Oracle
Monthly
Unauthorized data manipulation in Oracle Telecommunications Billing Integrator versions 12.2.3 through 12.2.15 allows unauthenticated network attackers to compromise critical data integrity via crafted HTTP requests, requiring only victim interaction to trigger. The CVSS scope change (S:C) indicates successful exploitation can cascade into other Oracle E-Business Suite components beyond the directly targeted module, amplifying the overall impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this vulnerability through its August 2026 Critical Patch Update.
Full system takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by any low-privileged authenticated user over HTTP, with no additional complexity required. The Server component is vulnerable to exploitation that results in complete compromise of confidentiality, integrity, and availability - Oracle's own description uses the word 'takeover'. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low bar to exploitation (PR:L, AC:L, AV:N) makes this a high-priority patching target for any organization running this Oracle Hyperion version.
Unauthorized data access and partial integrity compromise in Oracle Service Fulfillment Manager (E-Business Suite Fulfillment Engine component) affects all releases from 12.2.3 through 12.2.15. A low-privileged network attacker can, after inducing a victim user to interact with a crafted payload delivered over HTTP, achieve complete confidentiality loss of all data accessible to the application and limited unauthorized write access - with confirmed scope change affecting additional EBS products. No public exploit code has been identified at time of analysis, and Oracle has addressed this vulnerability in the August 2026 Critical Patch Update. The Authentication Bypass tag warrants verification, as the provided CVSS vector assigns PR:L rather than PR:N, suggesting privilege escalation within the session rather than a full authentication bypass.
Oracle Service Contracts in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in its Internal Operations component reachable over HTTP without credentials, enabling unauthorized full read and write access to critical service contract data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impact, moderated by high attack complexity (AC:H) that prevents trivial mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass nature of the flaw and the sensitivity of contract data make this a meaningful target for motivated adversaries with access to the EBS application layer.
Oracle Labor Distribution versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, allows a low-privileged network attacker to bypass internal authorization controls via HTTP, resulting in complete unauthorized read and write access to critical labor and payroll cost distribution data. The vendor characterizes this as 'easily exploitable,' and the 'Authentication Bypass' tag indicates that a standard EBS account holder can escalate beyond their assigned access level within the Internal Operations component. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and high dual confidentiality and integrity impact make this a high-priority item in the August 2026 Oracle CPU.
Full takeover of Oracle Proposals (Oracle E-Business Suite component) is achievable by a high-privileged, network-adjacent attacker over HTTP, resulting in complete compromise of confidentiality, integrity, and availability. Affected deployments span versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, a widely deployed enterprise ERP platform. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.
Oracle iSupplier Portal versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes an authentication bypass in the Internal Operations component that allows unauthenticated network attackers to fully compromise supplier data confidentiality and integrity via HTTP. Successful exploitation grants complete read access to all iSupplier Portal data and the ability to create, delete, or modify critical data records - high-value targets in supply chain environments. Oracle patched this in the August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis, though the AC:H rating indicates non-trivial but achievable exploitation conditions.
Unauthorized data access and modification in Oracle Customer Care (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by network-authenticated low-privileged attackers through the Internal Operations component via HTTP, with successful exploitation requiring victim interaction and producing a scope change that can compromise additional Oracle E-Business Suite components. The vulnerability carries a CVSS 3.1 score of 8.7, reflecting high confidentiality and integrity impacts with a cross-component blast radius. Oracle's August 2026 Critical Patch Update confirms the issue; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Unauthenticated remote attackers can access all data within Oracle iSupplier Portal 12.2.3 through 12.2.15 via a trivially exploitable HTTP flaw in the Internal Operations component, with no credentials, no user interaction, and no special configuration required. The 'Authentication Bypass' tag indicates that access controls protecting internal operations endpoints can be circumvented entirely over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity makes opportunistic exploitation realistic if portal instances are internet-facing.
Oracle Warehouse Management versions 12.2.3 through 12.2.15 within Oracle E-Business Suite allows low-privileged network-authenticated attackers to corrupt, delete, or create critical warehouse data and partially disrupt service availability over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms easy exploitability requiring only a low-privilege account and HTTP connectivity - no user interaction or elevated rights are needed. No public exploit code or CISA KEV listing has been identified at time of analysis; the August 2026 Oracle Critical Patch Update references a fix.
Unauthenticated remote access to critical HR data is possible in Oracle HCM Common Architecture (Knowledge Integration component) across versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, exploitable over HTTP without credentials or user interaction. Successful exploitation yields full read access to all HCM-accessible data and partial write capability (insert/update/delete) against some HCM data stores, as confirmed by Oracle's own CVSS breakdown (C:H, I:L). Tagged as an authentication bypass by Oracle's security team, this represents a significant exposure for any organization running HCM within a network-reachable deployment. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote data exposure in Oracle Warehouse Management (versions 12.2.3 through 12.2.15) allows any network-accessible attacker to read critical warehouse management data via HTTP without credentials. Tagged as an authentication bypass in the Internal Operations component, this vulnerability provides complete read access to all data within the WMS module's scope. No public exploit code or CISA KEV listing has been identified at time of analysis, though the trivial attack complexity (AC:L, PR:N) elevates practical risk relative to the absence of observed exploitation.
Unauthorized data disclosure in Oracle Warehouse Management (Oracle E-Business Suite component: Internal Operations) allows a low-privileged authenticated attacker with HTTPS network access to bypass authorization controls and obtain critical or complete WMS data across versions 12.2.3 through 12.2.15. The CVSS scope change (S:C) is confirmed by Oracle's advisory, meaning successful exploitation can propagate to additional Oracle EBS products deployed in the same instance - amplifying the data exposure beyond WMS itself. No public exploit code and no CISA KEV listing are identified at time of analysis; the 'Authentication Bypass' tag combined with a PR:L vector indicates this is an authorization bypass for credentialed users rather than a fully unauthenticated flaw.
Oracle Warehouse Management versions 12.2.3 through 12.2.15 - a component of Oracle E-Business Suite - exposes a high-severity vulnerability in its Internal Operations component allowing low-privileged, network-authenticated attackers to compromise confidentiality, integrity, and availability via HTTP. Successful exploitation enables unauthorized read and write access to critical warehouse management data, including creation, deletion, and modification of records, alongside a partial denial of service. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data access and partial denial of service affect Oracle General Ledger versions 12.2.3 through 12.2.15, a core financial management component of Oracle E-Business Suite. A low-privileged, network-authenticated attacker can exploit the Internal Operations component via HTTP to gain complete read access to all Oracle General Ledger data, perform unauthorized insert/update/delete operations on a subset of that data, and cause a partial availability disruption. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Oracle Operations Intelligence, the Daily Business Intelligence component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, contains a network-exploitable vulnerability that allows a low-privileged authenticated attacker to achieve full takeover - encompassing complete loss of confidentiality, integrity, and availability - via crafted HTTP requests. The vendor-assigned CVSS 3.1 score of 7.5 reflects high attack complexity (AC:H), tempering immediacy despite the severe impact ceiling. No public exploit code and no CISA KEV listing have been identified at time of analysis, indicating this is not currently subject to widespread opportunistic exploitation.
Oracle Risk Management versions 12.2.3 through 12.2.15 in Oracle E-Business Suite exposes critical data to low-privileged authenticated attackers over HTTP via a flaw in the Internal Operations component, tagged as an authentication bypass. A successful attack grants full unauthorized read access to all Risk Management data and the ability to create, delete, or modify critical records. No public exploit or CISA KEV listing has been identified at this time, but the low attack complexity and broad version range make this a high-priority patching target for Oracle EBS deployments.
Full takeover of Oracle Risk Management (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated user over HTTP, with no interaction from other parties required. The CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability impact - Oracle's own advisory characterizes the outcome as system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a high-priority patch target for Oracle EBS deployments.
Unauthorized data access in Oracle Order Management's Product Diagnostic Tools component allows low-privileged authenticated attackers over HTTP to compromise confidentiality of critical order data and perform limited data manipulation, with a confirmed scope change that can extend impact to adjacent Oracle E-Business Suite components. Affected deployments span a wide version range, 12.2.3 through 12.2.15, and are addressed in Oracle's Critical Patch Update for August 2026. No public exploit code has been identified at time of analysis, though the Authentication Bypass tag associated with this CVE signals a potentially exploitable access control weakness in the diagnostic sub-component.
Unauthenticated remote disclosure of sensitive financial data affects Oracle Hyperion Financial Reporting 11.2.25.0.000 via HTTP, with no credentials required to trigger the flaw. Tagged as an authentication bypass, the vulnerability allows a network-adjacent attacker to read critical data or gain complete access to all data accessible by the Financial Reporting server component. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's own description characterizes it as 'easily exploitable.'
Full application takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by a low-privileged attacker with local OS logon access to the server host, requiring no user interaction and resulting in complete loss of confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects an easily exploitable local flaw in the Server component, with all three impact dimensions rated High. No public exploit code or active exploitation has been identified at time of analysis, though the severity of the described outcome - full application takeover - warrants prompt remediation.
Full system takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by unauthenticated remote attackers over HTTP without user interaction. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates the attack is network-accessible and requires no credentials, but high attack complexity (AC:H) implies specific preconditions - such as race conditions, timing requirements, or environmental factors - that prevent trivial mass exploitation. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though full CIA impact at CVSS 8.1 makes this a high-priority remediation target for organizations running this EPM platform.
Full takeover of Oracle Customers Online (E-Business Suite component) is achievable by any low-privileged authenticated user over HTTP, across versions 12.2.3 through 12.2.15. The Customer Tab component contains a flaw that, when exploited, yields complete confidentiality, integrity, and availability compromise - Oracle's own description uses the word 'takeover.' No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad authentication baseline (any portal account qualifies) make this a critical patching priority for Oracle EBS deployments.
Oracle Hyperion Financial Reporting version 11.2.25.0.000 is affected by an authentication bypass vulnerability exposing critical financial data to unauthenticated remote attackers over HTTP. Successful exploitation, which requires human interaction from a victim user, grants unauthorized read access to all accessible financial data as well as the ability to create, modify, or delete critical records. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Authentication Bypass tag and CVSS 8.1 score highlight significant risk to corporate financial data confidentiality and integrity.
Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows an unauthenticated attacker with HTTP network access to fully compromise the Server component, yielding complete confidentiality, integrity, and availability loss. Rated CVSS 9.8 and flagged as 'easily exploitable' by Oracle, though tagged as Information Disclosure in EUVD; no public exploit identified at time of analysis and it is not listed in CISA KEV. This is part of Oracle's August 2026 Critical Patch Update and should be treated as high-priority given the unauthenticated network vector.
Full takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by an unauthenticated remote attacker via HTTP, according to Oracle's August 2026 Critical Security Update. The vulnerability resides in the Server component and, if successfully exploited, results in complete compromise of confidentiality, integrity, and availability of the affected instance. No public exploit code or CISA KEV listing has been identified at time of analysis; the High attack complexity rating reduces the likelihood of opportunistic mass exploitation but does not eliminate targeted risk.
Unauthenticated remote exploitation of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows network attackers to obtain complete access to all financial reporting data and cause a partial denial of service via HTTPS. The vulnerability resides in the Server component and is tagged as an authentication bypass, meaning no credentials are required to trigger the flaw against a network-exposed instance. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a high-priority patch target for any organization running this specific version.
Full takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by any low-privileged network attacker communicating via HTTPS, with complete confidentiality, integrity, and availability impact confirmed by a CVSS 3.1 score of 8.8. The vulnerability resides in the Server component and requires only minimal authenticated access, presenting a low barrier for insider threat or compromised-credential scenarios. Oracle formally disclosed and addressed this issue in its August 2026 Critical Security Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote unauthenticated compromise of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an attacker with network access via the Java RMI interface to read, create, modify, or delete all data accessible to the application. Carrying a CVSS 3.1 base score of 9.1 and tagged as an authentication bypass, the flaw yields full confidentiality and integrity compromise without any credentials or user interaction, though it does not affect availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an unauthenticated attacker with only HTTP network reach to fully compromise the application, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact reflects complete product compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch.
Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an unauthenticated attacker with only HTTP network access to fully compromise the application, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' At time of analysis there is no public exploit identified and no CISA KEV listing, but the trivial exploitability and complete-compromise outcome make it a high patch priority.
Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 exposes critical financial data to full unauthorized read and write access through an authorization bypass flaw in its Deployment component, exploitable over HTTP by any low-privileged authenticated user. The dual high-severity impacts - complete confidentiality loss and full integrity compromise covering unauthorized creation, deletion, and modification of all PCM-accessible data - make this a significant threat to enterprise financial management environments. No public exploit has been identified at time of analysis, and CISA KEV listing is not confirmed.
Full system takeover is achievable in Oracle Enterprise Manager for Systems Infrastructure (versions 13.5 and 24.1) via the Storage Server Management component, exploitable by any low-privileged attacker with HTTP network access. The CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact confirms complete compromise of the affected OEM instance - not merely information disclosure despite the 'Information Disclosure' tag in the source intelligence. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though Oracle's opaque CPU advisory format historically delays exploit development rather than preventing it.
Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 exposes critical financial planning data to low-privileged network attackers through its Deployment component over HTTP. Tagged as an authentication bypass, the vulnerability permits a credentialed user to gain complete read access to all data accessible within the application and perform limited unauthorized insert, update, or delete operations, without requiring user interaction or elevated privileges beyond an initial low-level account. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity (AC:L) means a skilled attacker with any valid credential could exploit this reliably.
Full system takeover in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by a high-privileged, network-authenticated attacker via HTTP against the Deployment component, resulting in complete confidentiality, integrity, and availability compromise. Disclosed as part of Oracle's August 2026 Critical Security Update (CPU) and registered in ENISA EUVD (EUVD-2026-61690), with no confirmed active exploitation or public exploit code at time of analysis. The PR:H prerequisite significantly constrains the attacker population to insiders, compromised administrator accounts, or actors with prior lateral movement to admin-level access.
Data integrity and availability compromise in Oracle Autonomous Health Framework's Trace File Analyzer component affects versions 26 through 26.5.2, permitting high-privileged local attackers to corrupt or destroy critical data and induce a complete denial-of-service condition. Notably, the attack carries a scope change, meaning successful exploitation can cascade to affect additional co-located Oracle products beyond AHF itself. No public exploit code or active exploitation has been identified at time of analysis; Oracle has issued remediation through its August 2026 Critical Patch Update.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by any low-privileged attacker with network access over HTTP targeting the Deployment component. The combination of a high confidentiality impact and an 'Authentication Bypass' tag from EUVD suggests the flaw may allow authenticated users to escalate access beyond their authorization level, potentially exposing all financial and operational data managed by the platform. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has addressed this in the August 2026 Critical Security Patch Update.
Local privilege escalation and denial-of-service in Oracle Autonomous Health Framework's Trace File Analyzer component affects versions 26 through 26.5.2, enabling low-privileged infrastructure users to corrupt or destroy critical data and crash the framework with scope change to dependent Oracle products. The CVSS 3.1 score of 8.4 reflects ease of exploitation once local access is obtained, with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis; this disclosure originates from Oracle's Critical Security Patch Update for August 2026.
Unauthenticated data compromise in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 (Deployment component) lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the application. Tagged as an authentication bypass and rated CVSS 3.1 9.1, it was reported by Oracle and addressed in the August 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Teleservice (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged attacker with network access via HTTP, exploiting a flaw in the Service Request Form component. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation is straightforward - no elevated privileges, no user interaction, and no complex preconditions beyond a valid low-privilege account. Oracle's own advisory characterizes the outcome as complete product takeover, implying full loss of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data exposure in Oracle Autonomous Health Framework (Trace File Analyzer component) allows a low-privileged network attacker to gain complete read access to critical data and limited write capability across the framework and potentially connected Oracle products due to a scope-changing exploit path. Affected versions span the entire 26.x release family through 26.5.2, making this a broad exposure across current deployments. No public exploit has been identified at time of analysis, but the low attack complexity, absence of user interaction, and scope-change characteristic elevate real-world priority beyond what the raw CVSS alone conveys.
Oracle Advanced Inbound Telephony versions 12.2.3 through 12.2.15 exposes its Internal Operations component to low-privileged HTTP attackers who can achieve full read access to sensitive telephony data, limited data manipulation, and partial denial of service. The 'Authentication Bypass' tag suggests that while a valid low-privilege account is required to initiate the attack, the Internal Operations component fails to enforce additional authorization controls, allowing privilege escalation within the application. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was disclosed by Oracle's own security team via the August 2026 Critical Patch Update.
Full takeover of Oracle MySQL Cluster is achievable by an unauthenticated remote attacker over HTTP across three active release trains: 8.0.0-8.0.48, 8.4.0-8.4.11, and 9.7.0-9.7.2. The attack carries high complexity and requires human interaction from a victim user, but successful exploitation yields complete confidentiality, integrity, and availability compromise of the cluster. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data exposure in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible by the application, with scope change enabling lateral data exposure across additional Oracle Hyperion ecosystem products. The vulnerability resides in the Deployment component and is exploitable over HTTP without user interaction. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the Authentication Bypass tag from ENISA EUVD signals a likely authorization control weakness that warrants priority patching in enterprise environments.
Unauthenticated remote exploitation of Oracle Advanced Inbound Telephony (versions 12.2.3-12.2.15) within Oracle E-Business Suite allows a network attacker to perform unauthorized creation, deletion, or modification of critical telephony data and cause a partial denial of service via HTTPS. The CVSS 3.1 base score of 8.2 reflects high integrity impact and low availability impact with no confidentiality exposure. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis.
Unauthenticated remote exploitation of Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 allows network attackers to gain complete read access to all application-managed financial data via HTTP, with no credentials or user interaction required. The vulnerability resides in the Deployment component and carries a CVSS scope change, meaning successful exploitation may expose data from additional interconnected Oracle Hyperion products sharing the same infrastructure. No public exploit code or active exploitation has been confirmed, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N profile makes this trivially repeatable once an attacker identifies the vulnerable endpoint.
Full system compromise of Oracle Bills of Material - a component of Oracle E-Business Suite - across versions 12.2.3 through 12.2.15 is achievable by a network-reachable, low-privileged attacker via crafted HTTP requests, with Oracle confirming potential for complete takeover covering confidentiality, integrity, and availability. The scope change designation in the CVSS vector indicates that successful exploitation can cascade beyond the Bills of Material module to affect additional Oracle E-Business Suite components. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Oracle has issued a patch in the August 2026 Critical Patch Update.
Full takeover of Oracle iSetup 12.2.3 through 12.2.15 is achievable by a low-privileged, network-adjacent attacker via HTTP, targeting the General Ledger Update Transform and Reports component within Oracle E-Business Suite. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected instance. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the full-takeover impact (C:H/I:H/A:H) and network accessibility elevate the urgency of patching relative to other Oracle CPU entries in this cycle.
Full takeover of Oracle Sales Foundation (E-Business Suite 12.2.3-12.2.15) is achievable by a low-privileged network attacker via HTTP, targeting the Security API component. The vulnerability is rated CVSS 8.8 with high impact across confidentiality, integrity, and availability, indicating the attacker can gain complete control of the affected application. No public exploit or CISA KEV listing has been identified at time of analysis, though Oracle's classification as 'easily exploitable' elevates urgency for patching.
Unauthorized data access and modification in Oracle Sales Foundation (Oracle E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The vulnerability resides in the Security API component and is tagged as an authentication bypass, enabling an attacker to read, create, delete, or modify critical data across the entire Sales Foundation dataset. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog, though the low exploitation complexity makes this a realistic near-term threat for exposed deployments.
Full system takeover of Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated attacker with HTTP network access, resulting in complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Internal Operations component and requires no user interaction or elevated privileges beyond a basic account. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad version range make this a credible lateral-movement or privilege-escalation risk within Oracle EBS environments.
Full compromise of Oracle Sales (E-Business Suite component: Internal Operations) is achievable by a low-privileged network attacker via HTTP across versions 12.2.3 through 12.2.15, with successful exploitation resulting in complete takeover - high confidentiality, integrity, and availability impact. The attack is constrained by high complexity (AC:H), meaning reliable exploitation requires meeting specific, non-trivial conditions rather than simple request crafting. Disclosed through Oracle's August 2026 Critical Security Patch Update, no public exploit or active exploitation has been identified at time of analysis.
Local authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated local attacker - one with OS-level logon to the host infrastructure but no Oracle application credentials - to compromise the Security component and gain complete unauthorized read access to all data accessible by Hyperion Calculation Manager. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to impact additional Oracle products co-hosted on the same infrastructure. No public exploit has been identified at time of analysis, and Oracle disclosed this through its August 2026 Critical Patch Update.
Full takeover of Oracle Trading Community within Oracle E-Business Suite is achievable by unauthenticated remote attackers via HTTP, targeting the Party Search UI component across versions 12.2.3 through 12.2.15. The Oracle-reported CVSS vector confirms network accessibility with no privilege or user-interaction requirement, though high attack complexity (AC:H) indicates exploitation is non-trivial and likely requires precise conditions such as timing, specific request sequencing, or environment-dependent state. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Unauthorized read and write access to critical data in Oracle Agile Engineering Data Management 6.2.1 is achievable by low-privileged network attackers targeting the Engineering Communication Interface (ECI) component via HTTP, with successful exploitation yielding high confidentiality and integrity impact (C:H/I:H) that can cascade to additional Oracle products via scope change. The 'Authentication Bypass' tag in reporter intelligence suggests the flaw enables attackers to exceed their granted access level within the ECI, despite requiring an initial low-privileged foothold. Oracle addressed this in the August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote exploitation of the File Transmission component in Oracle Payments (E-Business Suite 12.2.3-12.2.15) allows network-accessible attackers over HTTP to gain complete read access to all Oracle Payments data and perform limited unauthorized write operations. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 8.2, and the Authentication Bypass tag confirms no credentials are required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack profile makes this a high-priority patching target for any organization running Oracle EBS with the Payments module active.
Unauthorized data access and modification in Oracle Payables (E-Business Suite versions 12.2.3-12.2.15) is exploitable by any low-privileged authenticated attacker with HTTP network access, enabling full compromise of Payables confidentiality and integrity. The vulnerability resides in the Internal Operations component and is tagged as an authentication bypass, indicating that access-control deficiencies allow a low-privileged account holder to read or manipulate critical financial data-including supplier invoices, payments, and transaction records-beyond their intended authorization scope. No public exploit code and no CISA KEV listing exist at time of analysis; however, the low attack complexity, vendor-confirmed CVSS 8.1, and sensitive financial data at stake make this a meaningful priority for Oracle EBS environments.
Remote denial-of-service in Oracle Payables (E-Business Suite versions 12.2.3 through 12.2.15) allows unauthenticated network attackers to crash or hang the Payables service via HTTP, completely disrupting accounts payable operations. Oracle describes the flaw as 'easily exploitable' with no authentication requirement, and the vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) corroborates full availability impact with minimal attacker effort. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle Critical Patch Update for August 2026 confirms the issue and provides remediation.
Unauthorized data access and modification in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by unauthenticated remote attackers via HTTPS targeting the File Transmission component. The vulnerability, tagged as an Authentication Bypass, enables full confidentiality and integrity compromise of Oracle Payments data - allowing attackers to read, create, delete, or modify all accessible payment records. Exploitation is rated 'difficult' (AC:H) and no active exploitation has been identified in CISA KEV at time of analysis, though the zero-prerequisites authentication bypass warrants urgent patching given the financial data exposure.
Local privilege escalation in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the system via the Engineering Communication Interface component. Exploitation requires high-complexity conditions and local access, but successful attacks result in complete takeover - full loss of confidentiality, integrity, and availability. Disclosed through Oracle's Critical Security Patch Update for August 2026; no public exploit identified at time of analysis.
Unauthenticated network exposure in Oracle Payments (E-Business Suite versions 12.2.3 through 12.2.15) allows remote attackers to access all data handled by the File Transmission component without credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network reachability with no authentication or user interaction required. Tagged as an authentication bypass, this flaw yields complete confidentiality loss over Oracle Payments data; no public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes exploitation straightforward once a target instance is reachable.
Unauthorized data access and manipulation in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by a network-adjacent, high-privileged attacker exploiting a flaw in the File Transmission component via HTTP. Successful exploitation produces a scope change, meaning compromise extends beyond Oracle Payments to additional E-Business Suite products, enabling complete confidentiality and integrity compromise of critical payment data. No public exploit or active KEV listing is identified at time of analysis; however, the 'Authentication Bypass' tag supplied by the reporter suggests internal authorization controls within the File Transmission component can be subverted despite the high-privilege initial access requirement.
Oracle Payments versions 12.2.3 through 12.2.15, within Oracle E-Business Suite, expose a flaw in the File Transmission component that permits a high-privileged HTTP attacker to bypass internal access controls and achieve full confidentiality and integrity compromise of payment data, with confirmed scope change cascading impact to additional integrated EBS modules. The vendor-assigned 'Authentication Bypass' tag creates a notable tension with the PR:H CVSS metric, suggesting the bypass operates within Oracle EBS's internal authorization layer - circumventing role-based data access controls - rather than defeating the perimeter authentication mechanism. No public exploit code or active exploitation has been identified at time of analysis; remediation is available via Oracle's August 2026 Critical Security Patch Update.
Unauthorized data disclosure in Oracle Marketing Encyclopedia System (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible by the application component. The vulnerability carries a scope change, meaning successful exploitation can impact resources beyond the immediately compromised component. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the tags attribute 'Authentication Bypass' suggesting the low-privilege barrier may be weaker in practice than the PR:L CVSS metric implies.
Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable by unauthenticated attackers who can reach the physical network segment hosting the EDM hardware, specifically via the Engineering Communication Interface (ECI) component. The CVSS vector (AV:A/AC:H/PR:N) confirms adjacency is mandatory and complexity is high, constraining realistic exposure to internal networks or co-located infrastructure. No public exploit code or active exploitation has been identified at time of analysis; this is patched under Oracle's August 2026 Critical Security Patch Update.
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network attacker exploiting a flaw in the US Payroll - General component via HTTP. The CVSS scope change (S:C) means a successful compromise can cascade into additional Oracle E-Business Suite modules beyond HRMS itself, amplifying the blast radius significantly. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis; remediation is addressed in Oracle's Critical Patch Update for August 2026.
Complete takeover of Oracle Essbase 21.8.1.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability impact and flags it as 'easily exploitable,' meaning no authentication, no user interaction, and low attack complexity are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach and unauthenticated takeover makes it a high-priority patch candidate.
Full system takeover in Oracle Essbase 21.8.1.0.0 is achievable by any low-privileged authenticated user with network access via HTTP, targeting the Calculator component. The CVSS 3.1 score of 8.8 reflects complete impact across confidentiality, integrity, and availability (C:H/I:H/A:H), consistent with Oracle's own classification of this as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network vector make this a credible and accessible exploitation path for any valid account holder.
Unauthorized data disclosure in Oracle Marketing 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to fully compromise confidentiality of all Oracle Marketing-accessible data via the Audience component over HTTP. The vulnerability carries a scope change, meaning successful exploitation can ripple into additional Oracle E-Business Suite products beyond Marketing itself. Tagged as an Authentication Bypass by the reporting source, no public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-accessible attacker via HTTP, requiring no user interaction and minimal exploitation complexity. The vulnerability resides in the Internal Operations component and results in complete compromise of confidentiality, integrity, and availability of the General Ledger application. No public exploit code or active exploitation has been identified at the time of analysis, but the vendor's own 'easily exploitable' characterization combined with the broad affected version range makes this a high-priority patch for all Oracle EBS deployments.
Local authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables unauthenticated local attackers to access critical application data and perform limited data modification, with a confirmed scope change that can propagate impact to additional co-deployed Oracle Hyperion products. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) classifies this as easily exploitable once local infrastructure access is obtained, requiring no application credentials. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote takeover of Oracle Enterprise Manager Base Platform is achievable by unauthenticated network attackers via HTTP targeting the Agent Next Gen component in versions 13.5 and 24.1. Despite the high attack complexity requirement (CVSS AC:H), successful exploitation yields complete compromise - high confidentiality, integrity, and availability impact, effectively full platform control. No public exploit or active exploitation has been identified at time of analysis, but the Oracle CPU August 2026 advisory documents this as a supported-version vulnerability requiring immediate attention.
Full takeover of Oracle Applications DBA within Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible via an unauthenticated, network-based HTTP attack targeting the JRI and associated Java utility components. Exploitation is rated difficult (CVSS AC:H) and requires human interaction from a legitimate user, but successful compromise yields complete loss of confidentiality, integrity, and availability of the affected component. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Oracle's August 2026 Critical Patch Update addresses this issue.
Oracle Applications DBA, the administrative component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, exposes critical internal operations over HTTP to low-privileged attackers. Successful exploitation enables unauthorized access to critical or complete data accessible by the Applications DBA component, along with the ability to trigger partial denial-of-service conditions against the same component. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the low complexity and broad network accessibility make it a meaningful risk in unpatched EBS deployments.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a flaw in its Security component that enables a network-accessible, low-privileged attacker to compromise the application via HTTP when a legitimate user is induced to interact with malicious content. Successful exploitation results in complete unauthorized read access to all data within Calculation Manager and limited write capability, with a confirmed scope change that may extend impact to other interconnected Oracle Hyperion EPM products. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the 'Authentication Bypass' tag sourced from EUVD metadata suggests the root cause involves bypassing higher-privilege access controls within the Security component after initial low-privilege authentication.
Unauthorized data modification, partial denial of service, and limited data exposure in Oracle Hyperion Calculation Manager 11.2.25.0.000 are achievable by unauthenticated remote attackers over HTTP targeting the Security component. The CVSS 3.1 score of 7.0 reflects high integrity impact - attackers can create, delete, or modify critical EPM data - tempered by high attack complexity (AC:H) that prevents trivial automated exploitation. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Oracle Reports Developer 14.1.2.0.0, a component of Oracle Fusion Middleware, allows unauthenticated remote attackers to fully compromise the system via a network-accessible HTTP attack against its Security and Authentication component. Successful exploitation results in complete takeover - achieving high confidentiality, integrity, and availability impact - consistent with full control over the affected instance. No public exploit code has been identified at time of analysis, and exploitation requires high attack complexity (AC:H), meaning real-world exploitation depends on meeting specific non-trivial preconditions.
Authentication bypass in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows a remote unauthenticated attacker to reach and compromise the reporting service over HTTP, exposing critical data and enabling partial data modification. The scope-changing flaw (CVSS 3.1 9.3) can also significantly impact adjacent products beyond Reports Developer itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, no-privilege, no-interaction profile makes it high priority.
Oracle Reports Developer 14.1.2.0.0 contains an authentication bypass in its Security and Authentication component that permits unauthenticated, network-based attackers to achieve both complete data disclosure and unauthorized modification of critical data over HTTP. The vulnerability requires no credentials or user interaction, though the high attack complexity (AC:H) means exploitation demands precise conditions or crafted request sequences. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network reach combined with dual high-impact outcomes warrants urgent remediation for any internet-exposed or untrusted-network-accessible deployments.
Oracle Reports Developer 14.1.2.0.0 contains an authentication bypass flaw in its Security and Authentication component that allows a low-privileged network attacker to gain unauthorized read and write access to all data managed by the application over HTTP. Rated 8.1 CVSS with low attack complexity and no user interaction required, this represents a significant confidentiality and integrity risk for any organization with Oracle Reports Developer exposed on a network-accessible interface. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Reports Developer 14.1.2.0.0 is exposed to a full system takeover through an authentication bypass (CWE-284) in its Security and Authentication component, exploitable by unauthenticated attackers with access to the adjacent network segment hosting the software. Two conflicting CVSS vectors are present in the source data - the embedded description asserts AV:A (Adjacent Network, score 9.6) while the separately provided vector field records AV:P (Physical, score 7.6) - a material discrepancy that affects risk prioritization and requires vendor clarification. Scope change (S:C) is confirmed, meaning successful exploitation may extend impact to other Oracle Fusion Middleware components; no public exploit or CISA KEV listing has been identified, and EPSS probability is very low at 0.26%.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible when an unauthenticated remote attacker sends crafted HTTP requests to the Security and Authentication component of this Oracle Fusion Middleware reporting tool. The flaw carries a CVSS 9.8 base score with full confidentiality, integrity, and availability impact, and requires no privileges or user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; it was disclosed via Oracle's August 2026 Critical Patch Update.
Remote unauthenticated compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible over the network via SOAP, letting an attacker read, create, delete, or modify all data accessible to the product. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact and no availability impact, and flagged as an authentication-bypass class issue, it was addressed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible for an unauthenticated attacker who can reach the service over IIOP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is network-reachable, low-complexity, and requires no credentials or user interaction, yielding full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was reported by Oracle and fixed in the August 2026 Critical Patch Update.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible for a remote, unauthenticated attacker who can reach the product's CORBA interface over the network, per the Oracle Critical Patch Update of August 2026. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is rated by Oracle as easily exploitable. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Unauthenticated data tampering and denial-of-service in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote attacker over HTTP create, delete, or modify all Reports Developer-accessible data and trigger a complete, repeatable crash. The flaw carries a CVSS 3.1 base score of 9.1 with high integrity and availability impact but no confidentiality impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Oracle Reports Developer 14.1.2.0.0 exposes an unauthenticated authentication bypass in its Security and Authentication component, allowing an attacker on the same physical network segment to fully compromise confidentiality and integrity of all accessible data - including critical data - without any credentials or user interaction. The vulnerability carries a scope change, meaning successful exploitation may cascade to impact additional Oracle Fusion Middleware products beyond Reports Developer itself. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.22% (13th percentile), suggesting low opportunistic risk despite the critical vendor-stated CVSS base score.
Unauthenticated remote exploitation of Oracle Reports Developer 14.1.2.0.0 via the SOAP interface allows attackers to read all data accessible to the application, perform partial data modification, and cause partial service disruption without credentials or user interaction. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, meaning authentication enforcement over the SOAP protocol can be bypassed entirely. No active exploitation has been confirmed at time of analysis, but the network-accessible, zero-authentication attack vector makes this a high-priority patching target for any organization with this product exposed beyond strictly controlled network segments.
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with only HTTP network access to fully compromise the product, per Oracle's Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a high-priority patch target.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible when a remote, unauthenticated attacker reaches the product over CORBA. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a top-priority patch item.
Unauthorized data manipulation in Oracle Telecommunications Billing Integrator versions 12.2.3 through 12.2.15 allows unauthenticated network attackers to compromise critical data integrity via crafted HTTP requests, requiring only victim interaction to trigger. The CVSS scope change (S:C) indicates successful exploitation can cascade into other Oracle E-Business Suite components beyond the directly targeted module, amplifying the overall impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this vulnerability through its August 2026 Critical Patch Update.
Full system takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by any low-privileged authenticated user over HTTP, with no additional complexity required. The Server component is vulnerable to exploitation that results in complete compromise of confidentiality, integrity, and availability - Oracle's own description uses the word 'takeover'. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low bar to exploitation (PR:L, AC:L, AV:N) makes this a high-priority patching target for any organization running this Oracle Hyperion version.
Unauthorized data access and partial integrity compromise in Oracle Service Fulfillment Manager (E-Business Suite Fulfillment Engine component) affects all releases from 12.2.3 through 12.2.15. A low-privileged network attacker can, after inducing a victim user to interact with a crafted payload delivered over HTTP, achieve complete confidentiality loss of all data accessible to the application and limited unauthorized write access - with confirmed scope change affecting additional EBS products. No public exploit code has been identified at time of analysis, and Oracle has addressed this vulnerability in the August 2026 Critical Patch Update. The Authentication Bypass tag warrants verification, as the provided CVSS vector assigns PR:L rather than PR:N, suggesting privilege escalation within the session rather than a full authentication bypass.
Oracle Service Contracts in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in its Internal Operations component reachable over HTTP without credentials, enabling unauthorized full read and write access to critical service contract data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impact, moderated by high attack complexity (AC:H) that prevents trivial mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass nature of the flaw and the sensitivity of contract data make this a meaningful target for motivated adversaries with access to the EBS application layer.
Oracle Labor Distribution versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, allows a low-privileged network attacker to bypass internal authorization controls via HTTP, resulting in complete unauthorized read and write access to critical labor and payroll cost distribution data. The vendor characterizes this as 'easily exploitable,' and the 'Authentication Bypass' tag indicates that a standard EBS account holder can escalate beyond their assigned access level within the Internal Operations component. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and high dual confidentiality and integrity impact make this a high-priority item in the August 2026 Oracle CPU.
Full takeover of Oracle Proposals (Oracle E-Business Suite component) is achievable by a high-privileged, network-adjacent attacker over HTTP, resulting in complete compromise of confidentiality, integrity, and availability. Affected deployments span versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, a widely deployed enterprise ERP platform. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.
Oracle iSupplier Portal versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes an authentication bypass in the Internal Operations component that allows unauthenticated network attackers to fully compromise supplier data confidentiality and integrity via HTTP. Successful exploitation grants complete read access to all iSupplier Portal data and the ability to create, delete, or modify critical data records - high-value targets in supply chain environments. Oracle patched this in the August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis, though the AC:H rating indicates non-trivial but achievable exploitation conditions.
Unauthorized data access and modification in Oracle Customer Care (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by network-authenticated low-privileged attackers through the Internal Operations component via HTTP, with successful exploitation requiring victim interaction and producing a scope change that can compromise additional Oracle E-Business Suite components. The vulnerability carries a CVSS 3.1 score of 8.7, reflecting high confidentiality and integrity impacts with a cross-component blast radius. Oracle's August 2026 Critical Patch Update confirms the issue; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Unauthenticated remote attackers can access all data within Oracle iSupplier Portal 12.2.3 through 12.2.15 via a trivially exploitable HTTP flaw in the Internal Operations component, with no credentials, no user interaction, and no special configuration required. The 'Authentication Bypass' tag indicates that access controls protecting internal operations endpoints can be circumvented entirely over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity makes opportunistic exploitation realistic if portal instances are internet-facing.
Oracle Warehouse Management versions 12.2.3 through 12.2.15 within Oracle E-Business Suite allows low-privileged network-authenticated attackers to corrupt, delete, or create critical warehouse data and partially disrupt service availability over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms easy exploitability requiring only a low-privilege account and HTTP connectivity - no user interaction or elevated rights are needed. No public exploit code or CISA KEV listing has been identified at time of analysis; the August 2026 Oracle Critical Patch Update references a fix.
Unauthenticated remote access to critical HR data is possible in Oracle HCM Common Architecture (Knowledge Integration component) across versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, exploitable over HTTP without credentials or user interaction. Successful exploitation yields full read access to all HCM-accessible data and partial write capability (insert/update/delete) against some HCM data stores, as confirmed by Oracle's own CVSS breakdown (C:H, I:L). Tagged as an authentication bypass by Oracle's security team, this represents a significant exposure for any organization running HCM within a network-reachable deployment. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote data exposure in Oracle Warehouse Management (versions 12.2.3 through 12.2.15) allows any network-accessible attacker to read critical warehouse management data via HTTP without credentials. Tagged as an authentication bypass in the Internal Operations component, this vulnerability provides complete read access to all data within the WMS module's scope. No public exploit code or CISA KEV listing has been identified at time of analysis, though the trivial attack complexity (AC:L, PR:N) elevates practical risk relative to the absence of observed exploitation.
Unauthorized data disclosure in Oracle Warehouse Management (Oracle E-Business Suite component: Internal Operations) allows a low-privileged authenticated attacker with HTTPS network access to bypass authorization controls and obtain critical or complete WMS data across versions 12.2.3 through 12.2.15. The CVSS scope change (S:C) is confirmed by Oracle's advisory, meaning successful exploitation can propagate to additional Oracle EBS products deployed in the same instance - amplifying the data exposure beyond WMS itself. No public exploit code and no CISA KEV listing are identified at time of analysis; the 'Authentication Bypass' tag combined with a PR:L vector indicates this is an authorization bypass for credentialed users rather than a fully unauthenticated flaw.
Oracle Warehouse Management versions 12.2.3 through 12.2.15 - a component of Oracle E-Business Suite - exposes a high-severity vulnerability in its Internal Operations component allowing low-privileged, network-authenticated attackers to compromise confidentiality, integrity, and availability via HTTP. Successful exploitation enables unauthorized read and write access to critical warehouse management data, including creation, deletion, and modification of records, alongside a partial denial of service. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data access and partial denial of service affect Oracle General Ledger versions 12.2.3 through 12.2.15, a core financial management component of Oracle E-Business Suite. A low-privileged, network-authenticated attacker can exploit the Internal Operations component via HTTP to gain complete read access to all Oracle General Ledger data, perform unauthorized insert/update/delete operations on a subset of that data, and cause a partial availability disruption. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Oracle Operations Intelligence, the Daily Business Intelligence component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, contains a network-exploitable vulnerability that allows a low-privileged authenticated attacker to achieve full takeover - encompassing complete loss of confidentiality, integrity, and availability - via crafted HTTP requests. The vendor-assigned CVSS 3.1 score of 7.5 reflects high attack complexity (AC:H), tempering immediacy despite the severe impact ceiling. No public exploit code and no CISA KEV listing have been identified at time of analysis, indicating this is not currently subject to widespread opportunistic exploitation.
Oracle Risk Management versions 12.2.3 through 12.2.15 in Oracle E-Business Suite exposes critical data to low-privileged authenticated attackers over HTTP via a flaw in the Internal Operations component, tagged as an authentication bypass. A successful attack grants full unauthorized read access to all Risk Management data and the ability to create, delete, or modify critical records. No public exploit or CISA KEV listing has been identified at this time, but the low attack complexity and broad version range make this a high-priority patching target for Oracle EBS deployments.
Full takeover of Oracle Risk Management (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated user over HTTP, with no interaction from other parties required. The CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability impact - Oracle's own advisory characterizes the outcome as system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a high-priority patch target for Oracle EBS deployments.
Unauthorized data access in Oracle Order Management's Product Diagnostic Tools component allows low-privileged authenticated attackers over HTTP to compromise confidentiality of critical order data and perform limited data manipulation, with a confirmed scope change that can extend impact to adjacent Oracle E-Business Suite components. Affected deployments span a wide version range, 12.2.3 through 12.2.15, and are addressed in Oracle's Critical Patch Update for August 2026. No public exploit code has been identified at time of analysis, though the Authentication Bypass tag associated with this CVE signals a potentially exploitable access control weakness in the diagnostic sub-component.
Unauthenticated remote disclosure of sensitive financial data affects Oracle Hyperion Financial Reporting 11.2.25.0.000 via HTTP, with no credentials required to trigger the flaw. Tagged as an authentication bypass, the vulnerability allows a network-adjacent attacker to read critical data or gain complete access to all data accessible by the Financial Reporting server component. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's own description characterizes it as 'easily exploitable.'
Full application takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by a low-privileged attacker with local OS logon access to the server host, requiring no user interaction and resulting in complete loss of confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects an easily exploitable local flaw in the Server component, with all three impact dimensions rated High. No public exploit code or active exploitation has been identified at time of analysis, though the severity of the described outcome - full application takeover - warrants prompt remediation.
Full system takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by unauthenticated remote attackers over HTTP without user interaction. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates the attack is network-accessible and requires no credentials, but high attack complexity (AC:H) implies specific preconditions - such as race conditions, timing requirements, or environmental factors - that prevent trivial mass exploitation. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though full CIA impact at CVSS 8.1 makes this a high-priority remediation target for organizations running this EPM platform.
Full takeover of Oracle Customers Online (E-Business Suite component) is achievable by any low-privileged authenticated user over HTTP, across versions 12.2.3 through 12.2.15. The Customer Tab component contains a flaw that, when exploited, yields complete confidentiality, integrity, and availability compromise - Oracle's own description uses the word 'takeover.' No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad authentication baseline (any portal account qualifies) make this a critical patching priority for Oracle EBS deployments.
Oracle Hyperion Financial Reporting version 11.2.25.0.000 is affected by an authentication bypass vulnerability exposing critical financial data to unauthenticated remote attackers over HTTP. Successful exploitation, which requires human interaction from a victim user, grants unauthorized read access to all accessible financial data as well as the ability to create, modify, or delete critical records. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Authentication Bypass tag and CVSS 8.1 score highlight significant risk to corporate financial data confidentiality and integrity.
Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows an unauthenticated attacker with HTTP network access to fully compromise the Server component, yielding complete confidentiality, integrity, and availability loss. Rated CVSS 9.8 and flagged as 'easily exploitable' by Oracle, though tagged as Information Disclosure in EUVD; no public exploit identified at time of analysis and it is not listed in CISA KEV. This is part of Oracle's August 2026 Critical Patch Update and should be treated as high-priority given the unauthenticated network vector.
Full takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by an unauthenticated remote attacker via HTTP, according to Oracle's August 2026 Critical Security Update. The vulnerability resides in the Server component and, if successfully exploited, results in complete compromise of confidentiality, integrity, and availability of the affected instance. No public exploit code or CISA KEV listing has been identified at time of analysis; the High attack complexity rating reduces the likelihood of opportunistic mass exploitation but does not eliminate targeted risk.
Unauthenticated remote exploitation of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows network attackers to obtain complete access to all financial reporting data and cause a partial denial of service via HTTPS. The vulnerability resides in the Server component and is tagged as an authentication bypass, meaning no credentials are required to trigger the flaw against a network-exposed instance. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a high-priority patch target for any organization running this specific version.
Full takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by any low-privileged network attacker communicating via HTTPS, with complete confidentiality, integrity, and availability impact confirmed by a CVSS 3.1 score of 8.8. The vulnerability resides in the Server component and requires only minimal authenticated access, presenting a low barrier for insider threat or compromised-credential scenarios. Oracle formally disclosed and addressed this issue in its August 2026 Critical Security Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote unauthenticated compromise of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an attacker with network access via the Java RMI interface to read, create, modify, or delete all data accessible to the application. Carrying a CVSS 3.1 base score of 9.1 and tagged as an authentication bypass, the flaw yields full confidentiality and integrity compromise without any credentials or user interaction, though it does not affect availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an unauthenticated attacker with only HTTP network reach to fully compromise the application, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact reflects complete product compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch.
Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an unauthenticated attacker with only HTTP network access to fully compromise the application, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' At time of analysis there is no public exploit identified and no CISA KEV listing, but the trivial exploitability and complete-compromise outcome make it a high patch priority.
Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 exposes critical financial data to full unauthorized read and write access through an authorization bypass flaw in its Deployment component, exploitable over HTTP by any low-privileged authenticated user. The dual high-severity impacts - complete confidentiality loss and full integrity compromise covering unauthorized creation, deletion, and modification of all PCM-accessible data - make this a significant threat to enterprise financial management environments. No public exploit has been identified at time of analysis, and CISA KEV listing is not confirmed.
Full system takeover is achievable in Oracle Enterprise Manager for Systems Infrastructure (versions 13.5 and 24.1) via the Storage Server Management component, exploitable by any low-privileged attacker with HTTP network access. The CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact confirms complete compromise of the affected OEM instance - not merely information disclosure despite the 'Information Disclosure' tag in the source intelligence. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though Oracle's opaque CPU advisory format historically delays exploit development rather than preventing it.
Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 exposes critical financial planning data to low-privileged network attackers through its Deployment component over HTTP. Tagged as an authentication bypass, the vulnerability permits a credentialed user to gain complete read access to all data accessible within the application and perform limited unauthorized insert, update, or delete operations, without requiring user interaction or elevated privileges beyond an initial low-level account. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity (AC:L) means a skilled attacker with any valid credential could exploit this reliably.
Full system takeover in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by a high-privileged, network-authenticated attacker via HTTP against the Deployment component, resulting in complete confidentiality, integrity, and availability compromise. Disclosed as part of Oracle's August 2026 Critical Security Update (CPU) and registered in ENISA EUVD (EUVD-2026-61690), with no confirmed active exploitation or public exploit code at time of analysis. The PR:H prerequisite significantly constrains the attacker population to insiders, compromised administrator accounts, or actors with prior lateral movement to admin-level access.
Data integrity and availability compromise in Oracle Autonomous Health Framework's Trace File Analyzer component affects versions 26 through 26.5.2, permitting high-privileged local attackers to corrupt or destroy critical data and induce a complete denial-of-service condition. Notably, the attack carries a scope change, meaning successful exploitation can cascade to affect additional co-located Oracle products beyond AHF itself. No public exploit code or active exploitation has been identified at time of analysis; Oracle has issued remediation through its August 2026 Critical Patch Update.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by any low-privileged attacker with network access over HTTP targeting the Deployment component. The combination of a high confidentiality impact and an 'Authentication Bypass' tag from EUVD suggests the flaw may allow authenticated users to escalate access beyond their authorization level, potentially exposing all financial and operational data managed by the platform. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has addressed this in the August 2026 Critical Security Patch Update.
Local privilege escalation and denial-of-service in Oracle Autonomous Health Framework's Trace File Analyzer component affects versions 26 through 26.5.2, enabling low-privileged infrastructure users to corrupt or destroy critical data and crash the framework with scope change to dependent Oracle products. The CVSS 3.1 score of 8.4 reflects ease of exploitation once local access is obtained, with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis; this disclosure originates from Oracle's Critical Security Patch Update for August 2026.
Unauthenticated data compromise in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 (Deployment component) lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the application. Tagged as an authentication bypass and rated CVSS 3.1 9.1, it was reported by Oracle and addressed in the August 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Teleservice (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged attacker with network access via HTTP, exploiting a flaw in the Service Request Form component. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation is straightforward - no elevated privileges, no user interaction, and no complex preconditions beyond a valid low-privilege account. Oracle's own advisory characterizes the outcome as complete product takeover, implying full loss of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data exposure in Oracle Autonomous Health Framework (Trace File Analyzer component) allows a low-privileged network attacker to gain complete read access to critical data and limited write capability across the framework and potentially connected Oracle products due to a scope-changing exploit path. Affected versions span the entire 26.x release family through 26.5.2, making this a broad exposure across current deployments. No public exploit has been identified at time of analysis, but the low attack complexity, absence of user interaction, and scope-change characteristic elevate real-world priority beyond what the raw CVSS alone conveys.
Oracle Advanced Inbound Telephony versions 12.2.3 through 12.2.15 exposes its Internal Operations component to low-privileged HTTP attackers who can achieve full read access to sensitive telephony data, limited data manipulation, and partial denial of service. The 'Authentication Bypass' tag suggests that while a valid low-privilege account is required to initiate the attack, the Internal Operations component fails to enforce additional authorization controls, allowing privilege escalation within the application. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was disclosed by Oracle's own security team via the August 2026 Critical Patch Update.
Full takeover of Oracle MySQL Cluster is achievable by an unauthenticated remote attacker over HTTP across three active release trains: 8.0.0-8.0.48, 8.4.0-8.4.11, and 9.7.0-9.7.2. The attack carries high complexity and requires human interaction from a victim user, but successful exploitation yields complete confidentiality, integrity, and availability compromise of the cluster. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data exposure in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible by the application, with scope change enabling lateral data exposure across additional Oracle Hyperion ecosystem products. The vulnerability resides in the Deployment component and is exploitable over HTTP without user interaction. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the Authentication Bypass tag from ENISA EUVD signals a likely authorization control weakness that warrants priority patching in enterprise environments.
Unauthenticated remote exploitation of Oracle Advanced Inbound Telephony (versions 12.2.3-12.2.15) within Oracle E-Business Suite allows a network attacker to perform unauthorized creation, deletion, or modification of critical telephony data and cause a partial denial of service via HTTPS. The CVSS 3.1 base score of 8.2 reflects high integrity impact and low availability impact with no confidentiality exposure. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis.
Unauthenticated remote exploitation of Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 allows network attackers to gain complete read access to all application-managed financial data via HTTP, with no credentials or user interaction required. The vulnerability resides in the Deployment component and carries a CVSS scope change, meaning successful exploitation may expose data from additional interconnected Oracle Hyperion products sharing the same infrastructure. No public exploit code or active exploitation has been confirmed, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N profile makes this trivially repeatable once an attacker identifies the vulnerable endpoint.
Full system compromise of Oracle Bills of Material - a component of Oracle E-Business Suite - across versions 12.2.3 through 12.2.15 is achievable by a network-reachable, low-privileged attacker via crafted HTTP requests, with Oracle confirming potential for complete takeover covering confidentiality, integrity, and availability. The scope change designation in the CVSS vector indicates that successful exploitation can cascade beyond the Bills of Material module to affect additional Oracle E-Business Suite components. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Oracle has issued a patch in the August 2026 Critical Patch Update.
Full takeover of Oracle iSetup 12.2.3 through 12.2.15 is achievable by a low-privileged, network-adjacent attacker via HTTP, targeting the General Ledger Update Transform and Reports component within Oracle E-Business Suite. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected instance. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the full-takeover impact (C:H/I:H/A:H) and network accessibility elevate the urgency of patching relative to other Oracle CPU entries in this cycle.
Full takeover of Oracle Sales Foundation (E-Business Suite 12.2.3-12.2.15) is achievable by a low-privileged network attacker via HTTP, targeting the Security API component. The vulnerability is rated CVSS 8.8 with high impact across confidentiality, integrity, and availability, indicating the attacker can gain complete control of the affected application. No public exploit or CISA KEV listing has been identified at time of analysis, though Oracle's classification as 'easily exploitable' elevates urgency for patching.
Unauthorized data access and modification in Oracle Sales Foundation (Oracle E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The vulnerability resides in the Security API component and is tagged as an authentication bypass, enabling an attacker to read, create, delete, or modify critical data across the entire Sales Foundation dataset. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog, though the low exploitation complexity makes this a realistic near-term threat for exposed deployments.
Full system takeover of Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated attacker with HTTP network access, resulting in complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Internal Operations component and requires no user interaction or elevated privileges beyond a basic account. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad version range make this a credible lateral-movement or privilege-escalation risk within Oracle EBS environments.
Full compromise of Oracle Sales (E-Business Suite component: Internal Operations) is achievable by a low-privileged network attacker via HTTP across versions 12.2.3 through 12.2.15, with successful exploitation resulting in complete takeover - high confidentiality, integrity, and availability impact. The attack is constrained by high complexity (AC:H), meaning reliable exploitation requires meeting specific, non-trivial conditions rather than simple request crafting. Disclosed through Oracle's August 2026 Critical Security Patch Update, no public exploit or active exploitation has been identified at time of analysis.
Local authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated local attacker - one with OS-level logon to the host infrastructure but no Oracle application credentials - to compromise the Security component and gain complete unauthorized read access to all data accessible by Hyperion Calculation Manager. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to impact additional Oracle products co-hosted on the same infrastructure. No public exploit has been identified at time of analysis, and Oracle disclosed this through its August 2026 Critical Patch Update.
Full takeover of Oracle Trading Community within Oracle E-Business Suite is achievable by unauthenticated remote attackers via HTTP, targeting the Party Search UI component across versions 12.2.3 through 12.2.15. The Oracle-reported CVSS vector confirms network accessibility with no privilege or user-interaction requirement, though high attack complexity (AC:H) indicates exploitation is non-trivial and likely requires precise conditions such as timing, specific request sequencing, or environment-dependent state. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Unauthorized read and write access to critical data in Oracle Agile Engineering Data Management 6.2.1 is achievable by low-privileged network attackers targeting the Engineering Communication Interface (ECI) component via HTTP, with successful exploitation yielding high confidentiality and integrity impact (C:H/I:H) that can cascade to additional Oracle products via scope change. The 'Authentication Bypass' tag in reporter intelligence suggests the flaw enables attackers to exceed their granted access level within the ECI, despite requiring an initial low-privileged foothold. Oracle addressed this in the August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote exploitation of the File Transmission component in Oracle Payments (E-Business Suite 12.2.3-12.2.15) allows network-accessible attackers over HTTP to gain complete read access to all Oracle Payments data and perform limited unauthorized write operations. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 8.2, and the Authentication Bypass tag confirms no credentials are required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack profile makes this a high-priority patching target for any organization running Oracle EBS with the Payments module active.
Unauthorized data access and modification in Oracle Payables (E-Business Suite versions 12.2.3-12.2.15) is exploitable by any low-privileged authenticated attacker with HTTP network access, enabling full compromise of Payables confidentiality and integrity. The vulnerability resides in the Internal Operations component and is tagged as an authentication bypass, indicating that access-control deficiencies allow a low-privileged account holder to read or manipulate critical financial data-including supplier invoices, payments, and transaction records-beyond their intended authorization scope. No public exploit code and no CISA KEV listing exist at time of analysis; however, the low attack complexity, vendor-confirmed CVSS 8.1, and sensitive financial data at stake make this a meaningful priority for Oracle EBS environments.
Remote denial-of-service in Oracle Payables (E-Business Suite versions 12.2.3 through 12.2.15) allows unauthenticated network attackers to crash or hang the Payables service via HTTP, completely disrupting accounts payable operations. Oracle describes the flaw as 'easily exploitable' with no authentication requirement, and the vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) corroborates full availability impact with minimal attacker effort. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle Critical Patch Update for August 2026 confirms the issue and provides remediation.
Unauthorized data access and modification in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by unauthenticated remote attackers via HTTPS targeting the File Transmission component. The vulnerability, tagged as an Authentication Bypass, enables full confidentiality and integrity compromise of Oracle Payments data - allowing attackers to read, create, delete, or modify all accessible payment records. Exploitation is rated 'difficult' (AC:H) and no active exploitation has been identified in CISA KEV at time of analysis, though the zero-prerequisites authentication bypass warrants urgent patching given the financial data exposure.
Local privilege escalation in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the system via the Engineering Communication Interface component. Exploitation requires high-complexity conditions and local access, but successful attacks result in complete takeover - full loss of confidentiality, integrity, and availability. Disclosed through Oracle's Critical Security Patch Update for August 2026; no public exploit identified at time of analysis.
Unauthenticated network exposure in Oracle Payments (E-Business Suite versions 12.2.3 through 12.2.15) allows remote attackers to access all data handled by the File Transmission component without credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network reachability with no authentication or user interaction required. Tagged as an authentication bypass, this flaw yields complete confidentiality loss over Oracle Payments data; no public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes exploitation straightforward once a target instance is reachable.
Unauthorized data access and manipulation in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by a network-adjacent, high-privileged attacker exploiting a flaw in the File Transmission component via HTTP. Successful exploitation produces a scope change, meaning compromise extends beyond Oracle Payments to additional E-Business Suite products, enabling complete confidentiality and integrity compromise of critical payment data. No public exploit or active KEV listing is identified at time of analysis; however, the 'Authentication Bypass' tag supplied by the reporter suggests internal authorization controls within the File Transmission component can be subverted despite the high-privilege initial access requirement.
Oracle Payments versions 12.2.3 through 12.2.15, within Oracle E-Business Suite, expose a flaw in the File Transmission component that permits a high-privileged HTTP attacker to bypass internal access controls and achieve full confidentiality and integrity compromise of payment data, with confirmed scope change cascading impact to additional integrated EBS modules. The vendor-assigned 'Authentication Bypass' tag creates a notable tension with the PR:H CVSS metric, suggesting the bypass operates within Oracle EBS's internal authorization layer - circumventing role-based data access controls - rather than defeating the perimeter authentication mechanism. No public exploit code or active exploitation has been identified at time of analysis; remediation is available via Oracle's August 2026 Critical Security Patch Update.
Unauthorized data disclosure in Oracle Marketing Encyclopedia System (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible by the application component. The vulnerability carries a scope change, meaning successful exploitation can impact resources beyond the immediately compromised component. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the tags attribute 'Authentication Bypass' suggesting the low-privilege barrier may be weaker in practice than the PR:L CVSS metric implies.
Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable by unauthenticated attackers who can reach the physical network segment hosting the EDM hardware, specifically via the Engineering Communication Interface (ECI) component. The CVSS vector (AV:A/AC:H/PR:N) confirms adjacency is mandatory and complexity is high, constraining realistic exposure to internal networks or co-located infrastructure. No public exploit code or active exploitation has been identified at time of analysis; this is patched under Oracle's August 2026 Critical Security Patch Update.
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network attacker exploiting a flaw in the US Payroll - General component via HTTP. The CVSS scope change (S:C) means a successful compromise can cascade into additional Oracle E-Business Suite modules beyond HRMS itself, amplifying the blast radius significantly. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis; remediation is addressed in Oracle's Critical Patch Update for August 2026.
Complete takeover of Oracle Essbase 21.8.1.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability impact and flags it as 'easily exploitable,' meaning no authentication, no user interaction, and low attack complexity are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach and unauthenticated takeover makes it a high-priority patch candidate.
Full system takeover in Oracle Essbase 21.8.1.0.0 is achievable by any low-privileged authenticated user with network access via HTTP, targeting the Calculator component. The CVSS 3.1 score of 8.8 reflects complete impact across confidentiality, integrity, and availability (C:H/I:H/A:H), consistent with Oracle's own classification of this as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network vector make this a credible and accessible exploitation path for any valid account holder.
Unauthorized data disclosure in Oracle Marketing 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to fully compromise confidentiality of all Oracle Marketing-accessible data via the Audience component over HTTP. The vulnerability carries a scope change, meaning successful exploitation can ripple into additional Oracle E-Business Suite products beyond Marketing itself. Tagged as an Authentication Bypass by the reporting source, no public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-accessible attacker via HTTP, requiring no user interaction and minimal exploitation complexity. The vulnerability resides in the Internal Operations component and results in complete compromise of confidentiality, integrity, and availability of the General Ledger application. No public exploit code or active exploitation has been identified at the time of analysis, but the vendor's own 'easily exploitable' characterization combined with the broad affected version range makes this a high-priority patch for all Oracle EBS deployments.
Local authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables unauthenticated local attackers to access critical application data and perform limited data modification, with a confirmed scope change that can propagate impact to additional co-deployed Oracle Hyperion products. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) classifies this as easily exploitable once local infrastructure access is obtained, requiring no application credentials. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote takeover of Oracle Enterprise Manager Base Platform is achievable by unauthenticated network attackers via HTTP targeting the Agent Next Gen component in versions 13.5 and 24.1. Despite the high attack complexity requirement (CVSS AC:H), successful exploitation yields complete compromise - high confidentiality, integrity, and availability impact, effectively full platform control. No public exploit or active exploitation has been identified at time of analysis, but the Oracle CPU August 2026 advisory documents this as a supported-version vulnerability requiring immediate attention.
Full takeover of Oracle Applications DBA within Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible via an unauthenticated, network-based HTTP attack targeting the JRI and associated Java utility components. Exploitation is rated difficult (CVSS AC:H) and requires human interaction from a legitimate user, but successful compromise yields complete loss of confidentiality, integrity, and availability of the affected component. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Oracle's August 2026 Critical Patch Update addresses this issue.
Oracle Applications DBA, the administrative component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, exposes critical internal operations over HTTP to low-privileged attackers. Successful exploitation enables unauthorized access to critical or complete data accessible by the Applications DBA component, along with the ability to trigger partial denial-of-service conditions against the same component. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the low complexity and broad network accessibility make it a meaningful risk in unpatched EBS deployments.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a flaw in its Security component that enables a network-accessible, low-privileged attacker to compromise the application via HTTP when a legitimate user is induced to interact with malicious content. Successful exploitation results in complete unauthorized read access to all data within Calculation Manager and limited write capability, with a confirmed scope change that may extend impact to other interconnected Oracle Hyperion EPM products. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the 'Authentication Bypass' tag sourced from EUVD metadata suggests the root cause involves bypassing higher-privilege access controls within the Security component after initial low-privilege authentication.
Unauthorized data modification, partial denial of service, and limited data exposure in Oracle Hyperion Calculation Manager 11.2.25.0.000 are achievable by unauthenticated remote attackers over HTTP targeting the Security component. The CVSS 3.1 score of 7.0 reflects high integrity impact - attackers can create, delete, or modify critical EPM data - tempered by high attack complexity (AC:H) that prevents trivial automated exploitation. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Oracle Reports Developer 14.1.2.0.0, a component of Oracle Fusion Middleware, allows unauthenticated remote attackers to fully compromise the system via a network-accessible HTTP attack against its Security and Authentication component. Successful exploitation results in complete takeover - achieving high confidentiality, integrity, and availability impact - consistent with full control over the affected instance. No public exploit code has been identified at time of analysis, and exploitation requires high attack complexity (AC:H), meaning real-world exploitation depends on meeting specific non-trivial preconditions.
Authentication bypass in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows a remote unauthenticated attacker to reach and compromise the reporting service over HTTP, exposing critical data and enabling partial data modification. The scope-changing flaw (CVSS 3.1 9.3) can also significantly impact adjacent products beyond Reports Developer itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, no-privilege, no-interaction profile makes it high priority.
Oracle Reports Developer 14.1.2.0.0 contains an authentication bypass in its Security and Authentication component that permits unauthenticated, network-based attackers to achieve both complete data disclosure and unauthorized modification of critical data over HTTP. The vulnerability requires no credentials or user interaction, though the high attack complexity (AC:H) means exploitation demands precise conditions or crafted request sequences. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network reach combined with dual high-impact outcomes warrants urgent remediation for any internet-exposed or untrusted-network-accessible deployments.
Oracle Reports Developer 14.1.2.0.0 contains an authentication bypass flaw in its Security and Authentication component that allows a low-privileged network attacker to gain unauthorized read and write access to all data managed by the application over HTTP. Rated 8.1 CVSS with low attack complexity and no user interaction required, this represents a significant confidentiality and integrity risk for any organization with Oracle Reports Developer exposed on a network-accessible interface. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Reports Developer 14.1.2.0.0 is exposed to a full system takeover through an authentication bypass (CWE-284) in its Security and Authentication component, exploitable by unauthenticated attackers with access to the adjacent network segment hosting the software. Two conflicting CVSS vectors are present in the source data - the embedded description asserts AV:A (Adjacent Network, score 9.6) while the separately provided vector field records AV:P (Physical, score 7.6) - a material discrepancy that affects risk prioritization and requires vendor clarification. Scope change (S:C) is confirmed, meaning successful exploitation may extend impact to other Oracle Fusion Middleware components; no public exploit or CISA KEV listing has been identified, and EPSS probability is very low at 0.26%.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible when an unauthenticated remote attacker sends crafted HTTP requests to the Security and Authentication component of this Oracle Fusion Middleware reporting tool. The flaw carries a CVSS 9.8 base score with full confidentiality, integrity, and availability impact, and requires no privileges or user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; it was disclosed via Oracle's August 2026 Critical Patch Update.
Remote unauthenticated compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible over the network via SOAP, letting an attacker read, create, delete, or modify all data accessible to the product. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact and no availability impact, and flagged as an authentication-bypass class issue, it was addressed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible for an unauthenticated attacker who can reach the service over IIOP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is network-reachable, low-complexity, and requires no credentials or user interaction, yielding full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was reported by Oracle and fixed in the August 2026 Critical Patch Update.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible for a remote, unauthenticated attacker who can reach the product's CORBA interface over the network, per the Oracle Critical Patch Update of August 2026. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is rated by Oracle as easily exploitable. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Unauthenticated data tampering and denial-of-service in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote attacker over HTTP create, delete, or modify all Reports Developer-accessible data and trigger a complete, repeatable crash. The flaw carries a CVSS 3.1 base score of 9.1 with high integrity and availability impact but no confidentiality impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Oracle Reports Developer 14.1.2.0.0 exposes an unauthenticated authentication bypass in its Security and Authentication component, allowing an attacker on the same physical network segment to fully compromise confidentiality and integrity of all accessible data - including critical data - without any credentials or user interaction. The vulnerability carries a scope change, meaning successful exploitation may cascade to impact additional Oracle Fusion Middleware products beyond Reports Developer itself. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.22% (13th percentile), suggesting low opportunistic risk despite the critical vendor-stated CVSS base score.
Unauthenticated remote exploitation of Oracle Reports Developer 14.1.2.0.0 via the SOAP interface allows attackers to read all data accessible to the application, perform partial data modification, and cause partial service disruption without credentials or user interaction. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, meaning authentication enforcement over the SOAP protocol can be bypassed entirely. No active exploitation has been confirmed at time of analysis, but the network-accessible, zero-authentication attack vector makes this a high-priority patching target for any organization with this product exposed beyond strictly controlled network segments.
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with only HTTP network access to fully compromise the product, per Oracle's Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a high-priority patch target.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible when a remote, unauthenticated attacker reaches the product over CORBA. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a top-priority patch item.