Oracle
Monthly
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes the Access and Security component to unauthenticated remote attackers over HTTP, enabling full read and write access to critical master data hierarchies. The CVSS 3.1 score of 8.7 reflects a scope change (S:C), meaning successful exploitation can cascade to additional Oracle Hyperion EPM products beyond the initial target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero authentication requirement and cross-component impact warrants prompt remediation.
Full system takeover in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged authenticated network attackers via HTTP, targeting the Access and Security component. Oracle's own advisory characterizes this as 'easily exploitable,' with successful exploitation resulting in complete compromise across confidentiality, integrity, and availability - consistent with an authorization bypass or privilege escalation flaw within the access control layer. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes critical data assets to unauthenticated network attackers via HTTP, enabling both full read access to all application-accessible data and unauthorized creation, deletion, or modification of critical records. The vulnerability resides in the Access and security component and is tagged as an authentication bypass by Oracle. No active exploitation (KEV) or public proof-of-concept code has been identified at time of analysis, but the high confidentiality and integrity impact with no authentication prerequisite elevates its priority for affected deployments.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all DRM-managed master data to unauthenticated remote attackers over HTTPS. The flaw resides in the Access and Security component - the gatekeeper for the application - and permits complete read access to critical DRM data alongside limited unauthorized write capability. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS vector (PR:N, AC:L) confirms trivial unauthenticated exploitability from any network-adjacent position with HTTPS reachability.
Unauthorized data exposure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows unauthenticated network attackers to access the complete dataset managed by the platform via HTTP, without requiring credentials or user interaction. The vulnerability resides in the Access and Security component and has been tagged as an Authentication Bypass, indicating a fundamental failure in access control rather than a logic edge case. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the low attack complexity and absence of authentication prerequisites make this an attractive reconnaissance target.
Improper access control in Oracle Hyperion Data Relationship Management 11.2.25.0.000 enables a local attacker to bypass application-level authentication and gain full read and write access to all DRM-managed data. The affected component is the Access and Security module (CWE-284), meaning the flaw sits at the authorization enforcement layer rather than in data processing logic. No public exploit or active exploitation is confirmed; SSVC rates technical impact as total, making successful compromise highly damaging despite the local attack vector requirement.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a low-privileged, network-based attacker to bypass access controls via a crafted SQL interaction, resulting in full confidentiality and integrity compromise of critical DRM data. The scope change (S:C) in the CVSS vector indicates successful exploitation can significantly impact additional Oracle products beyond DRM itself. No public exploit code or CISA KEV listing is identified at time of analysis, though the 'Authentication Bypass' tag signals the vulnerability undermines a core security control.
Oracle Hyperion Data Relationship Management version 11.2.25.0.000 exposes a network-exploitable flaw in its Access and Security component that allows low-privileged authenticated attackers to achieve full read and write access to critical master data and propagate impact across additional Oracle Hyperion components via a scope change. Oracle assigned a CVSS 8.2 base score and tagged the issue as an authentication bypass, indicating a breakdown in authorization enforcement rather than a trivial credential attack. No public exploit code or CISA KEV listing exists at time of analysis, but the scope change and high confidentiality and integrity impacts make this a priority patch target for organizations running integrated Hyperion environments.
Unauthenticated remote data exposure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a network-adjacent or internet-facing attacker to read critical data or achieve complete unauthorized read access to all DRM-accessible data via HTTP, with no credentials or user interaction required. The vulnerability resides in the Access and Security component and is classified as an authentication bypass by the reporting source. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes opportunistic exploitation realistic against any exposed instance.
Unauthorized data disclosure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible financial hierarchy and metadata to unauthenticated remote attackers over HTTP, with no user interaction required. The flaw resides in the Access and Security component and is classified as an authentication bypass, enabling complete confidentiality compromise of the DRM platform's data assets without any credential requirement. No public exploit has been identified at time of analysis, but the absence of authentication barriers and low attack complexity make this a credible remote threat against any network-exposed deployment.
Unauthenticated remote access to all data in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible via a network-reachable HTTP endpoint due to an authentication bypass in the Access and Security component. An unauthenticated attacker with network access can exploit this to obtain complete read access to all data managed by the affected DRM instance, including potentially sensitive master data such as financial hierarchies, organizational structures, and governance metadata. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible master data to unauthenticated remote attackers over HTTP, with additional limited write capability (insert, update, delete). The flaw resides in the Access and Security component, and Oracle's own advisory classifies it as 'easily exploitable' with a PR:N/AC:L attack vector - meaning any network-reachable instance requires no credentials or special conditions to exploit. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a high-priority patch target for enterprises running Oracle Hyperion.
Full system takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged authenticated attackers over HTTP, with no interaction required beyond initial access. The vulnerability resides in the Access and Security component and results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad network accessibility make this a credible internal threat vector for any organization running the affected version.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a low-privileged attacker over HTTP, with confirmed scope change affecting additional Oracle ecosystem products. The vulnerability resides in the Access and Security component, and successful exploitation results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high CVSS base score of 8.5 and scope-change designation make this a priority for organizations running Oracle Hyperion environments.
Unauthenticated data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a remote attacker to read, create, delete, or modify all data accessible to the application via its SOAP interface. The flaw sits in the Access and security component and is tagged as an authentication bypass, meaning an attacker needs no credentials to reach critical master-data records. No public exploit identified at time of analysis, but the CVSS 9.1 rating and unauthenticated network vector make this a high-priority patch.
Unauthorized data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) lets a remote, unauthenticated attacker read, create, delete, or modify any DRM-accessible data over HTTP. The vendor tags this as an authentication bypass, and its CVSS 3.1 score of 9.1 reflects complete confidentiality and integrity loss with no availability impact. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and no-privileges vector make it a high-priority patching target.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 permits a low-privileged, network-adjacent attacker to achieve full confidentiality and integrity compromise of critical master data, with a confirmed scope change that can propagate impact to additional Oracle Hyperion components. Exploitation via HTTP requires a victim to take some form of interactive action, placing this in a phishing or session-hijacking attack pattern. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has published a Critical Security Patch Update advisory for August 2026 addressing this flaw.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged, network-adjacent attackers over HTTP, with no user interaction required. The vulnerability resides in the Access and Security component and is tagged as an authentication bypass, enabling an attacker who holds minimal credentials to escalate their effective access to critical or all DRM-accessible data - achieving both full confidentiality and full integrity compromise without triggering availability disruption. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and lack of user interaction make exploitation straightforward for any authenticated user.
Complete takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by remote, unauthenticated attackers over TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Access and security component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can reach beyond DRM into additional connected products. No public exploit code has been identified at time of analysis, but the trivial exploitability (no authentication, low complexity) makes this a top-priority patch.
Local privilege escalation in Oracle Hyperion Data Relationship Management (DRM) version 11.2.25.0.000 allows a low-privileged attacker with established local infrastructure access to fully compromise the DRM system, with confirmed potential for scope change affecting additional Oracle Hyperion products. The CVSS vector (AV:L/AC:H/PR:L/S:C/C:H/I:H/A:H) reflects both the restricted attack surface - requiring local logon - and the significant blast radius if successfully exploited. No public exploit identified at time of analysis, and the high attack complexity further constrains real-world exploitation.
Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes an access control bypass in its 'Access and security' component that permits low-privileged authenticated users, reachable over HTTP, to gain unauthorized read access to all application data and unauthorized write access enabling creation, deletion, or modification of critical data. Tagged as an Authentication Bypass by the advisory, the flaw delivers CVSS 3.1 High severity (8.1) with combined confidentiality and integrity impact against an enterprise master data management platform. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a low-privileged network attacker via HTTP, with confirmed impacts across confidentiality, integrity, and availability. The flaw resides in the Access and Security component, pointing to an authorization defect - likely privilege escalation or access control bypass - that allows any authenticated user to compromise the entire application. No public exploit has been identified at time of analysis, but the CVSS 8.8 score, low attack complexity, and Oracle's 'takeover' impact language make this a high-priority remediation target for organizations running financial master data management environments.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible when an attacker who already holds high application privileges sends crafted requests over the network via HTTPS to the Access and security component. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond DRM itself, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 9.1). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full system takeover is possible in Oracle Hyperion Data Relationship Management version 11.2.25.0.000 via a network-exploitable flaw in the Access and Security component. A low-privileged authenticated attacker with HTTP access can, under high-complexity conditions, achieve complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the product is not listed in the CISA KEV catalog; the high attack complexity (AC:H) meaningfully reduces the realistic exploitation probability despite the severe potential impact.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by any low-privileged, network-accessible attacker via HTTP, with high impact across confidentiality, integrity, and availability. The vulnerability resides in the Access and Security component and carries a vendor-assigned CVSS 3.1 base score of 8.8, reflecting low attack complexity and no required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full remote takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by an unauthenticated attacker who can reach the service over the network via TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Access and security component and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch.
Unauthenticated remote compromise of Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) allows network attackers to read, create, modify, or delete all data accessible to the application over HTTP without any credentials. Oracle rates it CVSS 3.1 9.1 and tags it as an authentication bypass, meaning an attacker who can reach the web interface gains full confidentiality and integrity impact over master-data governance records. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Full product takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over TCP, per Oracle's Critical Patch Update advisory (CSPU August 2026). The flaw resides in the Access and security component and yields complete confidentiality, integrity, and availability compromise (CVSS 3.1 base 9.8). No public exploit identified at time of analysis, and it is not currently listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch item.
Oracle Hyperion Data Relationship Management (DRM) version 11.2.23.0.000 exposes its Web Client - Unicode component to unauthenticated remote attackers over HTTP. Exploitation allows complete read access to all DRM-accessible data - which in a master data management context often includes sensitive financial hierarchies and organizational structures - plus the ability to induce a partial denial of service. No public exploit has been identified at time of analysis, but the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivially low attack complexity with no authentication barrier.
Full system takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by an unauthenticated remote attacker over HTTP, with successful exploitation resulting in complete compromise of confidentiality, integrity, and availability. The vendor-assigned CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network reachability without authentication, though the high attack complexity rating indicates non-trivial exploitation conditions that reduce the likelihood of opportunistic mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Oracle Application Testing Suite 13.3.0.1 exposes an authentication bypass that allows an unauthenticated attacker on the same physical network segment to read critical data and perform limited data manipulation. The adjacency requirement (AV:A) constrains the attack surface to attackers who have physical or logical access to the local network segment hosting the affected system, but no credentials or user interaction are needed once that foothold exists. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero privilege requirement make this straightforward to exploit by any actor already on the adjacent network.
Local privilege escalation in Oracle Application Testing Suite 13.3.0.1 enables a low-privileged attacker with the 'Load Testing for Web Apps' application privilege to achieve full system takeover, resulting in complete loss of confidentiality, integrity, and availability. Oracle classifies this as 'easily exploitable' with CVSS 7.8 (High), reflecting low attack complexity and no user interaction requirement once local access is established. No public exploit has been identified at time of analysis, and Oracle issued a fix through the August 2026 Critical Patch Update.
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by a network-adjacent, low-privileged attacker holding the 'Load Testing for Web Apps' privilege over HTTPS. The CVSS 3.1 score of 7.5 (High) reflects total compromise of confidentiality, integrity, and availability, though Oracle classifies this as 'difficult to exploit' (AC:H), implying specific conditions must align for successful attack. No public exploit code and no CISA KEV listing have been identified at time of analysis, and EPSS data was not available in the provided intelligence.
Oracle Application Testing Suite 13.3.0.1 exposes a network-accessible vulnerability allowing low-privileged attackers holding the Load Testing for Web Apps role to achieve unauthorized complete read access to critical data and limited write access through HTTP-based exploitation that requires victim interaction. The attack carries a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle products beyond the testing suite itself. No public exploit code has been identified and CISA KEV listing is absent, though the low attack complexity and network accessibility make this a credible targeted threat for any environment running this specific version.
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by any low-privileged attacker holding the 'Load Testing for Web Apps' role via a network-accessible HTTPS vector. Oracle's own advisory classifies this as 'easily exploitable,' with complete confidentiality, integrity, and availability impact resulting in system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and broad CIA impact make this a credible priority for affected deployments.
Unauthenticated remote compromise of Oracle Application Testing Suite 13.3.0.1 allows a network attacker to read, create, modify, or delete all data accessible to the application over HTTP with no credentials or user interaction. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact (no availability impact), and tagged as an authentication bypass, this is a pre-auth flaw fixed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of PeopleSoft Enterprise FIN Common Objects Brazil 9.1 is achievable by a high-privileged attacker with network access using Oracle's T3 or IIOP protocols. The vulnerability carries a CVSS 3.1 score of 7.2, reflecting complete confidentiality, integrity, and availability impact despite the PR:H prerequisite. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though Oracle's August 2026 Critical Patch Update advisory addresses it.
Full takeover of Oracle Siebel CRM Integration (versions 17.0-26.6) is achievable by a low-privileged authenticated attacker over HTTP, exploiting a flaw in the REST component. The CVSS scope change (S:C) means successful exploitation can pivot beyond the directly targeted service, potentially compromising additional Oracle or backend systems. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog; however, the C:H/I:H/A:H impact triad warrants prioritized patching for organizations running Siebel in enterprise environments.
Remote exploitation of Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to compromise confidentiality, integrity, and availability of the platform when a victim user interacts with a malicious payload delivered over HTTP. Both actively supported versions - 12.2.1.4.0 and 14.1.2.0.0 - are affected, and successful exploitation produces a scope change, meaning impacts can propagate beyond the directly targeted WebCenter Content instance to adjacent products within the Fusion Middleware stack. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a credible threat in internet-exposed deployments.
Oracle Siebel CRM End User versions 17.0 through 26.6 expose a network-exploitable flaw in the Open UI component that, when triggered via a crafted HTTPS interaction, grants a low-privileged attacker full read and write access to critical CRM data - including complete confidentiality and integrity compromise with a documented scope change to additional products. The 'Authentication Bypass' tag reported by Oracle's security team suggests the Open UI layer can be manipulated to circumvent access controls in the context of an authenticated victim's session. No exploit code is publicly available and the vulnerability is not listed in the CISA KEV catalog at the time of analysis.
Full system takeover of Oracle Siebel CRM Deployment (versions 17.0 through 26.6) is achievable by unauthenticated remote attackers via HTTP, targeting the Migration component. The attack requires human interaction from a victim - a social engineering or luring condition that constrains opportunistic exploitation - but successful exploitation results in complete compromise of confidentiality, integrity, and availability of the Siebel CRM Deployment instance. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.
Cross-boundary compromise in Oracle Siebel CRM's Siebel Apps - Self Service module (Helpdesk/Training component, versions 17.0 through 26.6) lets an unauthenticated remote attacker fully read and modify all data accessible to the application after luring a legitimate user into interacting with a crafted HTTP request. Because the CVSS vector carries a scope change (S:C), successful exploitation can significantly impact products beyond Siebel itself, and the vendor/analyst tagging as an 'Authentication Bypass' reinforces the high confidentiality and integrity risk. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.3 base score and network-facing, unauthenticated nature make it a top-tier patch priority.
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allow a remote, unauthenticated attacker to reach the application over HTTP and create, modify, or delete critical data as well as trigger a complete, repeatable crash. Oracle rates this CVSS 9.1 (I:H/A:H, no confidentiality impact), reflecting an easily exploitable network-facing flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch item.
Remote unauthorized data access in Oracle Demand Planning versions 12.1 and 12.2 enables unauthenticated network attackers over HTTP to read all data accessible to the application and perform limited unauthorized write operations, with no authentication, elevated privileges, or user interaction required. Tagged as an authentication bypass by Oracle's own security team, this flaw carries a CVSS 3.1 base score of 8.2, reflecting high confidentiality and low integrity impact with no availability component. No public exploit code has been identified at the time of analysis, though the low attack complexity and complete absence of authentication barriers make this a straightforward target for automated or opportunistic exploitation once a proof-of-concept surfaces.
Privilege-leveraging compromise of Oracle Demand Planning (Internal Operations component) in Oracle Supply Chain / E-Business Suite versions 12.1 and 12.2 lets a low-privileged attacker with HTTP network access read and modify all data reachable by the module. Because the CVSS scope is Changed (S:C), successful attacks can extend impact beyond Demand Planning to additional connected products. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the 9.6 base score and low attack complexity make it a high-priority patch.
Oracle Loans 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes its Internal Operations component to network-based exploitation by low-privileged authenticated attackers over HTTP. Successful exploitation grants unauthorized ability to create, delete, or modify critical data across all Oracle Loans accessible records, and can induce a partial denial of service against the application. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and broad affected version range (12.2.3-12.2.15) make this a notable priority for Oracle EBS deployments.
Oracle Loans within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes all loan records to network-authenticated low-privileged users through an authorization control failure in the Internal Operations component. A low-privileged attacker with HTTP network access can read the complete Oracle Loans dataset and perform unauthorized inserts or updates on a subset of that data, without requiring elevated credentials or any victim interaction. No public exploit code has been identified at time of analysis, and Oracle has addressed this vulnerability in the August 2026 Critical Patch Update.
Local privilege escalation with scope change in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged authenticated user on the host system to bypass security controls within the Security component, achieving complete unauthorized read and write access to all application data. The CVSS scope change (S:C) means successful exploitation can cascade into additional Oracle products sharing the same infrastructure, amplifying the blast radius beyond the immediate application. No public exploit code or CISA KEV listing exists at time of analysis; the vulnerability was disclosed through Oracle's Critical Security Patch Update for August 2026.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.25.0.000 enables low-privileged authenticated host users to fully compromise the application's confidentiality and data integrity via a flaw in the Security component. Critically, the CVSS scope change indicator (S:C) signals that successful exploitation may cascade beyond the HFM application boundary to impact additional co-hosted Oracle products. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of required user interaction make exploitation straightforward for any attacker holding a valid local system account.
Unauthorized data access in Oracle Financials for EMEA (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-accessible attacker to exfiltrate critical financial data and perform limited data manipulation via HTTP. The 'Authentication Bypass' tag from ENISA EUVD suggests the flaw in the Internal Operations component permits privilege escalation beyond what the authenticated identity should authorize - effectively letting a standard user reach data reserved for higher roles. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across a financial ERP increase urgency for EMEA-facing Oracle deployments.
Authenticated low-privileged network exploitation of Oracle Financials for Asia/Pacific (versions 12.2.3-12.2.15) enables unauthorized creation, deletion, or modification of critical financial data, with partial read access to additional records. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is reachable over HTTP without user interaction. No public exploit or active KEV listing has been identified at time of analysis, though Oracle classifies it as 'easily exploitable,' and the 'Authentication Bypass' tag suggests the low-privilege requirement may be bypassed or trivially satisfied under certain conditions.
Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to compromise the Internal Operations component via HTTP, resulting in full read access to and arbitrary creation, modification, or deletion of all iRecruitment-accessible data. Tagged as an Authentication Bypass class vulnerability, the flaw enables an attacker with minimal account privileges to exceed their authorization boundary - likely bypassing object-level access controls within the HR recruitment workflow. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; remediation is available via Oracle's Critical Security Patch Update (CPU) for August 2026.
Full system takeover in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged attacker with HTTP network access, exploiting a flaw in the Security component. Oracle's own description characterizes the outcome as complete compromise, with CVSS 3.1 confirming full confidentiality, integrity, and availability impact (C:H/I:H/A:H), making this more severe than the accompanying 'Information Disclosure' tag suggests. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data access and partial data manipulation in Oracle Landed Cost Management (versions 12.2.3 through 12.2.15) is exploitable by low-privileged, network-accessible attackers via HTTP, with no user interaction required. Tagged as an Authentication Bypass, the vulnerability in the Internal Operations component allows an authenticated low-privilege user to exceed their authorization, gaining complete read access to all data accessible by the module and limited write/insert/delete capability. No public exploit has been identified at time of analysis and the flaw is not listed in the CISA KEV catalog.
Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable via HTTP due to a failure in the Security component's authentication enforcement. Tagged as an authentication bypass, the flaw allows any network-reachable attacker with no credentials or user interaction to access all data within the application's scope, carrying a CVSS 3.1 score of 7.5 (High) reflecting complete confidentiality compromise. No public exploit code or confirmed active exploitation has been identified at the time of analysis, though the low attack complexity lowers the practical barrier for capable adversaries who can reach the service.
Oracle Process Manufacturing Systems (OPM), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes a high-severity authenticated network vulnerability in the Internal Operations component that allows low-privileged attackers to both read and manipulate critical data. The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impact with no availability impact, exploitable over HTTP without user interaction. Tagged as an Authentication Bypass, this vulnerability is described as 'easily exploitable,' raising the effective risk for any organization running unpatched OPM installations; no public exploit or CISA KEV listing has been identified at time of analysis.
Full system takeover is possible in Oracle Process Manufacturing Systems (OPM), an Oracle E-Business Suite component, via a network-accessible flaw in the Internal Operations sub-component affecting versions 12.2.3 through 12.2.15. A low-privileged attacker operating over HTTP can, under high-complexity conditions, compromise confidentiality, integrity, and availability simultaneously - Oracle's own language is 'takeover of Oracle Process Manufacturing Systems.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope of impact makes this a priority patch target for manufacturing-sector organizations running Oracle EBS. Oracle addressed this in the Critical Patch Update for August 2026.
Complete data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a network-accessible, low-privileged authenticated attacker to bypass security controls within the application's Security component and gain unauthorized read access to all data the application can reach. The scope change (S:C) in the CVSS vector signals that successful exploitation may expose data beyond the HFM instance itself, potentially impacting other integrated Oracle Hyperion suite components. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low attack complexity and the Authentication Bypass tag make this a practical risk for any organization running this CPM platform.
Unauthorized data disclosure in Oracle MES for Process Manufacturing (versions 12.2.3-12.2.15) allows a low-privileged attacker with network HTTP access to bypass internal authorization controls and gain complete access to all data accessible by the MES component. The scope change (S:C in CVSS) means successful exploitation can cascade into other Oracle E-Business Suite products, amplifying the confidentiality impact beyond the MES module itself. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; however, the 'Authentication Bypass' tag, low attack complexity, and no required user interaction make this a credible risk in exposed enterprise EBS deployments.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 exposes critical financial data to unauthenticated network attackers via HTTPS. The Security component flaw - tagged explicitly as an authentication bypass by Oracle - allows complete read and write access to all data within the application, including sensitive financial consolidation records. No public exploit or CISA KEV listing is confirmed at time of analysis, and the high attack complexity (AC:H) limits opportunistic mass exploitation, but the unauthenticated network vector and dual high-severity impact on both confidentiality and integrity make this a serious priority for organizations running this version.
Unauthenticated remote information disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 exposes the complete data set accessible to the application via HTTP. The Security component contains an authentication bypass weakness that allows a network-adjacent attacker with no credentials to retrieve critical financial data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to target.
Full system takeover in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, network-authenticated attacker via the SQL interface targeting the Security component, with successful exploitation yielding complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 8.8 reflects low attack complexity and no user interaction required, making exploitation straightforward for any attacker holding valid low-level credentials. No public exploit code has been identified and no CISA KEV listing is present at time of analysis, though the low barrier to exploitation warrants urgent patching for organizations running this version.
Full system takeover of Oracle Call Center Technology (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged attacker with network access over HTTP targeting the Internal Operations component. The vulnerability is rated 7.2 CVSS 3.1 with complete Confidentiality, Integrity, and Availability impacts, meaning successful exploitation yields effective control of the affected instance. No public exploit code has been identified at time of analysis, and the requirement for high-privilege credentials is the primary limiting factor constraining real-world exposure.
Oracle Hyperion Financial Management 11.2.25.0.000 is vulnerable to full system takeover via a SQL-based attack against its Security component, exploitable by any low-privileged network-authenticated user. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability with no user interaction required beyond holding basic credentials. Oracle disclosed this as part of its August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL-based network exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged authenticated attacker to fully compromise the application, achieving complete confidentiality, integrity, and availability impact. The vulnerability resides in the Security component and is exploitable with low attack complexity and no user interaction required, making it a reliable attack path for any threat actor holding valid credentials. No public exploit code or active exploitation has been identified at time of analysis.
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated attacker with HTTP network access to fully compromise the application. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and per the CVSS vector requires no privileges or user interaction, making it a prime candidate for opportunistic exploitation. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; despite the Oracle-supplied 'Information Disclosure' tag, the CVSS I:H/A:H metrics and 'takeover' language indicate impact well beyond disclosure.
Oracle Financials for EMEA (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to gain unauthorized read access to critical financial data and perform limited unauthorized write operations via HTTP. The vulnerability resides in the Internal Operations component and, despite requiring an existing account, carries a High confidentiality impact given the sensitivity of EMEA financial records involved. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the low attack complexity and absence of user-interaction requirements make this a realistic post-authentication privilege escalation path.
Oracle Internet Procurement Connector in E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated network attackers to fully compromise data confidentiality and integrity within the connector via HTTP. Tagged as an authentication bypass by ENISA EUVD (EUVD-2026-61766), the flaw enables unauthorized creation, modification, deletion, and exfiltration of all connector-accessible data with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's own characterization as 'easily exploitable' combined with low attack complexity and network accessibility make this a credible remediation priority for organizations running Oracle E-Business Suite.
Full system takeover of Oracle Call Center Technology - a component of Oracle E-Business Suite - is achievable by unauthenticated remote attackers via HTTP across versions 12.2.3 through 12.2.15, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The high attack complexity (AC:H) designation indicates that exploitation requires satisfying non-trivial preconditions beyond mere network reachability, but no authentication or user interaction is necessary, keeping the attack surface entirely external. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover is achievable in Oracle Call Center Technology (versions 12.2.3-12.2.15) by a low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The vendor describes this as 'easily exploitable' and confirms full Confidentiality, Integrity, and Availability compromise - consistent with a CVSS 8.8 High rating and system takeover outcome. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal privilege threshold lower the bar for exploitation significantly. Notably, the vulnerability tag 'Information Disclosure' understates the confirmed impact scope, which extends to full takeover.
Oracle Call Center Technology versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes a flaw in the Internal Operations component that allows a low-privileged authenticated network attacker to fully compromise the affected system via HTTP. The vendor-assigned CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability - consistent with the described 'takeover' outcome. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Oracle Purchasing versions 12.2.5 through 12.2.15 within Oracle E-Business Suite expose an authorization bypass flaw in the Internal Operations component, allowing any authenticated low-privileged network user to gain complete read access to all purchasing data and perform unauthorized creation, deletion, or modification of critical records. Tagged as an Authentication Bypass by ENISA EUVD-2026-61762, the vulnerability is exploitable over HTTP with no user interaction and low attack complexity, making it a high-priority remediation target in Oracle EBS deployments. No public exploit code has been identified and the vulnerability is not currently listed in the CISA KEV catalog at time of analysis.
Unauthenticated remote data disclosure in Oracle Scripting (Oracle E-Business Suite component: Internal Operations) affects all supported releases from 12.2.3 through 12.2.15. Exploitation over HTTP requires no credentials, no user interaction, and no special configuration - consistent with the Authentication Bypass tag reported alongside this vulnerability. Successful exploitation grants an attacker unauthorized read access to all data accessible within Oracle Scripting, including potentially critical business data. No public exploit or active exploitation has been confirmed at time of analysis.
Oracle Scripting versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes an Internal Operations component vulnerability allowing low-privileged, network-based attackers to achieve full confidentiality and integrity compromise of all Scripting-accessible data, plus partial service disruption. The "Authentication Bypass" tag from the intelligence feed creates a notable tension with the CVSS PR:L assignment - if the bypass allows unauthenticated users to obtain a low-privilege session context, the effective attack surface is wider than the CVSS vector alone suggests. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H rating constrains opportunistic exploitation.
Oracle Scripting within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible vulnerability in the Internal Operations component, allowing a low-privileged authenticated attacker to gain complete unauthorized read access to all Oracle Scripting-accessible data and limited write access via HTTP. The vulnerability carries an Authentication Bypass tag, indicating the flaw permits privilege escalation beyond the attacker's intended authorization level within the module. No public exploit code or active exploitation has been identified at time of analysis, though Oracle itself characterizes the vulnerability as easily exploitable, elevating urgency despite the absence of a CISA KEV listing.
Unauthorized data access in Oracle Call Center Technology (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged remote attacker to gain complete read access to all data accessible by the application and limited write capability via HTTP, with a confirmed scope change enabling cascading impact on additional E-Business Suite components. The EUVD tags this as an Authentication Bypass, suggesting the Internal Operations component fails to enforce sufficient authorization boundaries for low-privilege accounts despite requiring initial authentication. No public exploit has been identified at time of analysis; this vulnerability was disclosed as part of Oracle's Critical Patch Update for August 2026.
Oracle E-Business Tax versions 12.2.3 through 12.2.15 allows a low-privileged local attacker to compromise data integrity and trigger a repeatable denial-of-service condition in the Internal Operations component. Successful exploitation enables unauthorized creation, deletion, or modification of critical tax data, and can cause the application to hang or crash completely, disrupting core business tax processing workflows. No public exploit has been identified at time of analysis, though the low complexity and low privilege requirements make this an accessible target for any authenticated local user on the affected infrastructure.
Unauthorized data access and modification in Oracle Project Planning and Control (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged authenticated network attacker via HTTP, targeting the Change Management component. The vulnerability is tagged as an authentication bypass, suggesting an attacker with minimal credentials can exceed their authorized access level to read or manipulate critical project data without any user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle rates this as easily exploitable with a CVSS 8.1, making it a high-priority patching target in enterprise environments running E-Business Suite.
Unauthorized data access and modification in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3-12.2.15) is achievable by a high-privileged remote attacker via HTTP, with exploitation triggering a scope change that can affect systems beyond the directly targeted component. The flaw resides in the Regression Testing component and carries CVSS 3.1 Base Score 7.7, reflecting high confidentiality and integrity impacts. No public exploit or CISA KEV active-exploitation listing has been identified at time of analysis.
Unauthorized data manipulation in Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical financial records via HTTP, with secondary read and partial availability impacts. The vulnerability resides in the Internal Operations component and requires only a valid low-privilege account - no elevated rights or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high integrity impact make this a significant risk for any organization running Oracle EBS financials.
Full system takeover in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged, network-capable attacker exploiting a flaw in the Regression Testing component over HTTP. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, with a scope change indicating that impact can cascade into adjacent Oracle EBS components beyond the directly affected module. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.
Unauthorized data access in Oracle Flow Manufacturing 12.2.3 through 12.2.15 allows network-authenticated low-privileged users to fully compromise confidentiality of all accessible manufacturing data and perform limited unauthorized data modification via HTTP. Tagged as an authentication bypass by the reporting source, this suggests the vulnerability enables low-privileged users to circumvent authorization controls within Oracle E-Business Suite's Internal Operations component, exposing critical operational data beyond their intended access scope. No public exploit has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Security Patch Update.
Oracle SDP Number Portability versions 12.2.3 through 12.2.15, a telecommunications management component of Oracle E-Business Suite, exposes a local privilege-abuse flaw in its Internal Operations component that enables high-privileged insiders or post-breach actors to compromise the affected system. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, read access to a subset of accessible data, and the ability to cause a partial denial of service - with a scope change (S:C) extending potential impact to additional Oracle products co-hosted in the same E-Business Suite environment. No public exploit code exists and this CVE does not appear in the CISA KEV catalog at time of analysis; the CVSS 3.1 base score of 7.3 reflects the scope change rather than inherent exploitability from the perimeter.
Unauthenticated remote data exposure in Oracle SDP Number Portability (E-Business Suite versions 12.2.3 through 12.2.15) allows a network attacker over HTTP to access critical or all data managed by the component without any credentials. The vulnerability is tagged as an Authentication Bypass in the Internal Operations component, consistent with the PR:N/AC:L CVSS vector indicating trivial exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity significantly lowers the bar for opportunistic abuse.
Oracle Purchasing within E-Business Suite versions 12.2.3 through 12.2.15 exposes a local privilege escalation in the Internal Operations component that yields full application takeover. A low-privileged attacker with OS-level logon to the infrastructure running Oracle Purchasing can exploit this flaw without any additional complexity or user interaction, achieving complete confidentiality, integrity, and availability compromise of the Purchasing module. No public exploit has been identified at time of analysis, but Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' materially elevating practical risk for organizations running EBS in shared or multi-tenant server environments.
Oracle Purchasing, a procurement module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes a high-severity network-exploitable vulnerability in its Internal Operations component that enables full system takeover - complete loss of confidentiality, integrity, and availability. Oracle itself classifies this as 'easily exploitable' despite the high-privilege requirement (PR:H), meaning that once an attacker possesses elevated credentials, exploitation presents no meaningful technical barrier. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the full CIA impact and low attack complexity make this a priority patching target for any organization running internet-exposed or broadly network-accessible Oracle EBS deployments.
Oracle General Ledger versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, contains an authentication bypass weakness in the Internal Operations component that allows a highly privileged local attacker to gain unauthorized read and write access to critical financial ledger data, with a scope change that may cascade impact to additional Oracle EBS products. The attack requires local infrastructure logon and high attack complexity, substantially constraining the realistic attacker population to insiders or those who have already compromised the host environment. No public exploit code has been identified and Oracle has addressed this through the August 2026 Critical Patch Update.
Full takeover of Oracle Applications Platform Engineering (Oracle E-Business Suite versions 12.2.3-12.2.15) is achievable by unauthenticated remote attackers via the Oracle Net protocol by exploiting a flaw in the Valid Session component. The CVSS 3.1 score of 8.1 reflects complete confidentiality, integrity, and availability impact, tempered by a high attack complexity (AC:H) that limits opportunistic mass exploitation. No public exploit code or CISA KEV listing exists at time of analysis, though the unauthenticated network vector over Oracle Net makes this a high-priority patch target for any internet-adjacent EBS deployment.
Full system takeover of Oracle Yard Management (E-Business Suite component, versions 12.2.3 through 12.2.15) is achievable by any low-privileged authenticated user over HTTP, with the vendor-reported CVSS impact of C:H/I:H/A:H indicating complete compromise of confidentiality, integrity, and availability. The affected subcomponent is Internal Operations, and Oracle addressed this flaw in the August 2026 Critical Patch Update. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Oracle Transportation Execution (E-Business Suite versions 12.2.3 through 12.2.15) exposes a network-exploitable integrity flaw in its Internal Operations component that allows a low-privileged authenticated attacker to gain unauthorized create, delete, and modify access to critical data - including a partial confidentiality breach - with a scope change impacting additional Oracle EBS products. The attack requires human interaction from a victim other than the attacker, consistent with a client-side injection pattern (e.g., stored XSS or similar), amplified by the 'Authentication Bypass' tag suggesting privilege escalation from low to higher access tiers. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes the Access and Security component to unauthenticated remote attackers over HTTP, enabling full read and write access to critical master data hierarchies. The CVSS 3.1 score of 8.7 reflects a scope change (S:C), meaning successful exploitation can cascade to additional Oracle Hyperion EPM products beyond the initial target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero authentication requirement and cross-component impact warrants prompt remediation.
Full system takeover in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged authenticated network attackers via HTTP, targeting the Access and Security component. Oracle's own advisory characterizes this as 'easily exploitable,' with successful exploitation resulting in complete compromise across confidentiality, integrity, and availability - consistent with an authorization bypass or privilege escalation flaw within the access control layer. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes critical data assets to unauthenticated network attackers via HTTP, enabling both full read access to all application-accessible data and unauthorized creation, deletion, or modification of critical records. The vulnerability resides in the Access and security component and is tagged as an authentication bypass by Oracle. No active exploitation (KEV) or public proof-of-concept code has been identified at time of analysis, but the high confidentiality and integrity impact with no authentication prerequisite elevates its priority for affected deployments.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all DRM-managed master data to unauthenticated remote attackers over HTTPS. The flaw resides in the Access and Security component - the gatekeeper for the application - and permits complete read access to critical DRM data alongside limited unauthorized write capability. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS vector (PR:N, AC:L) confirms trivial unauthenticated exploitability from any network-adjacent position with HTTPS reachability.
Unauthorized data exposure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows unauthenticated network attackers to access the complete dataset managed by the platform via HTTP, without requiring credentials or user interaction. The vulnerability resides in the Access and Security component and has been tagged as an Authentication Bypass, indicating a fundamental failure in access control rather than a logic edge case. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the low attack complexity and absence of authentication prerequisites make this an attractive reconnaissance target.
Improper access control in Oracle Hyperion Data Relationship Management 11.2.25.0.000 enables a local attacker to bypass application-level authentication and gain full read and write access to all DRM-managed data. The affected component is the Access and Security module (CWE-284), meaning the flaw sits at the authorization enforcement layer rather than in data processing logic. No public exploit or active exploitation is confirmed; SSVC rates technical impact as total, making successful compromise highly damaging despite the local attack vector requirement.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a low-privileged, network-based attacker to bypass access controls via a crafted SQL interaction, resulting in full confidentiality and integrity compromise of critical DRM data. The scope change (S:C) in the CVSS vector indicates successful exploitation can significantly impact additional Oracle products beyond DRM itself. No public exploit code or CISA KEV listing is identified at time of analysis, though the 'Authentication Bypass' tag signals the vulnerability undermines a core security control.
Oracle Hyperion Data Relationship Management version 11.2.25.0.000 exposes a network-exploitable flaw in its Access and Security component that allows low-privileged authenticated attackers to achieve full read and write access to critical master data and propagate impact across additional Oracle Hyperion components via a scope change. Oracle assigned a CVSS 8.2 base score and tagged the issue as an authentication bypass, indicating a breakdown in authorization enforcement rather than a trivial credential attack. No public exploit code or CISA KEV listing exists at time of analysis, but the scope change and high confidentiality and integrity impacts make this a priority patch target for organizations running integrated Hyperion environments.
Unauthenticated remote data exposure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a network-adjacent or internet-facing attacker to read critical data or achieve complete unauthorized read access to all DRM-accessible data via HTTP, with no credentials or user interaction required. The vulnerability resides in the Access and Security component and is classified as an authentication bypass by the reporting source. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes opportunistic exploitation realistic against any exposed instance.
Unauthorized data disclosure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible financial hierarchy and metadata to unauthenticated remote attackers over HTTP, with no user interaction required. The flaw resides in the Access and Security component and is classified as an authentication bypass, enabling complete confidentiality compromise of the DRM platform's data assets without any credential requirement. No public exploit has been identified at time of analysis, but the absence of authentication barriers and low attack complexity make this a credible remote threat against any network-exposed deployment.
Unauthenticated remote access to all data in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible via a network-reachable HTTP endpoint due to an authentication bypass in the Access and Security component. An unauthenticated attacker with network access can exploit this to obtain complete read access to all data managed by the affected DRM instance, including potentially sensitive master data such as financial hierarchies, organizational structures, and governance metadata. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible master data to unauthenticated remote attackers over HTTP, with additional limited write capability (insert, update, delete). The flaw resides in the Access and Security component, and Oracle's own advisory classifies it as 'easily exploitable' with a PR:N/AC:L attack vector - meaning any network-reachable instance requires no credentials or special conditions to exploit. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a high-priority patch target for enterprises running Oracle Hyperion.
Full system takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged authenticated attackers over HTTP, with no interaction required beyond initial access. The vulnerability resides in the Access and Security component and results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad network accessibility make this a credible internal threat vector for any organization running the affected version.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a low-privileged attacker over HTTP, with confirmed scope change affecting additional Oracle ecosystem products. The vulnerability resides in the Access and Security component, and successful exploitation results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high CVSS base score of 8.5 and scope-change designation make this a priority for organizations running Oracle Hyperion environments.
Unauthenticated data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a remote attacker to read, create, delete, or modify all data accessible to the application via its SOAP interface. The flaw sits in the Access and security component and is tagged as an authentication bypass, meaning an attacker needs no credentials to reach critical master-data records. No public exploit identified at time of analysis, but the CVSS 9.1 rating and unauthenticated network vector make this a high-priority patch.
Unauthorized data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) lets a remote, unauthenticated attacker read, create, delete, or modify any DRM-accessible data over HTTP. The vendor tags this as an authentication bypass, and its CVSS 3.1 score of 9.1 reflects complete confidentiality and integrity loss with no availability impact. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and no-privileges vector make it a high-priority patching target.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 permits a low-privileged, network-adjacent attacker to achieve full confidentiality and integrity compromise of critical master data, with a confirmed scope change that can propagate impact to additional Oracle Hyperion components. Exploitation via HTTP requires a victim to take some form of interactive action, placing this in a phishing or session-hijacking attack pattern. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has published a Critical Security Patch Update advisory for August 2026 addressing this flaw.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged, network-adjacent attackers over HTTP, with no user interaction required. The vulnerability resides in the Access and Security component and is tagged as an authentication bypass, enabling an attacker who holds minimal credentials to escalate their effective access to critical or all DRM-accessible data - achieving both full confidentiality and full integrity compromise without triggering availability disruption. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and lack of user interaction make exploitation straightforward for any authenticated user.
Complete takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by remote, unauthenticated attackers over TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Access and security component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can reach beyond DRM into additional connected products. No public exploit code has been identified at time of analysis, but the trivial exploitability (no authentication, low complexity) makes this a top-priority patch.
Local privilege escalation in Oracle Hyperion Data Relationship Management (DRM) version 11.2.25.0.000 allows a low-privileged attacker with established local infrastructure access to fully compromise the DRM system, with confirmed potential for scope change affecting additional Oracle Hyperion products. The CVSS vector (AV:L/AC:H/PR:L/S:C/C:H/I:H/A:H) reflects both the restricted attack surface - requiring local logon - and the significant blast radius if successfully exploited. No public exploit identified at time of analysis, and the high attack complexity further constrains real-world exploitation.
Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes an access control bypass in its 'Access and security' component that permits low-privileged authenticated users, reachable over HTTP, to gain unauthorized read access to all application data and unauthorized write access enabling creation, deletion, or modification of critical data. Tagged as an Authentication Bypass by the advisory, the flaw delivers CVSS 3.1 High severity (8.1) with combined confidentiality and integrity impact against an enterprise master data management platform. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a low-privileged network attacker via HTTP, with confirmed impacts across confidentiality, integrity, and availability. The flaw resides in the Access and Security component, pointing to an authorization defect - likely privilege escalation or access control bypass - that allows any authenticated user to compromise the entire application. No public exploit has been identified at time of analysis, but the CVSS 8.8 score, low attack complexity, and Oracle's 'takeover' impact language make this a high-priority remediation target for organizations running financial master data management environments.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible when an attacker who already holds high application privileges sends crafted requests over the network via HTTPS to the Access and security component. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond DRM itself, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 9.1). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full system takeover is possible in Oracle Hyperion Data Relationship Management version 11.2.25.0.000 via a network-exploitable flaw in the Access and Security component. A low-privileged authenticated attacker with HTTP access can, under high-complexity conditions, achieve complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the product is not listed in the CISA KEV catalog; the high attack complexity (AC:H) meaningfully reduces the realistic exploitation probability despite the severe potential impact.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by any low-privileged, network-accessible attacker via HTTP, with high impact across confidentiality, integrity, and availability. The vulnerability resides in the Access and Security component and carries a vendor-assigned CVSS 3.1 base score of 8.8, reflecting low attack complexity and no required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full remote takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by an unauthenticated attacker who can reach the service over the network via TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Access and security component and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch.
Unauthenticated remote compromise of Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) allows network attackers to read, create, modify, or delete all data accessible to the application over HTTP without any credentials. Oracle rates it CVSS 3.1 9.1 and tags it as an authentication bypass, meaning an attacker who can reach the web interface gains full confidentiality and integrity impact over master-data governance records. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Full product takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over TCP, per Oracle's Critical Patch Update advisory (CSPU August 2026). The flaw resides in the Access and security component and yields complete confidentiality, integrity, and availability compromise (CVSS 3.1 base 9.8). No public exploit identified at time of analysis, and it is not currently listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch item.
Oracle Hyperion Data Relationship Management (DRM) version 11.2.23.0.000 exposes its Web Client - Unicode component to unauthenticated remote attackers over HTTP. Exploitation allows complete read access to all DRM-accessible data - which in a master data management context often includes sensitive financial hierarchies and organizational structures - plus the ability to induce a partial denial of service. No public exploit has been identified at time of analysis, but the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivially low attack complexity with no authentication barrier.
Full system takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by an unauthenticated remote attacker over HTTP, with successful exploitation resulting in complete compromise of confidentiality, integrity, and availability. The vendor-assigned CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network reachability without authentication, though the high attack complexity rating indicates non-trivial exploitation conditions that reduce the likelihood of opportunistic mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Oracle Application Testing Suite 13.3.0.1 exposes an authentication bypass that allows an unauthenticated attacker on the same physical network segment to read critical data and perform limited data manipulation. The adjacency requirement (AV:A) constrains the attack surface to attackers who have physical or logical access to the local network segment hosting the affected system, but no credentials or user interaction are needed once that foothold exists. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero privilege requirement make this straightforward to exploit by any actor already on the adjacent network.
Local privilege escalation in Oracle Application Testing Suite 13.3.0.1 enables a low-privileged attacker with the 'Load Testing for Web Apps' application privilege to achieve full system takeover, resulting in complete loss of confidentiality, integrity, and availability. Oracle classifies this as 'easily exploitable' with CVSS 7.8 (High), reflecting low attack complexity and no user interaction requirement once local access is established. No public exploit has been identified at time of analysis, and Oracle issued a fix through the August 2026 Critical Patch Update.
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by a network-adjacent, low-privileged attacker holding the 'Load Testing for Web Apps' privilege over HTTPS. The CVSS 3.1 score of 7.5 (High) reflects total compromise of confidentiality, integrity, and availability, though Oracle classifies this as 'difficult to exploit' (AC:H), implying specific conditions must align for successful attack. No public exploit code and no CISA KEV listing have been identified at time of analysis, and EPSS data was not available in the provided intelligence.
Oracle Application Testing Suite 13.3.0.1 exposes a network-accessible vulnerability allowing low-privileged attackers holding the Load Testing for Web Apps role to achieve unauthorized complete read access to critical data and limited write access through HTTP-based exploitation that requires victim interaction. The attack carries a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle products beyond the testing suite itself. No public exploit code has been identified and CISA KEV listing is absent, though the low attack complexity and network accessibility make this a credible targeted threat for any environment running this specific version.
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by any low-privileged attacker holding the 'Load Testing for Web Apps' role via a network-accessible HTTPS vector. Oracle's own advisory classifies this as 'easily exploitable,' with complete confidentiality, integrity, and availability impact resulting in system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and broad CIA impact make this a credible priority for affected deployments.
Unauthenticated remote compromise of Oracle Application Testing Suite 13.3.0.1 allows a network attacker to read, create, modify, or delete all data accessible to the application over HTTP with no credentials or user interaction. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact (no availability impact), and tagged as an authentication bypass, this is a pre-auth flaw fixed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of PeopleSoft Enterprise FIN Common Objects Brazil 9.1 is achievable by a high-privileged attacker with network access using Oracle's T3 or IIOP protocols. The vulnerability carries a CVSS 3.1 score of 7.2, reflecting complete confidentiality, integrity, and availability impact despite the PR:H prerequisite. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though Oracle's August 2026 Critical Patch Update advisory addresses it.
Full takeover of Oracle Siebel CRM Integration (versions 17.0-26.6) is achievable by a low-privileged authenticated attacker over HTTP, exploiting a flaw in the REST component. The CVSS scope change (S:C) means successful exploitation can pivot beyond the directly targeted service, potentially compromising additional Oracle or backend systems. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog; however, the C:H/I:H/A:H impact triad warrants prioritized patching for organizations running Siebel in enterprise environments.
Remote exploitation of Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to compromise confidentiality, integrity, and availability of the platform when a victim user interacts with a malicious payload delivered over HTTP. Both actively supported versions - 12.2.1.4.0 and 14.1.2.0.0 - are affected, and successful exploitation produces a scope change, meaning impacts can propagate beyond the directly targeted WebCenter Content instance to adjacent products within the Fusion Middleware stack. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a credible threat in internet-exposed deployments.
Oracle Siebel CRM End User versions 17.0 through 26.6 expose a network-exploitable flaw in the Open UI component that, when triggered via a crafted HTTPS interaction, grants a low-privileged attacker full read and write access to critical CRM data - including complete confidentiality and integrity compromise with a documented scope change to additional products. The 'Authentication Bypass' tag reported by Oracle's security team suggests the Open UI layer can be manipulated to circumvent access controls in the context of an authenticated victim's session. No exploit code is publicly available and the vulnerability is not listed in the CISA KEV catalog at the time of analysis.
Full system takeover of Oracle Siebel CRM Deployment (versions 17.0 through 26.6) is achievable by unauthenticated remote attackers via HTTP, targeting the Migration component. The attack requires human interaction from a victim - a social engineering or luring condition that constrains opportunistic exploitation - but successful exploitation results in complete compromise of confidentiality, integrity, and availability of the Siebel CRM Deployment instance. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.
Cross-boundary compromise in Oracle Siebel CRM's Siebel Apps - Self Service module (Helpdesk/Training component, versions 17.0 through 26.6) lets an unauthenticated remote attacker fully read and modify all data accessible to the application after luring a legitimate user into interacting with a crafted HTTP request. Because the CVSS vector carries a scope change (S:C), successful exploitation can significantly impact products beyond Siebel itself, and the vendor/analyst tagging as an 'Authentication Bypass' reinforces the high confidentiality and integrity risk. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.3 base score and network-facing, unauthenticated nature make it a top-tier patch priority.
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allow a remote, unauthenticated attacker to reach the application over HTTP and create, modify, or delete critical data as well as trigger a complete, repeatable crash. Oracle rates this CVSS 9.1 (I:H/A:H, no confidentiality impact), reflecting an easily exploitable network-facing flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch item.
Remote unauthorized data access in Oracle Demand Planning versions 12.1 and 12.2 enables unauthenticated network attackers over HTTP to read all data accessible to the application and perform limited unauthorized write operations, with no authentication, elevated privileges, or user interaction required. Tagged as an authentication bypass by Oracle's own security team, this flaw carries a CVSS 3.1 base score of 8.2, reflecting high confidentiality and low integrity impact with no availability component. No public exploit code has been identified at the time of analysis, though the low attack complexity and complete absence of authentication barriers make this a straightforward target for automated or opportunistic exploitation once a proof-of-concept surfaces.
Privilege-leveraging compromise of Oracle Demand Planning (Internal Operations component) in Oracle Supply Chain / E-Business Suite versions 12.1 and 12.2 lets a low-privileged attacker with HTTP network access read and modify all data reachable by the module. Because the CVSS scope is Changed (S:C), successful attacks can extend impact beyond Demand Planning to additional connected products. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the 9.6 base score and low attack complexity make it a high-priority patch.
Oracle Loans 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes its Internal Operations component to network-based exploitation by low-privileged authenticated attackers over HTTP. Successful exploitation grants unauthorized ability to create, delete, or modify critical data across all Oracle Loans accessible records, and can induce a partial denial of service against the application. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and broad affected version range (12.2.3-12.2.15) make this a notable priority for Oracle EBS deployments.
Oracle Loans within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes all loan records to network-authenticated low-privileged users through an authorization control failure in the Internal Operations component. A low-privileged attacker with HTTP network access can read the complete Oracle Loans dataset and perform unauthorized inserts or updates on a subset of that data, without requiring elevated credentials or any victim interaction. No public exploit code has been identified at time of analysis, and Oracle has addressed this vulnerability in the August 2026 Critical Patch Update.
Local privilege escalation with scope change in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged authenticated user on the host system to bypass security controls within the Security component, achieving complete unauthorized read and write access to all application data. The CVSS scope change (S:C) means successful exploitation can cascade into additional Oracle products sharing the same infrastructure, amplifying the blast radius beyond the immediate application. No public exploit code or CISA KEV listing exists at time of analysis; the vulnerability was disclosed through Oracle's Critical Security Patch Update for August 2026.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.25.0.000 enables low-privileged authenticated host users to fully compromise the application's confidentiality and data integrity via a flaw in the Security component. Critically, the CVSS scope change indicator (S:C) signals that successful exploitation may cascade beyond the HFM application boundary to impact additional co-hosted Oracle products. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of required user interaction make exploitation straightforward for any attacker holding a valid local system account.
Unauthorized data access in Oracle Financials for EMEA (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-accessible attacker to exfiltrate critical financial data and perform limited data manipulation via HTTP. The 'Authentication Bypass' tag from ENISA EUVD suggests the flaw in the Internal Operations component permits privilege escalation beyond what the authenticated identity should authorize - effectively letting a standard user reach data reserved for higher roles. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across a financial ERP increase urgency for EMEA-facing Oracle deployments.
Authenticated low-privileged network exploitation of Oracle Financials for Asia/Pacific (versions 12.2.3-12.2.15) enables unauthorized creation, deletion, or modification of critical financial data, with partial read access to additional records. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is reachable over HTTP without user interaction. No public exploit or active KEV listing has been identified at time of analysis, though Oracle classifies it as 'easily exploitable,' and the 'Authentication Bypass' tag suggests the low-privilege requirement may be bypassed or trivially satisfied under certain conditions.
Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to compromise the Internal Operations component via HTTP, resulting in full read access to and arbitrary creation, modification, or deletion of all iRecruitment-accessible data. Tagged as an Authentication Bypass class vulnerability, the flaw enables an attacker with minimal account privileges to exceed their authorization boundary - likely bypassing object-level access controls within the HR recruitment workflow. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; remediation is available via Oracle's Critical Security Patch Update (CPU) for August 2026.
Full system takeover in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged attacker with HTTP network access, exploiting a flaw in the Security component. Oracle's own description characterizes the outcome as complete compromise, with CVSS 3.1 confirming full confidentiality, integrity, and availability impact (C:H/I:H/A:H), making this more severe than the accompanying 'Information Disclosure' tag suggests. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data access and partial data manipulation in Oracle Landed Cost Management (versions 12.2.3 through 12.2.15) is exploitable by low-privileged, network-accessible attackers via HTTP, with no user interaction required. Tagged as an Authentication Bypass, the vulnerability in the Internal Operations component allows an authenticated low-privilege user to exceed their authorization, gaining complete read access to all data accessible by the module and limited write/insert/delete capability. No public exploit has been identified at time of analysis and the flaw is not listed in the CISA KEV catalog.
Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable via HTTP due to a failure in the Security component's authentication enforcement. Tagged as an authentication bypass, the flaw allows any network-reachable attacker with no credentials or user interaction to access all data within the application's scope, carrying a CVSS 3.1 score of 7.5 (High) reflecting complete confidentiality compromise. No public exploit code or confirmed active exploitation has been identified at the time of analysis, though the low attack complexity lowers the practical barrier for capable adversaries who can reach the service.
Oracle Process Manufacturing Systems (OPM), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes a high-severity authenticated network vulnerability in the Internal Operations component that allows low-privileged attackers to both read and manipulate critical data. The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impact with no availability impact, exploitable over HTTP without user interaction. Tagged as an Authentication Bypass, this vulnerability is described as 'easily exploitable,' raising the effective risk for any organization running unpatched OPM installations; no public exploit or CISA KEV listing has been identified at time of analysis.
Full system takeover is possible in Oracle Process Manufacturing Systems (OPM), an Oracle E-Business Suite component, via a network-accessible flaw in the Internal Operations sub-component affecting versions 12.2.3 through 12.2.15. A low-privileged attacker operating over HTTP can, under high-complexity conditions, compromise confidentiality, integrity, and availability simultaneously - Oracle's own language is 'takeover of Oracle Process Manufacturing Systems.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope of impact makes this a priority patch target for manufacturing-sector organizations running Oracle EBS. Oracle addressed this in the Critical Patch Update for August 2026.
Complete data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a network-accessible, low-privileged authenticated attacker to bypass security controls within the application's Security component and gain unauthorized read access to all data the application can reach. The scope change (S:C) in the CVSS vector signals that successful exploitation may expose data beyond the HFM instance itself, potentially impacting other integrated Oracle Hyperion suite components. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low attack complexity and the Authentication Bypass tag make this a practical risk for any organization running this CPM platform.
Unauthorized data disclosure in Oracle MES for Process Manufacturing (versions 12.2.3-12.2.15) allows a low-privileged attacker with network HTTP access to bypass internal authorization controls and gain complete access to all data accessible by the MES component. The scope change (S:C in CVSS) means successful exploitation can cascade into other Oracle E-Business Suite products, amplifying the confidentiality impact beyond the MES module itself. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; however, the 'Authentication Bypass' tag, low attack complexity, and no required user interaction make this a credible risk in exposed enterprise EBS deployments.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 exposes critical financial data to unauthenticated network attackers via HTTPS. The Security component flaw - tagged explicitly as an authentication bypass by Oracle - allows complete read and write access to all data within the application, including sensitive financial consolidation records. No public exploit or CISA KEV listing is confirmed at time of analysis, and the high attack complexity (AC:H) limits opportunistic mass exploitation, but the unauthenticated network vector and dual high-severity impact on both confidentiality and integrity make this a serious priority for organizations running this version.
Unauthenticated remote information disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 exposes the complete data set accessible to the application via HTTP. The Security component contains an authentication bypass weakness that allows a network-adjacent attacker with no credentials to retrieve critical financial data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to target.
Full system takeover in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, network-authenticated attacker via the SQL interface targeting the Security component, with successful exploitation yielding complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 8.8 reflects low attack complexity and no user interaction required, making exploitation straightforward for any attacker holding valid low-level credentials. No public exploit code has been identified and no CISA KEV listing is present at time of analysis, though the low barrier to exploitation warrants urgent patching for organizations running this version.
Full system takeover of Oracle Call Center Technology (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged attacker with network access over HTTP targeting the Internal Operations component. The vulnerability is rated 7.2 CVSS 3.1 with complete Confidentiality, Integrity, and Availability impacts, meaning successful exploitation yields effective control of the affected instance. No public exploit code has been identified at time of analysis, and the requirement for high-privilege credentials is the primary limiting factor constraining real-world exposure.
Oracle Hyperion Financial Management 11.2.25.0.000 is vulnerable to full system takeover via a SQL-based attack against its Security component, exploitable by any low-privileged network-authenticated user. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability with no user interaction required beyond holding basic credentials. Oracle disclosed this as part of its August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL-based network exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged authenticated attacker to fully compromise the application, achieving complete confidentiality, integrity, and availability impact. The vulnerability resides in the Security component and is exploitable with low attack complexity and no user interaction required, making it a reliable attack path for any threat actor holding valid credentials. No public exploit code or active exploitation has been identified at time of analysis.
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated attacker with HTTP network access to fully compromise the application. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and per the CVSS vector requires no privileges or user interaction, making it a prime candidate for opportunistic exploitation. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; despite the Oracle-supplied 'Information Disclosure' tag, the CVSS I:H/A:H metrics and 'takeover' language indicate impact well beyond disclosure.
Oracle Financials for EMEA (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to gain unauthorized read access to critical financial data and perform limited unauthorized write operations via HTTP. The vulnerability resides in the Internal Operations component and, despite requiring an existing account, carries a High confidentiality impact given the sensitivity of EMEA financial records involved. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the low attack complexity and absence of user-interaction requirements make this a realistic post-authentication privilege escalation path.
Oracle Internet Procurement Connector in E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated network attackers to fully compromise data confidentiality and integrity within the connector via HTTP. Tagged as an authentication bypass by ENISA EUVD (EUVD-2026-61766), the flaw enables unauthorized creation, modification, deletion, and exfiltration of all connector-accessible data with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's own characterization as 'easily exploitable' combined with low attack complexity and network accessibility make this a credible remediation priority for organizations running Oracle E-Business Suite.
Full system takeover of Oracle Call Center Technology - a component of Oracle E-Business Suite - is achievable by unauthenticated remote attackers via HTTP across versions 12.2.3 through 12.2.15, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The high attack complexity (AC:H) designation indicates that exploitation requires satisfying non-trivial preconditions beyond mere network reachability, but no authentication or user interaction is necessary, keeping the attack surface entirely external. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover is achievable in Oracle Call Center Technology (versions 12.2.3-12.2.15) by a low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The vendor describes this as 'easily exploitable' and confirms full Confidentiality, Integrity, and Availability compromise - consistent with a CVSS 8.8 High rating and system takeover outcome. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal privilege threshold lower the bar for exploitation significantly. Notably, the vulnerability tag 'Information Disclosure' understates the confirmed impact scope, which extends to full takeover.
Oracle Call Center Technology versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes a flaw in the Internal Operations component that allows a low-privileged authenticated network attacker to fully compromise the affected system via HTTP. The vendor-assigned CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability - consistent with the described 'takeover' outcome. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Oracle Purchasing versions 12.2.5 through 12.2.15 within Oracle E-Business Suite expose an authorization bypass flaw in the Internal Operations component, allowing any authenticated low-privileged network user to gain complete read access to all purchasing data and perform unauthorized creation, deletion, or modification of critical records. Tagged as an Authentication Bypass by ENISA EUVD-2026-61762, the vulnerability is exploitable over HTTP with no user interaction and low attack complexity, making it a high-priority remediation target in Oracle EBS deployments. No public exploit code has been identified and the vulnerability is not currently listed in the CISA KEV catalog at time of analysis.
Unauthenticated remote data disclosure in Oracle Scripting (Oracle E-Business Suite component: Internal Operations) affects all supported releases from 12.2.3 through 12.2.15. Exploitation over HTTP requires no credentials, no user interaction, and no special configuration - consistent with the Authentication Bypass tag reported alongside this vulnerability. Successful exploitation grants an attacker unauthorized read access to all data accessible within Oracle Scripting, including potentially critical business data. No public exploit or active exploitation has been confirmed at time of analysis.
Oracle Scripting versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes an Internal Operations component vulnerability allowing low-privileged, network-based attackers to achieve full confidentiality and integrity compromise of all Scripting-accessible data, plus partial service disruption. The "Authentication Bypass" tag from the intelligence feed creates a notable tension with the CVSS PR:L assignment - if the bypass allows unauthenticated users to obtain a low-privilege session context, the effective attack surface is wider than the CVSS vector alone suggests. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H rating constrains opportunistic exploitation.
Oracle Scripting within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible vulnerability in the Internal Operations component, allowing a low-privileged authenticated attacker to gain complete unauthorized read access to all Oracle Scripting-accessible data and limited write access via HTTP. The vulnerability carries an Authentication Bypass tag, indicating the flaw permits privilege escalation beyond the attacker's intended authorization level within the module. No public exploit code or active exploitation has been identified at time of analysis, though Oracle itself characterizes the vulnerability as easily exploitable, elevating urgency despite the absence of a CISA KEV listing.
Unauthorized data access in Oracle Call Center Technology (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged remote attacker to gain complete read access to all data accessible by the application and limited write capability via HTTP, with a confirmed scope change enabling cascading impact on additional E-Business Suite components. The EUVD tags this as an Authentication Bypass, suggesting the Internal Operations component fails to enforce sufficient authorization boundaries for low-privilege accounts despite requiring initial authentication. No public exploit has been identified at time of analysis; this vulnerability was disclosed as part of Oracle's Critical Patch Update for August 2026.
Oracle E-Business Tax versions 12.2.3 through 12.2.15 allows a low-privileged local attacker to compromise data integrity and trigger a repeatable denial-of-service condition in the Internal Operations component. Successful exploitation enables unauthorized creation, deletion, or modification of critical tax data, and can cause the application to hang or crash completely, disrupting core business tax processing workflows. No public exploit has been identified at time of analysis, though the low complexity and low privilege requirements make this an accessible target for any authenticated local user on the affected infrastructure.
Unauthorized data access and modification in Oracle Project Planning and Control (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged authenticated network attacker via HTTP, targeting the Change Management component. The vulnerability is tagged as an authentication bypass, suggesting an attacker with minimal credentials can exceed their authorized access level to read or manipulate critical project data without any user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle rates this as easily exploitable with a CVSS 8.1, making it a high-priority patching target in enterprise environments running E-Business Suite.
Unauthorized data access and modification in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3-12.2.15) is achievable by a high-privileged remote attacker via HTTP, with exploitation triggering a scope change that can affect systems beyond the directly targeted component. The flaw resides in the Regression Testing component and carries CVSS 3.1 Base Score 7.7, reflecting high confidentiality and integrity impacts. No public exploit or CISA KEV active-exploitation listing has been identified at time of analysis.
Unauthorized data manipulation in Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical financial records via HTTP, with secondary read and partial availability impacts. The vulnerability resides in the Internal Operations component and requires only a valid low-privilege account - no elevated rights or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high integrity impact make this a significant risk for any organization running Oracle EBS financials.
Full system takeover in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged, network-capable attacker exploiting a flaw in the Regression Testing component over HTTP. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, with a scope change indicating that impact can cascade into adjacent Oracle EBS components beyond the directly affected module. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.
Unauthorized data access in Oracle Flow Manufacturing 12.2.3 through 12.2.15 allows network-authenticated low-privileged users to fully compromise confidentiality of all accessible manufacturing data and perform limited unauthorized data modification via HTTP. Tagged as an authentication bypass by the reporting source, this suggests the vulnerability enables low-privileged users to circumvent authorization controls within Oracle E-Business Suite's Internal Operations component, exposing critical operational data beyond their intended access scope. No public exploit has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Security Patch Update.
Oracle SDP Number Portability versions 12.2.3 through 12.2.15, a telecommunications management component of Oracle E-Business Suite, exposes a local privilege-abuse flaw in its Internal Operations component that enables high-privileged insiders or post-breach actors to compromise the affected system. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, read access to a subset of accessible data, and the ability to cause a partial denial of service - with a scope change (S:C) extending potential impact to additional Oracle products co-hosted in the same E-Business Suite environment. No public exploit code exists and this CVE does not appear in the CISA KEV catalog at time of analysis; the CVSS 3.1 base score of 7.3 reflects the scope change rather than inherent exploitability from the perimeter.
Unauthenticated remote data exposure in Oracle SDP Number Portability (E-Business Suite versions 12.2.3 through 12.2.15) allows a network attacker over HTTP to access critical or all data managed by the component without any credentials. The vulnerability is tagged as an Authentication Bypass in the Internal Operations component, consistent with the PR:N/AC:L CVSS vector indicating trivial exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity significantly lowers the bar for opportunistic abuse.
Oracle Purchasing within E-Business Suite versions 12.2.3 through 12.2.15 exposes a local privilege escalation in the Internal Operations component that yields full application takeover. A low-privileged attacker with OS-level logon to the infrastructure running Oracle Purchasing can exploit this flaw without any additional complexity or user interaction, achieving complete confidentiality, integrity, and availability compromise of the Purchasing module. No public exploit has been identified at time of analysis, but Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' materially elevating practical risk for organizations running EBS in shared or multi-tenant server environments.
Oracle Purchasing, a procurement module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes a high-severity network-exploitable vulnerability in its Internal Operations component that enables full system takeover - complete loss of confidentiality, integrity, and availability. Oracle itself classifies this as 'easily exploitable' despite the high-privilege requirement (PR:H), meaning that once an attacker possesses elevated credentials, exploitation presents no meaningful technical barrier. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the full CIA impact and low attack complexity make this a priority patching target for any organization running internet-exposed or broadly network-accessible Oracle EBS deployments.
Oracle General Ledger versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, contains an authentication bypass weakness in the Internal Operations component that allows a highly privileged local attacker to gain unauthorized read and write access to critical financial ledger data, with a scope change that may cascade impact to additional Oracle EBS products. The attack requires local infrastructure logon and high attack complexity, substantially constraining the realistic attacker population to insiders or those who have already compromised the host environment. No public exploit code has been identified and Oracle has addressed this through the August 2026 Critical Patch Update.
Full takeover of Oracle Applications Platform Engineering (Oracle E-Business Suite versions 12.2.3-12.2.15) is achievable by unauthenticated remote attackers via the Oracle Net protocol by exploiting a flaw in the Valid Session component. The CVSS 3.1 score of 8.1 reflects complete confidentiality, integrity, and availability impact, tempered by a high attack complexity (AC:H) that limits opportunistic mass exploitation. No public exploit code or CISA KEV listing exists at time of analysis, though the unauthenticated network vector over Oracle Net makes this a high-priority patch target for any internet-adjacent EBS deployment.
Full system takeover of Oracle Yard Management (E-Business Suite component, versions 12.2.3 through 12.2.15) is achievable by any low-privileged authenticated user over HTTP, with the vendor-reported CVSS impact of C:H/I:H/A:H indicating complete compromise of confidentiality, integrity, and availability. The affected subcomponent is Internal Operations, and Oracle addressed this flaw in the August 2026 Critical Patch Update. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Oracle Transportation Execution (E-Business Suite versions 12.2.3 through 12.2.15) exposes a network-exploitable integrity flaw in its Internal Operations component that allows a low-privileged authenticated attacker to gain unauthorized create, delete, and modify access to critical data - including a partial confidentiality breach - with a scope change impacting additional Oracle EBS products. The attack requires human interaction from a victim other than the attacker, consistent with a client-side injection pattern (e.g., stored XSS or similar), amplified by the 'Authentication Bypass' tag suggesting privilege escalation from low to higher access tiers. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.