delete access across the module. Oracle rates the issue 8.8 with a network vector, low complexity, low privileges required and no user interaction, and has published a Critical Security Patch Update addressing it. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Low-privileged attackers who already hold a logon to the infrastructure hosting Oracle Siebel CRM's Life Sciences module (versions 17.0 through 26.7) can achieve full takeover of that module, with high confidentiality, integrity, and availability impact. Exploitation is not remote: it requires local interactive access plus a separate human user to perform some action (CVSS:3.1/AV:L/AC:L/PR:L/UI:R, base 7.3). No public exploit code or CISA KEV listing was present in the supplied intelligence, so this is assessed as a patch-now enterprise hardening issue rather than an actively exploited threat.
Oracle Siebel CRM End User (Open UI component) versions 17.0 through 26.7 can be taken over by an unauthenticated, network-positioned attacker who reaches the Open UI HTTP interface, and who manages to satisfy the high-complexity conditions of the flaw. Oracle's own CVSS 3.1 rating is 8.1 with high confidentiality, integrity and availability impact, reflecting full application compromise rather than a narrow data leak. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so the practical urgency stems from the breadth of the affected version range and the criticality of CRM data rather than from observed attacks.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.7, can be fully taken over by an unauthenticated network attacker who reaches the deployment's TCP service and successfully exploits a difficult-to-trigger flaw. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H, score 8.1) confirms no credentials or user interaction are required, but the high attack complexity means the attacker must satisfy a narrow, non-trivial condition to succeed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was supplied; Oracle published the fix in its Critical Security Patch Update advisory referenced below.
Full takeover of the Siebel CRM Deployment component (Oracle Siebel CRM Server Infrastructure, supported versions 17.0 through 26.7) is possible for a low-privileged user who can log on to the host where the deployment service runs, provided a person other than the attacker can be induced to perform an interaction. Oracle rates it 7.3 under CVSS 3.1 (AV:L/AC:L/PR:L/
A broken authorization flaw in the Proxy User Delegation component of Oracle User Management (Oracle E-Business Suite 12.2.3 through 12.2.15) lets an authenticated, low-privileged user reach the application over HTTP and fully take over the module, with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Because delegation features inherently exercise impersonation logic, a bypass here can translate directly into acting as a higher-privileged user across the suite. No CISA KEV listing, no public exploit code and no EPSS score were supplied with the input; exploitation status is therefore 'no public exploit identified at time of analysis'.
Full takeover of Oracle Depot Repair — the field-service and repair-management module of Oracle E-Business Suite — is possible in versions 12.2.3 through 12.2.15 for any attacker who already holds a high-privileged account and can reach the application over HTTP. The flaw sits in the module's Internal Operations component and permits complete loss of confidentiality, integrity and availability of Depot Repair data and functions. There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is currently limited to actors who obtain or already possess elevated EBS credentials.
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an application-layer access-control weakness that lets a low-privileged user with network access to the EBS HTTP interface create, delete or modify critical calendar data and read a subset of calendar records. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), meaning no user interaction is needed but a valid low-privileged account is a prerequisite. No public exploit code or CISA KEV listing was provided in the source data, and no EPSS score was supplied, so active exploitation is currently unconfirmed.
Low-privileged users with network access to Oracle E-Business Suite 12.2.3 through 12.2.15 can tamper with, create, or delete Applications Calendar data they should not control, and can partially degrade the availability of that component (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N, integrity high and availability low, no confidentiality impact). The flaw sits in the Oracle Common Applications Calendar module of EBS and is rated 'easily exploitable' by the vendor, but it is not a pre-authentication bug: an attacker must already hold a valid low-privileged account and HTTP reachability to the EBS application tier. No CISA KEV listing, EPSS score, or public exploit code was provided with the advisory data, so there is currently no public exploit identified at time of analysis.
Oracle Common Applications, a shared framework component of Oracle E-Business Suite (CRM User Management Framework), fails to properly restrict actions for low-privileged users in versions 12.2.3 through 12.2.15, allowing them to create, delete, or modify critical CRM data and read data they should not access. Exploitation is network-based over HTTP with low complexity, but requires the attacker to already hold a valid low-privileged account and to persuade another user to interact with a crafted request (CVSS 7.3, AV:N/AC:L/PR:L/UI:R). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was provided in the source data.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Core component of the Application Object Library that allows a remote, unauthenticated attacker with HTTP access to bypass authentication and gain unauthorized read and write access to critical application data. Oracle rates the issue 7.4 with a high attack complexity, reflecting that exploitation is possible over the network without credentials but requires conditions an attacker must engineer or discover. No public exploit code has been identified and the issue is not listed in CISA KEV, so at time of analysis this is a patch-now, high-impact confidentiality and integrity risk rather than a confirmed active campaign.
Unauthenticated denial of service in Oracle Siebel CRM Deployment (Server Infrastructure component) affecting release levels 17.0 through 26.7. An attacker who can reach the deployment infrastructure over HTTP can send crafted requests that hang or repeatedly crash the service, producing a complete denial of service with no confidentiality or integrity impact. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied; the risk is driven by the low attack complexity and lack of required credentials rather than by observed exploitation.
Authenticated low-privileged attackers with network reachability can fully take over Oracle Siebel CRM Development (versions 17.0 through 26.7) by exploiting the Configuration Tools component through SQL-based input, resulting in complete loss of confidentiality, integrity, and availability on the affected deployment. Oracle rates this 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a hard-to-execute but network-reachable flaw that requires only a low-privileged account and no user interaction. There is no public exploit identified at time of analysis, no EPSS score supplied, and no CISA KEV listing, so this is currently a patch-cycle priority rather than an observed active campaign.
Unauthenticated remote attackers can reach the Workspaces component of Oracle Siebel CRM Development over HTTP and obtain unauthorized read access to critical application data while also degrading service availability (CVSS 3.1 base 8.2, AV:N/AC:L/PR:N/UI:N). Affected are all Siebel CRM Development releases from 17.0 through 26.7. There is no public exploit code or CISA KEV listing confirmed in the supplied intelligence, so the practical priority depends on whether the Workspaces HTTP interface is exposed beyond trusted internal networks.
Full compromise of Oracle Siebel CRM Deployment (Server Infrastructure component, versions 17.0 through 26.7) is achievable by an authenticated low-privileged user who can reach the deployment tier over HTTP. Oracle's own advisory rates it 8.8 with complete confidentiality, integrity, and availability impact, meaning a single low-privilege account can escalate to takeover of the deployment rather than merely reading data. No CISA KEV listing, no public exploit code, and no EPSS score were included in the source data, so the current exploitation status is unconfirmed and the immediate risk is driven by the breadth of the affected version range combined with trivial attack complexity.
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker who already holds a valid account and can reach the application over HTTP. Successful exploitation gives the attacker unauthorized read, creation, modification, and deletion access to Calendar data and can also cause a partial denial of service, though Oracle rates the flaw as difficult to exploit (CVSS 3.1 7.1, AV:N/AC:H/PR:L/UI:N). No public exploit code or CISA KEV entry was provided in the intelligence feed, and the only authoritative reference is Oracle's Critical Patch Update advisory cspusep2026.
Authenticated high-privilege abuse in Oracle Application Object Library (AOL) Core, the shared foundation component of Oracle E-Business Suite 12.2.3 through 12.2.15, lets an attacker who already holds elevated EBS application privileges reach a vulnerable code path over HTTP and achieve full takeover of the AOL component itself. Exploitation is rated difficult (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.0), so success depends on conditions outside the attacker's direct control, and the high-privilege prerequisite sharply limits who can mount the attack. The offsetting aggravator is the scope change: a successful compromise can significantly impact additional integrated EBS products beyond AOL, and no public exploit code has been identified at time of analysis, so this is a genuine but hard-to-reach post-authentication risk rather than an opportunistic remote flaw.
Low-privileged users of Oracle One-to-One Fulfillment (the Documents component of Oracle E-Business Suite 12.2.3 through 12.2.15) can read, create, delete, or modify critical fulfillment and document data over HTTP without any user interaction. Oracle assigns it a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning the attacker only needs network reachability plus a low-privileged account, not administrative rights. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data.
Oracle E-Business Suite's Common Applications module (CRM User Management Framework component) in supported releases 12.2.3 through 12.2.15 can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP, resulting in complete loss of confidentiality, integrity and availability of that component. Oracle rates it CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so the network attack path is simple but the privilege bar is high. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied in the input data.
Improper authorization in the Application Framework component of Oracle CRM Technical Foundation (Oracle E-Business Suite 12.2.3–12.2.15) lets a low-privileged user with ordinary HTTP access to the instance read and alter critical CRM data that should be restricted to higher-privileged roles — integrity and confidentiality are both rated High, availability is unaffected. Oracle scores it 8.1 (AV:N/AC:L/PR:L/UI:N), meaning exploitation is straightforward but requires a valid low-privilege account rather than anonymous access. No public exploit code or active exploitation has been reported in the supplied intelligence, and no EPSS value was provided, so it should be treated as a patch-priority issue rather than an emergency.
Oracle One-to-One Fulfillment, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes unauthorized access to critical data and can be partially disrupted by an attacker holding only a low-privileged account with HTTP access to the application. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/A:L), the issue requires authentication but no user interaction, and yields high confidentiality loss plus a limited availability impact. There is no public exploit code and no CISA KEV entry at time of analysis, and no EPSS score was supplied; the vendor patch is published in the September 2026 Critical Patch Update advisory.
Oracle Sales Online, a component of Oracle E-Business Suite, is affected by an easily exploitable flaw in versions 12.2.3 through 12.2.15 that lets a low-privileged attacker with HTTP network access compromise the application and reach data outside its intended boundary (scope change). Successful exploitation can expose critical data or all Oracle Sales Online-accessible data, plus allow unauthorized insert, update, or delete of some records. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle's Critical Security Patch Update advisory (cspusep2026.html) is the authoritative fix reference and the CVSS 3.1 base score of 8.5 reflects high confidentiality and low integrity impact.
Authenticated low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the One-to-One Fulfillment 'Documents' component to read critical data outside their authorized scope and partially degrade availability of the module. The vendor-assigned CVSS 3.1 base score is 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L), reflecting high confidentiality impact with no integrity impact and only partial denial of service; the scope-change flag indicates that exploitation can significantly affect resources beyond the vulnerable component. There is no CISA KEV listing, no public proof-of-concept identified, and no EPSS data supplied, so exploitation is not confirmed to be active at time of analysis.
An adjacent-network attacker holding a low-privileged Oracle E-Business Suite account can fully take over the Oracle One-to-One Fulfillment module (Documents component) in EBS releases 12.2.3 through 12.2.15, with high confidentiality, integrity and availability impact. Exploitation requires the attacker to sit on the physical communication segment serving the host where One-to-One Fulfillment runs, but needs no user interaction and no elevated privileges once there, making a single craftable request sufficient for complete compromise of the module. No public exploit code and no CISA KEV listing were present in the available intelligence at time of analysis, and no EPSS score was supplied to quantify real-world exploitation likelihood.
Unauthenticated attackers who can reach the One-to-One Fulfillment module of Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP can achieve complete takeover of that component, with high confidentiality, integrity, and availability impact (CVSS 8.1). Oracle characterizes the flaw as difficult to exploit (AC:H), which tempers the unauthenticated network attack vector, and the issue resides in the module's Java Server layer. No public exploit code and no CISA KEV listing were identified at time of analysis, and Oracle published the fix as part of its September 2026 Critical Security Patch Update.
Oracle Applications Manager, the web-based management console shipped with Oracle E-Business Suite 12.2.3 through 12.2.15, contains an easily exploitable flaw in its Oracle Diagnostics Interfaces component that lets a low-privileged attacker with network access over HTTPS seize control of the console. Successful exploitation yields full compromise of confidentiality, integrity and availability (CVSS 8.8) and effectively hands over the EBS management plane to the attacker. No public exploit code or CISA KEV listing was present in the available intelligence at the time of analysis, so exploitation status remains unconfirmed.
An unauthenticated remote attacker with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can bypass access controls in the Oracle Application Object Library (FND) Core component and read critical application data, per Oracle's own disclosure (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/C:H/I:N/AN). The flaw is fully automatable — no credentials, no user interaction, low complexity — making it attractive for mass scanning, though its impact is limited to confidentiality (no integrity or availability loss). No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, but no EPSS score was supplied, so real-world exploitation probability is unquantified.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a broken-authorization flaw in the Customer Interaction History module (Outcome-Result component) that allows a low-privileged user with HTTP access to read data well outside their intended privileges. Exploitation is trivial once an attacker holds any valid low-privileged EBS account, and Oracle's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) marks it as an easily exploitable, confidentiality-only issue whose scope change means other EBS modules can be affected. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical risk is driven by the enormous blast radius of an ERP holding financial, HR and customer records rather than by confirmed active exploitation.
Oracle E-Business Suite releases 12.2.3 through 12.2.15 allow a low-privileged, authenticated user with network access to the HTTPS interface to take over the Customer Interaction History module, compromising confidentiality, integrity and availability of that component's data. No public exploit code has been identified and the CVE is not listed in CISA KEV, but the attack is network-reachable with low complexity and no user interaction, so a single valid account is the only real barrier. Exploitation probability metrics (EPSS) were not supplied with this record, so real-world activity cannot be quantified from the available data.
Authenticated low-privileged users can fully compromise the Customer Interaction History module (Outcome-Result component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 over HTTP, achieving complete loss of confidentiality, integrity and availability of that module. Oracle rates the issue 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker needs only a valid low-privilege account and no user interaction, making the barrier to exploitation low for anyone who already holds any EBS login. No public exploit code has been identified and the flaw does not appear in CISA KEV at time of analysis, but the Oracle Critical Patch Update reference (cspusep2026.html) indicates a vendor fix is published and patching should follow normal CPU urgency for internet-facing EBS deployments.
Network-reachable file-upload flaws in Oracle E-Business Suite's Application Object Library (Attachments component, versions 12.2.3 through 12.2.15) allow a low-privileged authenticated user to take over the affected component, earning a CVSS 3.1 base score of 8.8 with High confidentiality, integrity and availability impact and no user interaction. Exploitation needs only a valid low-privilege EBS account plus HTTP access — no privileged role, no crash, no victim action — which makes it an attractive post-authentication escalation path inside ERP deployments. No public exploit code or CISA KEV entry has been identified at time of analysis, and Oracle's cspusep2026 Critical Patch Update is the authoritative fix source.
Unauthenticated attackers able to reach the HTTPS interface of Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the Oracle Application Object Library (Core component) to create, delete, or modify critical data and to read data they should never see. The CVSS 3.1 base score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), meaning no credentials or user interaction are needed but successful exploitation depends on conditions the attacker must satisfy. No public exploit code has been identified and the flaw is not listed in CISA KEV, so it should be treated as a high-severity patch obligation rather than an actively exploited emergency.
Authenticated low-privileged users can compromise Oracle Project Intelligence within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) over HTTP, gaining unauthorized create, delete, and modify access to critical data along with read access to a subset of application data. Oracle rates the issue CVSS 3.1 base 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), reflecting a trivial-to-execute, low-privilege attack whose dominant impact is data integrity rather than availability or broad disclosure. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so exploitation status is unconfirmed.
Oracle Database Server releases 23.4.0 through 23.26.3 contain a flaw in the RDBMS component that allows a low-privileged database account holding the Create Table privilege to escalate to full takeover of the database engine over Oracle Net. The attack is network-reachable, requires no user interaction, and carries high confidentiality, integrity and availability impact, producing a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied in the source data, so the immediate driver is the combination of a low privilege bar and complete database compromise rather than confirmed in-the-wild activity.
Oracle E-Business Suite's Applications DBA component (ADPatch) contains a flaw in versions 12.2.3 through 12.2.15 that allows an attacker who already holds a logon on the host infrastructure to take over Applications DBA without presenting Oracle application credentials. Exploitation requires the attacker to persuade another person to perform some interaction (UI:R) and is scored 7.8 with full confidentiality, integrity and availability impact. No public exploit code, EPSS score, or CISA KEV entry was provided in the available intelligence, so active exploitation is unconfirmed at time of analysis.
Oracle E-Business Suite Applications Manager 12.2.3 through 12.2.15 lets a low-privileged attacker who already holds a logon on the host running Applications Manager read and tamper with critical data through the Command Line - RapidClone component. The flaw is a local-only, low-complexity authorization weakness (CVSS 7.1, AV:L/PR:L/UI:N) that yields high confidentiality and integrity impact with no availability impact, and no scoped privilege escalation beyond the component. No public exploit code has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.
Command-line processing in Oracle Applications Manager, a component of Oracle E-Business Suite 12.2.3 through 12.2.15, can be abused by a high-privileged attacker with network access over HTTP to take full control of the Applications Manager host and, because of a scope change, to significantly impact other linked EBS products. Oracle's own vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates that exploitation is difficult and requires an already-elevated account (a privileged operator, administrator, or equivalent account with access to the RapidClone command-line functionality), and no public exploit code or CISA KEV listing has been identified at time of analysis. No EPSS score was supplied with the source data, so the probability of real-world exploitation cannot be quantified from the available intelligence.
A flaw in the Oracle XML Developers Kit (XDK) component bundled with Oracle Database Server lets a low-privileged database account holding the XDKC privilege execute a network-delivered Oracle Net attack that can lead to full takeover of the XDK component, with high confidentiality, integrity and availability impact. Supported releases 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3 are affected. Oracle classifies the issue as difficult to exploit (AC:H) and no public exploit code or CISA KEV entry has been identified at time of analysis, though any user able to obtain XDKC rights is a viable candidate attacker.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contains an easily exploitable flaw that lets a low-privileged attacker positioned on the physical communication segment adjacent to the Siebel Deployment host read critical data and repeatedly crash the service. Successful exploitation yields complete confidentiality loss of all data accessible to Siebel CRM Deployment plus a repeatable denial-of-service condition, per the Oracle CPU advisory. No public exploit code or CISA KEV listing was identified at time of analysis, and EPSS data was not supplied for this CVE.
Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication in Oracle Siebel CRM End User versions 17.0 through 26.7 and obtain full read, create, modify, and delete access to all data reachable through the affected component. Rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw requires no credentials, no user interaction, and has low attack complexity, though it carries no availability impact (A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, so the primary real-world risk driver is whether the SOAP endpoint of a given deployment is exposed beyond trusted networks.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 can be fully taken over by a low-privileged attacker who can reach the deployment server over HTTPS, with high impact to confidentiality, integrity and availability. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) and describes it as easily exploitable, meaning a valid low-privilege account plus network reachability to the Deployment tier is sufficient — no user interaction and no elevated privileges are required. No public exploit code or CISA KEV entry is associated with this CVE in the supplied intelligence, and no technical root-cause detail (CWE) has been published, so exploitation in the wild is not confirmed.
Improper authorization control in the Oracle Project Intelligence module of Oracle E-Business Suite allows a low-privileged authenticated user with network access to read, create, modify, or delete data across the module, including records the account should never reach. Affected releases are 12.2.3 through 12.2.15; the vendor's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N, base 8.1) indicates the flaw is trivially automatable once credentials exist, because no user interaction is needed. No public exploit code, KEV listing, or EPSS estimate was supplied with the available intelligence, so active exploitation should be treated as unconfirmed rather than assumed.
Unauthenticated attackers with network access to the SOAP interface of Oracle Service Delivery Platform (SDP) versions 12.2.1.4.0 and 14.1.2.0.0 can bypass authentication and achieve full takeover of the product, per CWE-287 and a CVSS 3.1 base score of 9.8. The flaw is remotely exploitable without privileges or user interaction (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. Real-world risk is concentrated in telecom environments where the Messaging Enabler component is deployed and network-reachable.
Local attackers who can log on to a host running Oracle Application Testing Suite 13.3.0.1 can achieve full takeover of the application, with high impact to confidentiality, integrity and availability. The flaw requires human interaction from someone other than the attacker and is rated high complexity, meaning a foothold on the machine plus a successful social-engineering or timing condition is needed rather than a simple remote request. There is no confirmed CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the source data, so current risk is driven by the local-access precondition and Oracle's own assessment rather than evidence of active exploitation.
Oracle Application Testing Suite 13.3.0.1 allows an authenticated attacker holding only the low-privilege 'Test Manager for Web Apps' role to obtain unauthorized access to critical data, perform unauthorized inserts, updates, or deletes, and cause a partial denial of service, with a scope change (S:C) indicating that a successful attack can significantly affect other products beyond the tested application. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) reflects low attack complexity and no user interaction over HTTP, but the low-privileged account requirement is the primary limiter - an anonymous or externally unauthenticated attacker cannot exploit this, and exposure is confined to deployments running 13.3.0.1 with the Web Apps test component deployed and network-reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by an attacker who already controls a low-privileged account holding the 'Test Manager for Web Apps' role: a crafted HTTP request traverses a privilege boundary and grants control of the platform with high confidentiality, integrity and availability impact (CVSS 8.8). Because the vector is AV:N/AC:L/PR:L/UI:N, exploitation is network-reachable and needs no user interaction but does require valid low-privilege credentials, so credential theft or reuse is the practical entry point. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied with this record.
Local privilege escalation and full takeover in Oracle PeopleSoft Enterprise FIN Inventory Brazil 9.1, where any attacker holding a valid low-privileged logon to the host running the application can compromise confidentiality, integrity and availability of the Inventory component entirely. Because the flaw is reached via local access (AV:L, PR:L, UI:N) with low attack complexity, it is most relevant to insider threat, shared-host environments and post-compromise lateral movement on PeopleSoft infrastructure rather than to internet-facing attackers. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied.
Oracle Siebel CRM 17.0 through 26.7 exposes a flaw in the Open UI component that lets a low-privileged, network-positioned attacker compromise a victim's Siebel CRM End User session once that victim is persuaded to interact with attacker-supplied content. Successful exploitation yields unauthorized read, creation, deletion or modification of critical and otherwise inaccessible CRM data, and the scope-change (S:C) rating means the fallout can extend to products beyond Siebel CRM End User itself. Rated CVSS 7.7 with high attack complexity, the bug is difficult to exploit reliably, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Low-privileged attackers with network access to the Siebel Apps - Customer Order Management module (Order Management component) in Oracle Siebel CRM versions 17.0 through 26.7 can craft HTTP requests that, once a second user is induced to interact, allow unauthorized read, creation, modification, and deletion of critical order data, with a scope change that can propagate impact to connected products. The flaw carries a CVSS 3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), but no EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so active exploitation is not confirmed (no public exploit identified at time of analysis). It is an easily exploitable, low-complexity issue, making patch deployment a high priority for any organization running an affected Siebel release.
Low-privileged abuse of the Order Management component in Oracle Siebel CRM (Siebel Apps - Customer Order Management, versions 17.0 through 26.7) allows an authenticated network attacker to create, delete, or modify critical order data and to read data beyond their authorization, provided a victim user is persuaded to interact with attacker-supplied content. The flaw is rated CVSS 3.1 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) on the strength of its high confidentiality and integrity impact and its scope change, which means a successful attack executed in the victim's context can reach additional connected Oracle products; there is no availability impact. Despite the 'Authentication Bypass' tag applied by the reporter, the assessed vector confirms a valid low-privileged account is required and there is no pre-authentication path, and no public exploit code has been identified at time of analysis - the practical risk is therefore conditional on phishing a different, typically higher-privileged user into viewing or acting on crafted order-management content.
Unauthenticated network attackers can bypass authentication in the eDetailing component of the Siebel Apps - Life Sciences module shipped with Oracle Siebel CRM, affecting versions 17.0 through 26.7, and gain both read and write access to critical CRM data — provided a human other than the attacker is induced to interact with a crafted HTTP request. Oracle scores this 8.1 (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:N), reflecting full confidentiality and integrity compromise but no availability impact and only the Life Sciences vertical exposed. No public exploit code or active exploitation has been identified at time of analysis, and the vendor advisory is Oracle's September 2026 Critical Security Patch Update (cspusep2026.html).
Improper access control in Oracle Proposals, a module of Oracle E-Business Suite (component: Internal Operations), lets a low-privileged, authenticated attacker reach data outside their authorization boundary over HTTP. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields unauthorized read access to critical Oracle Proposals data with a scope change that can extend impact to other EBS-backed products. Oracle rates the issue 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code or CISA KEV entry is present in the supplied intelligence, so it should be treated as an unpatched-window exposure rather than a confirmed in-the-wild campaign.
Low-privileged, network-reachable users of Oracle Field Service can read data far beyond their authorized scope in Oracle E-Business Suite releases 12.2.3 through 12.2.15, potentially reaching critical data across additional products because the flaw crosses a security scope boundary (CVSS 3.1 7.7, C:H only). The vulnerability is exploitable over HTTP with no user interaction once a low-privileged session exists, and no public exploit code or active exploitation is identified at time of analysis. Oracle has published a Critical Security Patch Update advisory covering this issue; there is no CISA KEV listing and no EPSS score was supplied in the source data.
A high-severity flaw in the Internal Operations component of Oracle Spares Management, part of Oracle E-Business Suite, lets a high-privileged attacker who already holds a valid EBS account and HTTP network access take over the Spares Management module and pivot into connected products. All supported 12.2.3 through 12.2.15 releases are affected, and because the flaw is rated hard to exploit (AC:H) the window for a successful attack depends on satisfying a specific, currently undisclosed technical precondition. No CISA KEV listing, public exploit code, or EPSS score was provided, so the risk is driven by the CVSS 8.0 impact profile and the breadth of EBS deployments rather than by observed exploitation.
Oracle Spares Management, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged authenticated user with HTTP network access take full control of the module. Versions 12.2.3 through 12.2.15 are affected, with a CVSS 3.1 base score of 8.8 reflecting high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis, and no EPSS score was provided, so real-world exploitation status cannot be confirmed from available data.
Authenticated but only low-privileged access to the Oracle Spares Management module in Oracle E-Business Suite 12.2.3 through 12.2.15 is sufficient to seize full control of that module, with high confidentiality, integrity and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The weakness sits in the module's Internal Operations component and is reachable over HTTP with no user interaction required, which makes it practically exploitable by anyone who already holds a valid EBS account. No CISA KEV entry, public exploit code or EPSS score was supplied, so active exploitation and real-world prevalence of attacks remain unconfirmed
Oracle iStore, the e-commerce/shopping cart module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exposed to a cross-site style attack in which a low-privileged authenticated attacker with HTTP network access can induce a second user to interact with crafted content and thereby gain unauthorized read, create, modify, and delete access to iStore data — with the vendor warning the impact can extend to other EBS products. With CVSS 3.1 base 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), the flaw is trivially automatable once an attacker holds any low-privileged account, but exploitation still hinges on victim interaction, which materially lowers real-world risk. No public proof-of-concept, EPSS estimate, or CISA KEV entry was present in the supplied intelligence, so exploitation is assessed as not confirmed in the wild at time of analysis.
Low-privileged users of Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can reach data they should not be able to read through the Shopping Cart component over HTTP. Successful exploitation results in unauthorized access to critical data or complete read access to everything the iStore application can reach, and because the flaw carries a scope change it can also significantly affect other E-Business Suite products. Oracle rates it CVSS 3.1 7.7 (confidentiality only, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated information disclosure in Oracle iStore (Shopping Cart component) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a remote attacker with plain HTTP access read critical data exposed through the storefront, up to and including all data reachable by the iStore application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is trivially automatable given the network vector and lack of credentials or user interaction. No CISA KEV entry, EPSS score, or public proof-of-concept was present in the supplied intelligence, so exploitation is assessed as possible but not confirmed in the wild at time of analysis.
Authenticated, low-privileged attackers with HTTP access to Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can read, create, modify, or delete critical shopping-cart, order, and customer data, giving them full read and write reach into all iStore-accessible records. The flaw sits in the Shopping Cart component and is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is remotely reachable over HTTP with no user interaction and only a low-privilege account. No CISA KEV listing and no public exploit code were identified at time of analysis, so exploitation is currently presumed opportunistic rather than confirmed in the wild.
Oracle Web Applications Desktop Integrator (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) exposes a file download weakness that lets a low-privileged, network-connected user retrieve data they should not be able to reach. Exploitation is rated 'easily exploitable' by Oracle — HTTPS network vector, low complexity, no user interaction — and because the flaw can cross a security boundary (CVSS scope change), successful abuse may expose critical data belonging to other EBS components, not just the Desktop Integrator. CVSS 3.1 base score is 7.7 with confidentiality-only impact; no public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Integrity compromise in Oracle Site Hub, a module of Oracle E-Business Suite, affects supported releases 12.2.3 through 12.2.15 and lets a low-privileged authenticated attacker reach the Internal Operations component over HTTP to create, delete, or modify critical Site Hub data while also reading a subset of that data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) confirms network reachability with no user interaction, but the PR:L metric means credentials are required, so this is not a pre-auth or anonymous attack path despite the 'Authentication Bypass' tag carried by the reporting feed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and exploitation is further constrained by the relatively narrow deployment footprint of the Site Hub module within EBS.
Oracle Sales, the sales module of Oracle E-Business Suite (supported versions 12.2.3 through 12.2.15), exposes critical business data to any low-privileged authenticated user who can reach its HTTP interface. A crafted request against the Internal Operations component bypasses the intended access boundary, and because the CVSS vector carries a scope change (S:C), the exposure is not limited to Oracle Sales — data reachable through additional Oracle products can be read as well. Oracle classifies it as 'easily exploitable' (AV:N/AC:L/PR:L/UI:N, CVSS 3.1 base 7.7, confidentiality-only impact); no public exploit code, EPSS score, or CISA KEV entry was provided in the source data.
Unauthenticated remote attackers with HTTP access to Oracle Sales Offline, a module of Oracle E-Business Suite, can read any data the application exposes on affected versions 12.2.3 through 12.2.15. The flaw sits in the Internal Operations component and requires no credentials, no user interaction and no non-default configuration, yielding a 7.5 confidentiality-only CVSS base score. Exploitation is highly automatable and attractive for bulk data theft, though at the time of analysis there is no public exploit code and no confirmed exploitation (no CISA KEV listing); EPSS is not available in the supplied intelligence.
Oracle Sales Offline, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged authenticated user with HTTP access read critical data far beyond their intended authorization, and Oracle's own scoring marks the impact as a scope change, meaning the flaw in this component can also reach data owned by other EBS products. The CVSS 3.1 base score is 7.7 with high confidentiality impact and no integrity or availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis.
Low-privileged attackers with network access over HTTP can compromise Oracle Sales Online in Oracle E-Business Suite releases 12.2.3 through 12.2.15, exposing critical sales data and allowing limited modification of records. Exploitation requires that a low-privileged account already be held and that a second person (not the attacker) be induced to interact with the application, yet the flaw's scope change means a successful attack can ripple into other E-Business Suite components beyond Sales Online itself. It carries a CVSS 3.1 base score of 7.6, but there is no CISA KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied in the intelligence feed.
Oracle Report Manager, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP. The flaw sits in the Internal Operations component and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity, and availability for the Report Manager component with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data, but the low privilege bar and network reachability make this a strong candidate for post-authentication lateral movement inside an EBS environment.
Oracle Sales Online, a module of Oracle E-Business Suite, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP; the flaw sits in the 'Internal Operations' component and is rated 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with high confidentiality, integrity and availability impact across versions 12.2.3 through 12.2.15. Exploitation needs no user interaction and no elevated privileges, only a valid low-privilege login, making any internet- or partner-facing EBS deployment with this module enabled a realistic target. No public exploit code and no CISA KEV listing were identified at time of analysis, so the immediate driver is exposure and patch lag rather than observed in-the-wild activity.
Oracle Report Manager, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes an internal-operations flaw that lets a low-privileged attacker with HTTPS network access read critical data and degrade service availability. Successful exploitation yields high confidentiality impact against all Report Manager-accessible data plus partial denial of service, giving the flaw a 7.1 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is not confirmed to be active; risk is concentrated in internet- or broadly-reachable EBS Report Manager deployments where ordinary authenticated users exist.
Oracle Report Manager — the reporting and output-management product within Oracle E-Business Suite — can be taken over by an attacker who already holds a low-privileged account on the same instance and can reach the application tier over HTTPS. Affected releases are E-Business Suite 12.2.3 through 12.2.15, covering a very long-lived branch of the ERP platform (per the EUVD record and Oracle's Critical Security Patch Update advisory). Successful exploitation yields full read, write and denial-of-service impact on the Report Manager component (CVSS 3.1 base 8.8: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no EPSS score, CISA KEV entry, or public proof-of-concept is present in the supplied intelligence, so exploitation status should be treated as unconfirmed.
Oracle Marketing, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), contains an easily exploitable flaw in its Audience component that lets a low-privileged attacker with HTTP network access fully compromise the application, resulting in complete loss of confidentiality, integrity, and availability. Oracle's own advisory classifies the issue as takeover-level, and because the attack requires only an authenticated low-privilege account with no user interaction, any tenant with self-service or limited marketing roles should treat it as a priority. No public exploit code or CISA KEV entry was provided in the source data, so active exploitation is not confirmed at time of analysis.
Oracle Alert, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be taken over by an attacker holding only a low-privileged account with HTTP access to the application. Because the flaw sits in the Internal Operations component and requires no user interaction, any valid low-privilege EBS user can reach it and obtain full read/write control over Alert data and functionality, with high confidentiality, integrity and availability impact (CVSS 8.8). There is currently no public exploit code or confirmed in-the-wild exploitation (no CISA KEV listing), but Oracle's out-of-band Critical Security Patch Update is the only authoritative fix, and internet-exposed EBS deployments should treat the missing authentication boundary as the primary risk.
A low-privileged, network-reachable flaw in the Internal Operations component of Oracle User Management (part of Oracle E-Business Suite 12.2.6 through 12.2.15) lets an attacker who already holds a valid low-privileged account take full control of the User Management module. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N), effectively amounting to a takeover of the user-provisioning and authorization layer of the ERP. No public exploit code and no CISA KEV listing were identified at time of analysis, so this should be treated as a patch-now, high-severity issue rather than a confirmed active campaign.