Oracle
Monthly
Full takeover of Oracle Reports Developer 14.1.2.0.0 (a component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, carrying a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact. Disclosed in Oracle's August 2026 Critical Patch Update (cross-referenced as ENISA EUVD-2026-61615), the flaw sits in the Security and Authentication component and permits complete compromise of the product without credentials or user interaction. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over HTTP against the Security and Authentication component, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with high confidentiality, integrity, and availability impact, describing 'takeover' of the product. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch.
Unauthenticated remote compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows attackers with only HTTP network access to tamper with or destroy critical data, read a subset of accessible data, and force a complete denial of service. Oracle rates this CVSS 9.4, reflecting high integrity and availability impact combined with trivial exploitability and no authentication requirement. No public exploit identified at time of analysis, but the low-complexity, no-privileges vector makes it a high-priority patch from Oracle's August 2026 Critical Patch Update.
Authentication bypass in Oracle Reports Developer 12.2.1.19.0 exposes critical data to unauthenticated remote attackers over TCP, with a scope change confirmed by the vendor meaning downstream Oracle Fusion Middleware components can also be compromised. The CVSS 3.1 score of 8.6 reflects a network-accessible, zero-interaction attack path yielding high confidentiality impact across system boundaries. No public exploit code has been identified at time of analysis, though the vendor's own 'easily exploitable' classification substantially lowers the operational barrier for threat actors.
Oracle Reports Developer 12.2.1.19.0, a component of Oracle Fusion Middleware, exposes a network-exploitable authentication/security bypass in its Security and Authentication component that allows a low-privileged attacker to gain complete unauthorized read access to all data accessible by the application and limited write access to some data. The scope change (S:C) in the CVSS vector confirms that a successful attack can cascade and significantly impact additional products beyond Oracle Reports Developer itself. No public exploit code or active exploitation has been identified at time of analysis, and Oracle classifies this as difficult to exploit (AC:H).
Complete takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by a remote, unauthenticated attacker over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the product's Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch.
Unauthenticated remote compromise of Oracle Reports Developer 12.2.1.19.0 is achievable via crafted SOAP requests targeting the Security and Authentication component, confirming an authentication bypass condition. The CVSS 3.1 vector (PR:N, AV:N, AC:L) indicates no credentials or user interaction are required, and the high confidentiality impact reflects full data exposure across all data accessible to the Reports Developer service. Additionally, limited integrity and availability degradation are possible, making this a high-priority patch candidate for any Oracle Fusion Middleware deployment running this version. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full compromise of Oracle Reports Developer 12.2.1.19.0 is possible when an unauthenticated attacker reaches the product over the network via the IIOP protocol, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields complete takeover with high confidentiality, integrity, and availability impact (CVSS 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Remote takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with network access over the IIOP protocol to fully compromise the product, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible via a Security and Authentication component flaw that lets a remote attacker take over the product over TCP without credentials or user interaction. Oracle rates it CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch in the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Reports Developer 12.2.1.19.0 exposes all data accessible to the application via HTTP, with confirmed scope change that can impact additional downstream products within the Oracle Fusion Middleware environment. The vulnerability resides in the Security and Authentication component and is tagged as an authentication bypass, meaning attackers require no credentials to exploit it. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to exploit once a target instance is reachable.
Full system takeover in Oracle Reports Developer 12.2.1.19.0 is achievable by unauthenticated remote attackers over HTTP, though exploitation requires human interaction from a victim user. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, and successful exploitation yields complete confidentiality, integrity, and availability compromise of the target instance. Oracle classifies the flaw as 'easily exploitable' in its August 2026 Critical Patch Update; no public exploit has been identified and the vulnerability is not listed in CISA KEV, meaning active exploitation is not confirmed at time of analysis.
Unauthenticated remote compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows a network attacker to reach protected data and cross a trust boundary into other products. An attacker with only HTTP access can read all data accessible to Oracle Reports Developer and make limited unauthorized modifications, and because the flaw is scope-changing it can significantly impact additional products beyond Reports Developer itself. It carries a CVSS 3.1 base score of 9.3 and is addressed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis.
Remote takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets an unauthenticated network attacker fully compromise the product via UDP. Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote exploitation of Oracle Reports Developer 12.2.1.19.0 via SMTP allows attackers to perform unauthorized data manipulation and cause a partial denial of service against the affected instance. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, and carries a scope-change designation indicating that successful attacks may cascade to impact additional Oracle products sharing the same environment. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Reports Developer 12.2.1.19.0 can be fully compromised by low-privileged, authenticated attackers over HTTP, resulting in complete system takeover with full confidentiality, integrity, and availability loss. The flaw resides in the Security and Authentication component of Oracle Fusion Middleware, and carries a scope-changing impact - successful exploitation may cascade into additional Fusion Middleware products beyond Reports Developer itself. No public exploit code or CISA KEV listing exists at time of analysis; however, the full-takeover potential and cross-component scope change elevate this beyond typical high-complexity findings.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP via the Security and Authentication component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle describes successful attacks as resulting in complete takeover of the product. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable takeover profile makes it a high patch priority.
Improper access control in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated attackers positioned on the same network segment as the host to fully compromise confidentiality and integrity of all data accessible by the product, with scope change allowing impact to additional Oracle Fusion Middleware components. The vulnerability carries tags of Authentication Bypass and is tracked under CWE-284 (Improper Access Control). No public exploit code or CISA KEV entry exists at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low observed exploitation probability despite the high theoretical severity.
Full system takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by any low-privileged authenticated user with HTTP network access, exploiting a flaw in the Security and Authentication component of Oracle Fusion Middleware. Oracle classifies this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability impact - effectively equivalent to administrative compromise of the affected instance. No public exploit code or active exploitation has been identified at time of analysis, but the low attack barrier significantly narrows the defender's window.
Remote unauthenticated takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an attacker with network access via the IIOP protocol to fully compromise the product without credentials or user interaction. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, this was disclosed in Oracle's August 2026 Critical Patch Update (CPUAUG2026). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote, unauthenticated attacker reach and manipulate the reporting service over HTTP, gaining read access to all data the product can reach and the ability to create, delete, or modify that data. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and integrity impact but no availability impact, it was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw resides in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, but the trivial exploitability and complete-takeover outcome make this a high-priority patch.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible when a low-privileged attacker reaches the product over the network via the CORBA protocol, per Oracle's August 2026 Critical Patch Update. Because the flaw carries a scope change, successful exploitation can take over the Reports Developer instance and significantly impact other products beyond the vulnerable component, yielding full confidentiality, integrity, and availability loss (CVSS 3.1 base 9.9). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Oracle Customer Care (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 allows a high-privileged, remote attacker to achieve full confidentiality and integrity compromise via HTTP - with a confirmed scope change that can cascade to additional EBS products. Despite the PR:H requirement, the 'Authentication Bypass' tag suggests that controls within the authenticated context can be circumvented, enabling unauthorized read and write access to critical customer data. No public exploit code has been identified and CISA KEV listing is absent, but the 'easily exploitable' vendor qualifier and low attack complexity mean that any attacker who reaches this component with elevated credentials faces minimal technical barriers.
Oracle Partner Management versions 12.2.3 through 12.2.15 (within Oracle E-Business Suite) exposes a network-accessible authentication bypass in its Internal Operations component, allowing unauthenticated remote attackers to compromise the application via HTTP - subject to a single victim interaction. Successful exploitation yields high-confidence access to critical partner data and limited write capability, with a scope change that may laterally impact additional Oracle EBS modules beyond Partner Management itself. No active exploitation (CISA KEV) or public POC has been identified at time of analysis, but the low-complexity, unauthenticated attack surface warrants priority patching for internet-facing EBS deployments.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables an unauthenticated attacker physically co-located on the same network segment to read or modify all data accessible to the platform, with scope change indicating compromise can cascade to additional Oracle products. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) confirms the attack requires adjacency but no credentials, and exploitation difficulty is rated high. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Oracle Sales within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes an authorization flaw in its Internal Operations component that enables low-privileged authenticated network attackers to access all Oracle Sales data they should not be authorized to view, and perform limited unauthorized data manipulation via HTTP. The CVSS 3.1 score of 7.1 reflects a high confidentiality impact - complete access to all Oracle Sales accessible data - combined with a low integrity impact allowing unauthorized insert, update, or delete operations. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV, but the ease of exploitation (AC:L, no UI required) combined with the data sensitivity of a CRM/sales platform makes this a meaningful organizational risk.
Oracle Sales versions 12.2.3 through 12.2.15 within Oracle E-Business Suite allows low-privileged, network-authenticated attackers to gain full read and write access to critical data via the Internal Operations component over HTTP. The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impacts with low attack complexity, making this easily exploitable by any user with a valid low-privilege account. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; Oracle's Critical Security Patch Update for August 2026 addresses this flaw.
Unauthenticated remote data exposure in Oracle Trading Community (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a network attacker to bypass authentication in the Third Party Data Integration component via HTTP, gaining complete read access to all data accessible by Oracle Trading Community. The scope change (S:C) means a successful attack can cascade into other EBS modules or integrated downstream systems. Oracle's own advisory classifies this as 'easily exploitable,' and no public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero-authentication requirement make it a high-priority patching target.
Critical confidentiality and integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables low-privileged network attackers to exploit the Security component via SFTP, gaining unauthorized read and write access to all critical data within the system. The CVSS scope change indicator confirms that successful exploitation can cascade beyond the directly targeted instance, significantly impacting additional Oracle Hyperion products sharing the same environment. No public exploit identified at time of analysis, though the combination of an authentication bypass tag and high-impact dual confidentiality and integrity outcomes makes this a material risk for any organization running this EPM platform.
Unauthorized data access in Oracle Siebel CRM Integration versions 25.12 through 26.6 allows low-privileged network attackers to read all CRM-accessible data and perform limited data manipulation via HTTP against the Open Integration component, with a confirmed scope change extending impact to additional integrated products. The vulnerability is tagged by Oracle as an Authentication Bypass, enabling a valid but low-privileged account to exceed its authorized access boundaries without elevated complexity or user interaction. No public exploit has been identified at time of analysis, but the combination of low attack complexity, network accessibility, and scope change makes this a credible high-priority threat in enterprise Siebel deployments.
Oracle Siebel CRM Integration versions 25.12-26.6 exposes a high-severity authentication bypass in its Open Integration component that permits an unauthenticated attacker on the same physical network segment to fully read and modify all data accessible through the integration layer. The CVSS 8.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms low-complexity, credential-free exploitation, though the adjacent-network requirement materially constrains the attacker population to insiders or laterally-moved threat actors. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Integrity and availability compromise in Oracle Siebel CRM Integration's Open Integration component (versions 25.12 through 26.6) allows a high-privileged remote attacker over HTTP to corrupt or destroy critical data and trigger a complete denial of service, with confirmed scope change meaning successful exploitation may cascade into additional integrated downstream products. The attack requires high complexity and pre-existing administrative privileges, limiting opportunistic exploitation, but the cross-system blast radius elevates overall business risk. No public exploit code has been identified and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data disclosure in Oracle Siebel CRM Integration (versions 25.12 through 26.6) allows a low-privileged authenticated attacker to access critical or complete CRM data via HTTP by exploiting an authentication bypass in the Open Integration component. The scope change (S:C) in the CVSS vector means successful exploitation can extend data exposure beyond Siebel CRM Integration to additional integrated Oracle products. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and no user-interaction requirement make this readily actionable for any attacker holding even minimal valid credentials.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Affected releases span Siebel CRM Integration 25.12 through 26.6, and successful exploitation yields complete takeover of the Integration component with full confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a high-priority patch item.
Remote authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows unauthenticated network attackers via HTTP to achieve full confidentiality and integrity compromise of CRM data when a victim user interacts with attacker-controlled content. The vulnerability enables unauthorized read, create, delete, and modification access to all Siebel CRM Integration accessible data. Tagged as an Authentication Bypass by Oracle and scored CVSS 8.1 (High), no public exploit code or CISA KEV listing has been identified at time of analysis.
Siebel CRM Integration versions 25.12 through 26.6 expose a network-exploitable flaw in the Open Integration component that permits a low-privileged attacker to achieve full system takeover via crafted HTTP requests under high-complexity conditions. The CVSS 3.1 score of 8.5 reflects a scope change (S:C) alongside full confidentiality, integrity, and availability impact, meaning successful exploitation can cascade to other Oracle and third-party systems connected through the integration layer. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Security Patch Update.
Authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows a remote unauthenticated attacker reachable over HTTP to gain unauthorized read and write access to critical CRM data, with a confirmed scope change meaning successful exploitation can cascade to impact additional integrated systems beyond Siebel itself. The AC:H rating indicates exploitation is difficult and likely requires meeting specific environmental or timing conditions, tempering the urgency implied by the 8.7 CVSS score. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is achievable by a low-privileged, network-based attacker over HTTP, with a scope change that lets attacks significantly impact additional products beyond the vulnerable component. Affected releases span 25.12 through 26.6, and Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss (component takeover). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of low attack complexity, low privilege requirement, and scope change makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation in Oracle Siebel CRM's Data Archival component exposes critical CRM data to low-privileged network attackers via HTTP. Affected versions 25.12 through 26.6 allow an authenticated low-privileged user to gain complete read access to all Siebel CRM Administration accessible data and perform unauthorized write operations on a subset of that data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the 'Authentication Bypass' tag suggests the flaw enables privilege escalation beyond the attacker's authorized scope within the application.
Unauthenticated network exploitation of the Data Archival component in Oracle Siebel CRM Administration exposes complete CRM data to unauthorized access over HTTP. Affecting versions 25.12 through 26.6, the vulnerability carries a CVSS 3.1 score of 8.6 with a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle or integrated enterprise products beyond the Siebel CRM Administration interface itself. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this a high-priority patching target for any organization with internet-exposed Siebel administrative interfaces.
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticated attacker with only HTTP network access can fully compromise the module. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact, and it was disclosed in the August 2026 Oracle Critical Patch Update. At time of analysis there is no public exploit identified and no CISA KEV listing, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch for Siebel operators.
Privilege abuse and cross-product compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 lets an attacker holding only low-level network credentials read and tamper with all data the product can reach, and - because of a scope change - pivot to significantly impact additional Oracle Hyperion components beyond Calculation Manager. Oracle rates it CVSS 3.1 9.6 with high confidentiality and integrity impact but no availability impact, and the vendor tags it as an authentication-bypass-class flaw in the Security component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged authenticated user with logon access to the host to fully compromise the system, resulting in complete loss of confidentiality, integrity, and availability. The vulnerability resides in the Installation and Configuration component and is characterized by Oracle as 'easily exploitable,' with a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle August 2026 Critical Patch Update addresses this flaw.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a security bypass flaw in its Security component that allows low-privileged, authenticated network attackers to obtain unauthorized read access to critical or complete application data over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) confirms a scope change, meaning successful exploitation can propagate beyond Calculation Manager to compromise other Oracle Hyperion products in the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the vendor-tagged 'Authentication Bypass' classification and low attack complexity make this a credible risk for any enterprise running this EPM release.
Unauthenticated remote access to sensitive data is possible in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via an authentication bypass in the Installation and Configuration component exposed over HTTP. An attacker with network access can achieve complete read access to all data accessible by the Hyperion infrastructure layer without any credentials or user interaction. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog, but the trivial exploitation profile (AV:N/AC:L/PR:N/UI:N) represents a meaningful confidentiality risk for any organization running this specific version.
Unauthenticated remote information disclosure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes critical financial planning and performance management data over HTTP. The authentication bypass flaw in the Installation and Configuration component allows a network-adjacent attacker with no credentials to gain complete read access to all data accessible within the Hyperion environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-complexity, zero-authentication attack vector makes this a high-priority patching target for any enterprise running the affected version.
Unauthenticated remote exploitation of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via HTTP allows an attacker to read a subset of accessible data, perform unauthorized inserts, updates, or deletes, and cause a partial denial of service against the Installation and Configuration component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making this trivially reachable for any attacker with network access to the service. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized data exposure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows unauthenticated remote attackers to access critical or complete sensitive data via HTTP. The vulnerability resides in the Installation and Configuration component and is tagged as an authentication bypass, consistent with the CVSS PR:N rating. No public exploit has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a high-priority patching target for any organization running the affected version.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by an unauthenticated attacker positioned on the same physical network segment as the affected host, exploiting a flaw in the Installation and Configuration component. The CVSS vector confirms adjacent-network vector (AV:A) with high attack complexity (AC:H), meaning exploitation requires specific conditions but no credentials. Despite the adjacent-network constraint limiting broad internet exposure, successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible by a remote, unauthenticated attacker over HTTP against the Installation and Configuration component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit or CISA KEV listing has been identified at the time of analysis, so this is a pre-exploitation, patch-now situation rather than confirmed active exploitation.
Full product takeover in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Installation and Configuration component) allows a remote, unauthenticated attacker to compromise the platform over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and requires no user interaction. No public exploit is identified at time of analysis, but the trivially exploitable, network-facing nature makes it a top-tier patching priority for affected Oracle EPM deployments.
Complete takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible via HTTP by an unauthenticated remote attacker, per Oracle's Critical Patch Update of August 2026. The flaw resides in the Installation and Configuration component and carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication, low-complexity profile makes it a high-priority patch.
Full system takeover of Oracle Cost Management (versions 12.2.3-12.2.15) is achievable by a highly privileged network attacker via HTTP, resulting in complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Cost Planning component of Oracle E-Business Suite and is characterized by Oracle as 'easily exploitable' - meaning low attack complexity once credentials are obtained. No public exploit code or CISA KEV listing has been identified at time of analysis.
Complete takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible for a remote, unauthenticated attacker sending crafted HTTP requests to the Installation and Configuration component. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and was disclosed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network attack profile makes it a high-priority patch item.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes an unauthenticated authentication bypass over HTTPS in its Installation and Configuration component, enabling remote attackers to gain complete read access and full create, delete, or modify capabilities over all data accessible to the platform. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms no credentials or user interaction are required, though the High attack complexity means exploitation demands specific technical preconditions rather than trivial scanning. No public exploit code and no CISA KEV listing have been identified at time of analysis; the issue is formally acknowledged in Oracle's August 2026 Critical Security Patch Update advisory.
Local data compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables a low-privileged local OS user to fully breach confidentiality and integrity of all data accessible to the Hyperion platform via a flaw in the Installation and Configuration component. Tagged as an authentication bypass, the vulnerability suggests internal Hyperion access controls fail to restrict a minimally-privileged local account from accessing or manipulating critical data beyond its authorization. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a local privilege abuse path in its Installation and Configuration component, enabling a low-privileged authenticated user with system logon to gain unauthorized read and write access to all critical Hyperion data. The CVSS 3.1 score of 7.1 (High) reflects high confidentiality and integrity impacts, though the local attack vector constrains the attacker pool to insiders or those with pre-existing system access. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated network exploitation of Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows remote attackers to obtain complete unauthorized access to critical data, with confirmed scope change affecting additional Oracle Hyperion products beyond the directly targeted component. The vulnerability resides in the Installation and Configuration component, is tagged as an Authentication Bypass, and is accessible via multiple network protocols with no complexity barrier. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 3.1 base score of 8.6 reflects the elevated risk from scope change and high confidentiality impact. The Oracle August 2026 CSPU advisory (EUVD-2026-61533) is the primary disclosure source.
Full system takeover is achievable against Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via unauthenticated HTTP requests targeting the Lifecycle Management component. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network-exploitable, authentication-free access, though the high attack complexity (AC:H) suggests a non-trivial exploitation barrier such as a race condition, specific timing requirement, or environmental precondition. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis.
High-severity data disclosure and partial integrity compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged network attacker to gain complete unauthorized read access to all data accessible within the platform, with additional unauthorized insert, update, and delete capability against a subset of that data. The flaw resides in the Common Security component - the centralized authentication and authorization layer of the Hyperion EPM suite - and carries a CVSS scope-change indicator (S:C) confirming that successful exploitation can affect additional Hyperion products beyond the initially targeted component. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the cross-scope confidentiality and integrity impacts in a financial EPM context make it a meaningful business risk for affected organizations.
Privilege escalation to full takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.6) lets a low-privileged attacker with only HTTP network access fully compromise the application and, because of a scope change, meaningfully impact additional connected products. Oracle rates it CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact; it was disclosed in the Oracle Critical Patch Update of August 2026. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data access and modification in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by low-privileged network attackers via the Common Events component over HTTP. The vulnerability enables complete confidentiality and integrity compromise of all Hyperion-accessible data without requiring elevated privileges or user interaction, yielding a CVSS 3.1 base score of 8.1. Oracle addressed this issue in the August 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Full takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a remote unauthenticated attacker via HTTP, exploiting the Common Events component. The CVSS vector confirms no authentication or user interaction is required, though high attack complexity (AC:H) indicates exploitation is not trivial and likely requires specific timing, configuration state, or precise request crafting. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, consistent with a system takeover - no public exploit or CISA KEV listing identified at time of analysis.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a low-privileged attacker over HTTP, exploiting the Common Events component with no user interaction required. The CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact, consistent with the vendor's own characterization of the outcome as a complete system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a credible threat for any organization running the affected version.
Authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes the Common Security component to unauthenticated remote attackers over HTTPS, enabling complete read and write access to all Hyperion-accessible data. The high attack complexity (AC:H) constrains opportunistic exploitation, but successful attacks result in both full confidentiality and integrity compromise with no availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Purchasing (E-Business Suite component: Internal Operations), versions 12.2.3 through 12.2.15, exposes critical data to unauthorized read and write operations by low-privileged authenticated network attackers over HTTP. The vulnerability is tagged as an Authentication Bypass, suggesting that a user with minimal system privileges can circumvent authorization controls to access or manipulate purchasing data beyond their permitted scope - including complete confidentiality and integrity compromise of all Oracle Purchasing accessible data. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the low attack complexity and broad affected version range make this a meaningful priority for Oracle EBS deployments.
The Common Events component of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes an unauthenticated network-accessible attack path requiring victim interaction, enabling complete unauthorized read access to all Hyperion-accessible data and limited write capability through a scope-changing exploit. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) combined with the Authentication Bypass tag and scope change indicator is strongly consistent with a client-side injection flaw - such as reflected XSS or CSRF - in the Common Events interface that can hijack or bypass authenticated session controls. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Full system takeover is achievable in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via a network-accessible SQL attack vector targeting the Common Events component. A low-privileged authenticated attacker who can meet the high-complexity exploitation conditions may fully compromise confidentiality, integrity, and availability of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor-confirmed total impact - described explicitly as 'takeover' - warrants priority patching in any environment running the affected version.
Unauthorized data access and modification in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows authenticated low-privileged attackers to bypass access controls in the Common Security component via HTTP, gaining read and write access to all critical EPM platform data. The 'Authentication Bypass' tag combined with a PR:L CVSS vector indicates an authorization bypass scenario: a minimal valid account is required but is sufficient to exceed intended access boundaries across confidentiality and integrity dimensions. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, targeting the Common Events component. The CVSS 3.1 score of 8.1 reflects maximum CIA impact (C:H/I:H/A:H) offset by high attack complexity (AC:H), indicating that while no credentials are required, specific conditions must be met to exploit the vulnerability. No public exploit code or active exploitation has been identified at time of analysis, but Oracle's August 2026 CPU advisory confirms the issue and a patch is available.
Unauthorized data disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to exfiltrate critical or all accessible Hyperion data via crafted HTTP requests to the Common Events component. The CVSS scope change (S:C) indicates exploitation can cascade beyond the directly targeted component to impact additional Oracle Hyperion products sharing the infrastructure. No public exploit or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag suggests the flaw enables privilege escalation beyond the attacker's initial access level.
Privilege-escalating data compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Lifecycle Management component) lets a low-privileged attacker with HTTP network access read, create, modify, or delete critical data across the platform. The scope-change design means the flaw pivots beyond Hyperion to significantly impact additional connected products, and the vendor's own tag of 'Authentication Bypass' plus a CVSS 9.6 mark it as a high-priority Critical Patch Update item. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and network vector make it an attractive target.
Full system takeover of Oracle Work in Process (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The Internal Operations component contains an easily exploitable flaw that yields complete compromise of confidentiality, integrity, and availability - consistent with an application-level takeover. No public exploit or active exploitation has been identified at time of analysis; a vendor patch was released as part of the Oracle Critical Patch Update (CPU) August 2026.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a high-privileged, network-exploitable vulnerability in its Security component that enables complete unauthorized read access to all data accessible by the application, with additional limited integrity and availability impacts. The CVSS scope change (S:C) is a critical signal: successful exploitation can significantly affect other products within the same Oracle Hyperion suite deployment, amplifying organizational risk beyond the directly targeted component. No public exploit identified at time of analysis, and no CISA KEV listing; however, the combination of scope change and high confidentiality impact warrants prioritization in Oracle Hyperion deployments.
Oracle Work in Process (WIP) versions 12.2.3 through 12.2.15, a manufacturing module within Oracle E-Business Suite, exposes its Internal Operations component over HTTP to low-privileged authenticated attackers who can trigger a complete service hang or crash alongside unauthorized data modification. The attack requires no user interaction and is characterized as easily exploitable by Oracle's own advisory language, giving it outsized operational impact for manufacturing environments dependent on WIP for production scheduling. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Full product takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Common Events component) is possible by an unauthenticated remote attacker sending crafted HTTP requests. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable exploitation with no privileges or user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the 9.8 base score and unauthenticated nature make it a high-priority patch target.
Compromise of Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by a low-privileged, network-authenticated attacker over HTTP targeting the Siebel Cloud Manager component. Successful exploitation yields unauthorized creation, deletion, or modification of critical CRM data (high integrity impact), partial unauthorized read of CRM data (low confidentiality impact), and the ability to cause a complete, repeatable denial-of-service crash of the application. No public exploit code and no CISA KEV listing are confirmed at time of analysis; EPSS data was not supplied in the source intelligence.
Local privilege escalation in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the application via the Siebel Cloud Manager component. Successful exploitation results in complete application takeover with high confidentiality, integrity, and availability impacts. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible through the Siebel Cloud Manager component via crafted HTTP requests, requiring no privileges or user interaction. An attacker can gain full read access to all Siebel CRM Cloud data, perform limited unauthorized writes, and cause a partial denial of service, and because the flaw carries a scope change, exploitation can significantly impact additional connected products beyond Siebel itself. Rated CVSS 9.9; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Flow Manufacturing versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains a vulnerability in its Internal Operations component that allows a low-privileged, network-authenticated attacker to fully compromise the system via HTTP with no user interaction required. The vendor characterizes this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete loss of confidentiality, integrity, and availability - constituting a full product takeover rather than the narrower 'Information Disclosure' tag in the intelligence metadata would suggest. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Full takeover of Oracle Work in Process (WIP), a manufacturing execution module in Oracle E-Business Suite, is achievable by a low-privileged local attacker exploiting a flaw in the Internal Operations component across versions 12.2.3 through 12.2.15. The CVSS vector (AV:L/AC:H/PR:L) constrains exploitation to authenticated infrastructure-level access with high attack complexity, significantly limiting opportunistic or remote attack paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, successful exploitation yields complete compromise of confidentiality, integrity, and availability of the WIP instance.
Oracle Email Center versions 12.2.3 through 12.2.15 contains a network-exploitable authentication bypass in its Message Component that allows unauthenticated remote attackers to gain unauthorized access to critical data and perform limited data manipulation via HTTP, contingent on victim user interaction. The scope change embedded in the CVSS vector (S:C) indicates successful exploitation can extend impact beyond Email Center to other Oracle E-Business Suite components, materially amplifying real-world risk beyond the immediate application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this vulnerability in the August 2026 Critical Patch Update.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component allows complete read and write access to all CRM data without credentials. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms low-complexity, zero-authentication exploitation, constrained only by the requirement for physical or logical adjacency to the target network segment. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the authentication bypass tag and high integrity/confidentiality impact make this a serious concern for any environment with exposed CRM infrastructure.
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileged, network-accessible attacker via HTTP against the Siebel Cloud Manager component, with no user interaction required. Oracle classifies this as 'easily exploitable' and the CVSS vector confirms high impact across confidentiality, integrity, and availability - consistent with a complete system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across four years of releases materially raises real-world risk for unpatched enterprise deployments.
Oracle MES for Process Manufacturing versions 12.2.3 through 12.2.15 exposes unauthenticated remote attackers to complete confidentiality compromise and partial integrity loss via HTTP, contingent on a victim's interaction. The scope change in the CVSS vector confirms that a successful attack can cascade beyond the MES module itself into additional Oracle E-Business Suite components. No public exploit code or CISA KEV active-exploitation confirmation exists at time of analysis, but the low attack complexity and zero privilege requirement make this a credible phishing or watering-hole vector against manufacturing-sector targets.
Local privilege abuse in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) allows a low-privileged OS-level user on the hosting infrastructure to compromise the Siebel Cloud Manager component, achieving full read access to all CRM application data and limited write access, with a confirmed scope change extending impact to additional co-hosted products. The attack vector is local infrastructure access, making this primarily an insider threat or post-compromise lateral movement risk rather than an external internet-facing exposure. No public exploit has been identified, and Oracle addressed this vulnerability in the August 2026 Critical Patch Update (CPU Aug 2026).
High-privileged remote exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component enables full confidentiality and integrity compromise of Siebel data, with a documented scope change allowing cascading impact on additional Oracle products in the environment. Oracle's August 2026 Critical Security Patch Update discloses a CVSS 3.1 base score of 8.7, reflecting network-accessible exploitation requiring no interaction but demanding high-privilege credentials. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data disclosure in Oracle Financials Common Modules (Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged authenticated attacker with HTTP network access to bypass access controls in the Common Components layer, gaining unauthorized read access to critical or complete financial data. The scope change (S:C) confirmed in the CVSS vector means successful exploitation can cascade into data exposure across additional Oracle EBS products beyond the directly vulnerable module. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this a straightforward exploitation path for any authenticated EBS user.
Full takeover of Oracle Reports Developer 14.1.2.0.0 (a component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, carrying a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact. Disclosed in Oracle's August 2026 Critical Patch Update (cross-referenced as ENISA EUVD-2026-61615), the flaw sits in the Security and Authentication component and permits complete compromise of the product without credentials or user interaction. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over HTTP against the Security and Authentication component, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with high confidentiality, integrity, and availability impact, describing 'takeover' of the product. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch.
Unauthenticated remote compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows attackers with only HTTP network access to tamper with or destroy critical data, read a subset of accessible data, and force a complete denial of service. Oracle rates this CVSS 9.4, reflecting high integrity and availability impact combined with trivial exploitability and no authentication requirement. No public exploit identified at time of analysis, but the low-complexity, no-privileges vector makes it a high-priority patch from Oracle's August 2026 Critical Patch Update.
Authentication bypass in Oracle Reports Developer 12.2.1.19.0 exposes critical data to unauthenticated remote attackers over TCP, with a scope change confirmed by the vendor meaning downstream Oracle Fusion Middleware components can also be compromised. The CVSS 3.1 score of 8.6 reflects a network-accessible, zero-interaction attack path yielding high confidentiality impact across system boundaries. No public exploit code has been identified at time of analysis, though the vendor's own 'easily exploitable' classification substantially lowers the operational barrier for threat actors.
Oracle Reports Developer 12.2.1.19.0, a component of Oracle Fusion Middleware, exposes a network-exploitable authentication/security bypass in its Security and Authentication component that allows a low-privileged attacker to gain complete unauthorized read access to all data accessible by the application and limited write access to some data. The scope change (S:C) in the CVSS vector confirms that a successful attack can cascade and significantly impact additional products beyond Oracle Reports Developer itself. No public exploit code or active exploitation has been identified at time of analysis, and Oracle classifies this as difficult to exploit (AC:H).
Complete takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by a remote, unauthenticated attacker over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the product's Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch.
Unauthenticated remote compromise of Oracle Reports Developer 12.2.1.19.0 is achievable via crafted SOAP requests targeting the Security and Authentication component, confirming an authentication bypass condition. The CVSS 3.1 vector (PR:N, AV:N, AC:L) indicates no credentials or user interaction are required, and the high confidentiality impact reflects full data exposure across all data accessible to the Reports Developer service. Additionally, limited integrity and availability degradation are possible, making this a high-priority patch candidate for any Oracle Fusion Middleware deployment running this version. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full compromise of Oracle Reports Developer 12.2.1.19.0 is possible when an unauthenticated attacker reaches the product over the network via the IIOP protocol, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields complete takeover with high confidentiality, integrity, and availability impact (CVSS 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Remote takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with network access over the IIOP protocol to fully compromise the product, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible via a Security and Authentication component flaw that lets a remote attacker take over the product over TCP without credentials or user interaction. Oracle rates it CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch in the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Reports Developer 12.2.1.19.0 exposes all data accessible to the application via HTTP, with confirmed scope change that can impact additional downstream products within the Oracle Fusion Middleware environment. The vulnerability resides in the Security and Authentication component and is tagged as an authentication bypass, meaning attackers require no credentials to exploit it. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to exploit once a target instance is reachable.
Full system takeover in Oracle Reports Developer 12.2.1.19.0 is achievable by unauthenticated remote attackers over HTTP, though exploitation requires human interaction from a victim user. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, and successful exploitation yields complete confidentiality, integrity, and availability compromise of the target instance. Oracle classifies the flaw as 'easily exploitable' in its August 2026 Critical Patch Update; no public exploit has been identified and the vulnerability is not listed in CISA KEV, meaning active exploitation is not confirmed at time of analysis.
Unauthenticated remote compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows a network attacker to reach protected data and cross a trust boundary into other products. An attacker with only HTTP access can read all data accessible to Oracle Reports Developer and make limited unauthorized modifications, and because the flaw is scope-changing it can significantly impact additional products beyond Reports Developer itself. It carries a CVSS 3.1 base score of 9.3 and is addressed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis.
Remote takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets an unauthenticated network attacker fully compromise the product via UDP. Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote exploitation of Oracle Reports Developer 12.2.1.19.0 via SMTP allows attackers to perform unauthorized data manipulation and cause a partial denial of service against the affected instance. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, and carries a scope-change designation indicating that successful attacks may cascade to impact additional Oracle products sharing the same environment. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Reports Developer 12.2.1.19.0 can be fully compromised by low-privileged, authenticated attackers over HTTP, resulting in complete system takeover with full confidentiality, integrity, and availability loss. The flaw resides in the Security and Authentication component of Oracle Fusion Middleware, and carries a scope-changing impact - successful exploitation may cascade into additional Fusion Middleware products beyond Reports Developer itself. No public exploit code or CISA KEV listing exists at time of analysis; however, the full-takeover potential and cross-component scope change elevate this beyond typical high-complexity findings.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP via the Security and Authentication component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle describes successful attacks as resulting in complete takeover of the product. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable takeover profile makes it a high patch priority.
Improper access control in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated attackers positioned on the same network segment as the host to fully compromise confidentiality and integrity of all data accessible by the product, with scope change allowing impact to additional Oracle Fusion Middleware components. The vulnerability carries tags of Authentication Bypass and is tracked under CWE-284 (Improper Access Control). No public exploit code or CISA KEV entry exists at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low observed exploitation probability despite the high theoretical severity.
Full system takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by any low-privileged authenticated user with HTTP network access, exploiting a flaw in the Security and Authentication component of Oracle Fusion Middleware. Oracle classifies this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability impact - effectively equivalent to administrative compromise of the affected instance. No public exploit code or active exploitation has been identified at time of analysis, but the low attack barrier significantly narrows the defender's window.
Remote unauthenticated takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an attacker with network access via the IIOP protocol to fully compromise the product without credentials or user interaction. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, this was disclosed in Oracle's August 2026 Critical Patch Update (CPUAUG2026). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote, unauthenticated attacker reach and manipulate the reporting service over HTTP, gaining read access to all data the product can reach and the ability to create, delete, or modify that data. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and integrity impact but no availability impact, it was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw resides in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, but the trivial exploitability and complete-takeover outcome make this a high-priority patch.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible when a low-privileged attacker reaches the product over the network via the CORBA protocol, per Oracle's August 2026 Critical Patch Update. Because the flaw carries a scope change, successful exploitation can take over the Reports Developer instance and significantly impact other products beyond the vulnerable component, yielding full confidentiality, integrity, and availability loss (CVSS 3.1 base 9.9). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Oracle Customer Care (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 allows a high-privileged, remote attacker to achieve full confidentiality and integrity compromise via HTTP - with a confirmed scope change that can cascade to additional EBS products. Despite the PR:H requirement, the 'Authentication Bypass' tag suggests that controls within the authenticated context can be circumvented, enabling unauthorized read and write access to critical customer data. No public exploit code has been identified and CISA KEV listing is absent, but the 'easily exploitable' vendor qualifier and low attack complexity mean that any attacker who reaches this component with elevated credentials faces minimal technical barriers.
Oracle Partner Management versions 12.2.3 through 12.2.15 (within Oracle E-Business Suite) exposes a network-accessible authentication bypass in its Internal Operations component, allowing unauthenticated remote attackers to compromise the application via HTTP - subject to a single victim interaction. Successful exploitation yields high-confidence access to critical partner data and limited write capability, with a scope change that may laterally impact additional Oracle EBS modules beyond Partner Management itself. No active exploitation (CISA KEV) or public POC has been identified at time of analysis, but the low-complexity, unauthenticated attack surface warrants priority patching for internet-facing EBS deployments.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables an unauthenticated attacker physically co-located on the same network segment to read or modify all data accessible to the platform, with scope change indicating compromise can cascade to additional Oracle products. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) confirms the attack requires adjacency but no credentials, and exploitation difficulty is rated high. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Oracle Sales within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes an authorization flaw in its Internal Operations component that enables low-privileged authenticated network attackers to access all Oracle Sales data they should not be authorized to view, and perform limited unauthorized data manipulation via HTTP. The CVSS 3.1 score of 7.1 reflects a high confidentiality impact - complete access to all Oracle Sales accessible data - combined with a low integrity impact allowing unauthorized insert, update, or delete operations. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV, but the ease of exploitation (AC:L, no UI required) combined with the data sensitivity of a CRM/sales platform makes this a meaningful organizational risk.
Oracle Sales versions 12.2.3 through 12.2.15 within Oracle E-Business Suite allows low-privileged, network-authenticated attackers to gain full read and write access to critical data via the Internal Operations component over HTTP. The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impacts with low attack complexity, making this easily exploitable by any user with a valid low-privilege account. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; Oracle's Critical Security Patch Update for August 2026 addresses this flaw.
Unauthenticated remote data exposure in Oracle Trading Community (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a network attacker to bypass authentication in the Third Party Data Integration component via HTTP, gaining complete read access to all data accessible by Oracle Trading Community. The scope change (S:C) means a successful attack can cascade into other EBS modules or integrated downstream systems. Oracle's own advisory classifies this as 'easily exploitable,' and no public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero-authentication requirement make it a high-priority patching target.
Critical confidentiality and integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables low-privileged network attackers to exploit the Security component via SFTP, gaining unauthorized read and write access to all critical data within the system. The CVSS scope change indicator confirms that successful exploitation can cascade beyond the directly targeted instance, significantly impacting additional Oracle Hyperion products sharing the same environment. No public exploit identified at time of analysis, though the combination of an authentication bypass tag and high-impact dual confidentiality and integrity outcomes makes this a material risk for any organization running this EPM platform.
Unauthorized data access in Oracle Siebel CRM Integration versions 25.12 through 26.6 allows low-privileged network attackers to read all CRM-accessible data and perform limited data manipulation via HTTP against the Open Integration component, with a confirmed scope change extending impact to additional integrated products. The vulnerability is tagged by Oracle as an Authentication Bypass, enabling a valid but low-privileged account to exceed its authorized access boundaries without elevated complexity or user interaction. No public exploit has been identified at time of analysis, but the combination of low attack complexity, network accessibility, and scope change makes this a credible high-priority threat in enterprise Siebel deployments.
Oracle Siebel CRM Integration versions 25.12-26.6 exposes a high-severity authentication bypass in its Open Integration component that permits an unauthenticated attacker on the same physical network segment to fully read and modify all data accessible through the integration layer. The CVSS 8.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms low-complexity, credential-free exploitation, though the adjacent-network requirement materially constrains the attacker population to insiders or laterally-moved threat actors. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Integrity and availability compromise in Oracle Siebel CRM Integration's Open Integration component (versions 25.12 through 26.6) allows a high-privileged remote attacker over HTTP to corrupt or destroy critical data and trigger a complete denial of service, with confirmed scope change meaning successful exploitation may cascade into additional integrated downstream products. The attack requires high complexity and pre-existing administrative privileges, limiting opportunistic exploitation, but the cross-system blast radius elevates overall business risk. No public exploit code has been identified and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data disclosure in Oracle Siebel CRM Integration (versions 25.12 through 26.6) allows a low-privileged authenticated attacker to access critical or complete CRM data via HTTP by exploiting an authentication bypass in the Open Integration component. The scope change (S:C) in the CVSS vector means successful exploitation can extend data exposure beyond Siebel CRM Integration to additional integrated Oracle products. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and no user-interaction requirement make this readily actionable for any attacker holding even minimal valid credentials.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Affected releases span Siebel CRM Integration 25.12 through 26.6, and successful exploitation yields complete takeover of the Integration component with full confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a high-priority patch item.
Remote authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows unauthenticated network attackers via HTTP to achieve full confidentiality and integrity compromise of CRM data when a victim user interacts with attacker-controlled content. The vulnerability enables unauthorized read, create, delete, and modification access to all Siebel CRM Integration accessible data. Tagged as an Authentication Bypass by Oracle and scored CVSS 8.1 (High), no public exploit code or CISA KEV listing has been identified at time of analysis.
Siebel CRM Integration versions 25.12 through 26.6 expose a network-exploitable flaw in the Open Integration component that permits a low-privileged attacker to achieve full system takeover via crafted HTTP requests under high-complexity conditions. The CVSS 3.1 score of 8.5 reflects a scope change (S:C) alongside full confidentiality, integrity, and availability impact, meaning successful exploitation can cascade to other Oracle and third-party systems connected through the integration layer. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Security Patch Update.
Authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows a remote unauthenticated attacker reachable over HTTP to gain unauthorized read and write access to critical CRM data, with a confirmed scope change meaning successful exploitation can cascade to impact additional integrated systems beyond Siebel itself. The AC:H rating indicates exploitation is difficult and likely requires meeting specific environmental or timing conditions, tempering the urgency implied by the 8.7 CVSS score. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is achievable by a low-privileged, network-based attacker over HTTP, with a scope change that lets attacks significantly impact additional products beyond the vulnerable component. Affected releases span 25.12 through 26.6, and Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss (component takeover). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of low attack complexity, low privilege requirement, and scope change makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation in Oracle Siebel CRM's Data Archival component exposes critical CRM data to low-privileged network attackers via HTTP. Affected versions 25.12 through 26.6 allow an authenticated low-privileged user to gain complete read access to all Siebel CRM Administration accessible data and perform unauthorized write operations on a subset of that data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the 'Authentication Bypass' tag suggests the flaw enables privilege escalation beyond the attacker's authorized scope within the application.
Unauthenticated network exploitation of the Data Archival component in Oracle Siebel CRM Administration exposes complete CRM data to unauthorized access over HTTP. Affecting versions 25.12 through 26.6, the vulnerability carries a CVSS 3.1 score of 8.6 with a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle or integrated enterprise products beyond the Siebel CRM Administration interface itself. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this a high-priority patching target for any organization with internet-exposed Siebel administrative interfaces.
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticated attacker with only HTTP network access can fully compromise the module. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact, and it was disclosed in the August 2026 Oracle Critical Patch Update. At time of analysis there is no public exploit identified and no CISA KEV listing, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch for Siebel operators.
Privilege abuse and cross-product compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 lets an attacker holding only low-level network credentials read and tamper with all data the product can reach, and - because of a scope change - pivot to significantly impact additional Oracle Hyperion components beyond Calculation Manager. Oracle rates it CVSS 3.1 9.6 with high confidentiality and integrity impact but no availability impact, and the vendor tags it as an authentication-bypass-class flaw in the Security component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged authenticated user with logon access to the host to fully compromise the system, resulting in complete loss of confidentiality, integrity, and availability. The vulnerability resides in the Installation and Configuration component and is characterized by Oracle as 'easily exploitable,' with a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle August 2026 Critical Patch Update addresses this flaw.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a security bypass flaw in its Security component that allows low-privileged, authenticated network attackers to obtain unauthorized read access to critical or complete application data over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) confirms a scope change, meaning successful exploitation can propagate beyond Calculation Manager to compromise other Oracle Hyperion products in the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the vendor-tagged 'Authentication Bypass' classification and low attack complexity make this a credible risk for any enterprise running this EPM release.
Unauthenticated remote access to sensitive data is possible in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via an authentication bypass in the Installation and Configuration component exposed over HTTP. An attacker with network access can achieve complete read access to all data accessible by the Hyperion infrastructure layer without any credentials or user interaction. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog, but the trivial exploitation profile (AV:N/AC:L/PR:N/UI:N) represents a meaningful confidentiality risk for any organization running this specific version.
Unauthenticated remote information disclosure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes critical financial planning and performance management data over HTTP. The authentication bypass flaw in the Installation and Configuration component allows a network-adjacent attacker with no credentials to gain complete read access to all data accessible within the Hyperion environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-complexity, zero-authentication attack vector makes this a high-priority patching target for any enterprise running the affected version.
Unauthenticated remote exploitation of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via HTTP allows an attacker to read a subset of accessible data, perform unauthorized inserts, updates, or deletes, and cause a partial denial of service against the Installation and Configuration component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making this trivially reachable for any attacker with network access to the service. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized data exposure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows unauthenticated remote attackers to access critical or complete sensitive data via HTTP. The vulnerability resides in the Installation and Configuration component and is tagged as an authentication bypass, consistent with the CVSS PR:N rating. No public exploit has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a high-priority patching target for any organization running the affected version.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by an unauthenticated attacker positioned on the same physical network segment as the affected host, exploiting a flaw in the Installation and Configuration component. The CVSS vector confirms adjacent-network vector (AV:A) with high attack complexity (AC:H), meaning exploitation requires specific conditions but no credentials. Despite the adjacent-network constraint limiting broad internet exposure, successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible by a remote, unauthenticated attacker over HTTP against the Installation and Configuration component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit or CISA KEV listing has been identified at the time of analysis, so this is a pre-exploitation, patch-now situation rather than confirmed active exploitation.
Full product takeover in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Installation and Configuration component) allows a remote, unauthenticated attacker to compromise the platform over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and requires no user interaction. No public exploit is identified at time of analysis, but the trivially exploitable, network-facing nature makes it a top-tier patching priority for affected Oracle EPM deployments.
Complete takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible via HTTP by an unauthenticated remote attacker, per Oracle's Critical Patch Update of August 2026. The flaw resides in the Installation and Configuration component and carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication, low-complexity profile makes it a high-priority patch.
Full system takeover of Oracle Cost Management (versions 12.2.3-12.2.15) is achievable by a highly privileged network attacker via HTTP, resulting in complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Cost Planning component of Oracle E-Business Suite and is characterized by Oracle as 'easily exploitable' - meaning low attack complexity once credentials are obtained. No public exploit code or CISA KEV listing has been identified at time of analysis.
Complete takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible for a remote, unauthenticated attacker sending crafted HTTP requests to the Installation and Configuration component. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and was disclosed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network attack profile makes it a high-priority patch item.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes an unauthenticated authentication bypass over HTTPS in its Installation and Configuration component, enabling remote attackers to gain complete read access and full create, delete, or modify capabilities over all data accessible to the platform. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms no credentials or user interaction are required, though the High attack complexity means exploitation demands specific technical preconditions rather than trivial scanning. No public exploit code and no CISA KEV listing have been identified at time of analysis; the issue is formally acknowledged in Oracle's August 2026 Critical Security Patch Update advisory.
Local data compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables a low-privileged local OS user to fully breach confidentiality and integrity of all data accessible to the Hyperion platform via a flaw in the Installation and Configuration component. Tagged as an authentication bypass, the vulnerability suggests internal Hyperion access controls fail to restrict a minimally-privileged local account from accessing or manipulating critical data beyond its authorization. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a local privilege abuse path in its Installation and Configuration component, enabling a low-privileged authenticated user with system logon to gain unauthorized read and write access to all critical Hyperion data. The CVSS 3.1 score of 7.1 (High) reflects high confidentiality and integrity impacts, though the local attack vector constrains the attacker pool to insiders or those with pre-existing system access. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated network exploitation of Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows remote attackers to obtain complete unauthorized access to critical data, with confirmed scope change affecting additional Oracle Hyperion products beyond the directly targeted component. The vulnerability resides in the Installation and Configuration component, is tagged as an Authentication Bypass, and is accessible via multiple network protocols with no complexity barrier. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 3.1 base score of 8.6 reflects the elevated risk from scope change and high confidentiality impact. The Oracle August 2026 CSPU advisory (EUVD-2026-61533) is the primary disclosure source.
Full system takeover is achievable against Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via unauthenticated HTTP requests targeting the Lifecycle Management component. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network-exploitable, authentication-free access, though the high attack complexity (AC:H) suggests a non-trivial exploitation barrier such as a race condition, specific timing requirement, or environmental precondition. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis.
High-severity data disclosure and partial integrity compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged network attacker to gain complete unauthorized read access to all data accessible within the platform, with additional unauthorized insert, update, and delete capability against a subset of that data. The flaw resides in the Common Security component - the centralized authentication and authorization layer of the Hyperion EPM suite - and carries a CVSS scope-change indicator (S:C) confirming that successful exploitation can affect additional Hyperion products beyond the initially targeted component. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the cross-scope confidentiality and integrity impacts in a financial EPM context make it a meaningful business risk for affected organizations.
Privilege escalation to full takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.6) lets a low-privileged attacker with only HTTP network access fully compromise the application and, because of a scope change, meaningfully impact additional connected products. Oracle rates it CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact; it was disclosed in the Oracle Critical Patch Update of August 2026. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data access and modification in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by low-privileged network attackers via the Common Events component over HTTP. The vulnerability enables complete confidentiality and integrity compromise of all Hyperion-accessible data without requiring elevated privileges or user interaction, yielding a CVSS 3.1 base score of 8.1. Oracle addressed this issue in the August 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Full takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a remote unauthenticated attacker via HTTP, exploiting the Common Events component. The CVSS vector confirms no authentication or user interaction is required, though high attack complexity (AC:H) indicates exploitation is not trivial and likely requires specific timing, configuration state, or precise request crafting. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, consistent with a system takeover - no public exploit or CISA KEV listing identified at time of analysis.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a low-privileged attacker over HTTP, exploiting the Common Events component with no user interaction required. The CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact, consistent with the vendor's own characterization of the outcome as a complete system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a credible threat for any organization running the affected version.
Authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes the Common Security component to unauthenticated remote attackers over HTTPS, enabling complete read and write access to all Hyperion-accessible data. The high attack complexity (AC:H) constrains opportunistic exploitation, but successful attacks result in both full confidentiality and integrity compromise with no availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Purchasing (E-Business Suite component: Internal Operations), versions 12.2.3 through 12.2.15, exposes critical data to unauthorized read and write operations by low-privileged authenticated network attackers over HTTP. The vulnerability is tagged as an Authentication Bypass, suggesting that a user with minimal system privileges can circumvent authorization controls to access or manipulate purchasing data beyond their permitted scope - including complete confidentiality and integrity compromise of all Oracle Purchasing accessible data. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the low attack complexity and broad affected version range make this a meaningful priority for Oracle EBS deployments.
The Common Events component of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes an unauthenticated network-accessible attack path requiring victim interaction, enabling complete unauthorized read access to all Hyperion-accessible data and limited write capability through a scope-changing exploit. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) combined with the Authentication Bypass tag and scope change indicator is strongly consistent with a client-side injection flaw - such as reflected XSS or CSRF - in the Common Events interface that can hijack or bypass authenticated session controls. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Full system takeover is achievable in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via a network-accessible SQL attack vector targeting the Common Events component. A low-privileged authenticated attacker who can meet the high-complexity exploitation conditions may fully compromise confidentiality, integrity, and availability of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor-confirmed total impact - described explicitly as 'takeover' - warrants priority patching in any environment running the affected version.
Unauthorized data access and modification in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows authenticated low-privileged attackers to bypass access controls in the Common Security component via HTTP, gaining read and write access to all critical EPM platform data. The 'Authentication Bypass' tag combined with a PR:L CVSS vector indicates an authorization bypass scenario: a minimal valid account is required but is sufficient to exceed intended access boundaries across confidentiality and integrity dimensions. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, targeting the Common Events component. The CVSS 3.1 score of 8.1 reflects maximum CIA impact (C:H/I:H/A:H) offset by high attack complexity (AC:H), indicating that while no credentials are required, specific conditions must be met to exploit the vulnerability. No public exploit code or active exploitation has been identified at time of analysis, but Oracle's August 2026 CPU advisory confirms the issue and a patch is available.
Unauthorized data disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to exfiltrate critical or all accessible Hyperion data via crafted HTTP requests to the Common Events component. The CVSS scope change (S:C) indicates exploitation can cascade beyond the directly targeted component to impact additional Oracle Hyperion products sharing the infrastructure. No public exploit or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag suggests the flaw enables privilege escalation beyond the attacker's initial access level.
Privilege-escalating data compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Lifecycle Management component) lets a low-privileged attacker with HTTP network access read, create, modify, or delete critical data across the platform. The scope-change design means the flaw pivots beyond Hyperion to significantly impact additional connected products, and the vendor's own tag of 'Authentication Bypass' plus a CVSS 9.6 mark it as a high-priority Critical Patch Update item. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and network vector make it an attractive target.
Full system takeover of Oracle Work in Process (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The Internal Operations component contains an easily exploitable flaw that yields complete compromise of confidentiality, integrity, and availability - consistent with an application-level takeover. No public exploit or active exploitation has been identified at time of analysis; a vendor patch was released as part of the Oracle Critical Patch Update (CPU) August 2026.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a high-privileged, network-exploitable vulnerability in its Security component that enables complete unauthorized read access to all data accessible by the application, with additional limited integrity and availability impacts. The CVSS scope change (S:C) is a critical signal: successful exploitation can significantly affect other products within the same Oracle Hyperion suite deployment, amplifying organizational risk beyond the directly targeted component. No public exploit identified at time of analysis, and no CISA KEV listing; however, the combination of scope change and high confidentiality impact warrants prioritization in Oracle Hyperion deployments.
Oracle Work in Process (WIP) versions 12.2.3 through 12.2.15, a manufacturing module within Oracle E-Business Suite, exposes its Internal Operations component over HTTP to low-privileged authenticated attackers who can trigger a complete service hang or crash alongside unauthorized data modification. The attack requires no user interaction and is characterized as easily exploitable by Oracle's own advisory language, giving it outsized operational impact for manufacturing environments dependent on WIP for production scheduling. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Full product takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Common Events component) is possible by an unauthenticated remote attacker sending crafted HTTP requests. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable exploitation with no privileges or user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the 9.8 base score and unauthenticated nature make it a high-priority patch target.
Compromise of Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by a low-privileged, network-authenticated attacker over HTTP targeting the Siebel Cloud Manager component. Successful exploitation yields unauthorized creation, deletion, or modification of critical CRM data (high integrity impact), partial unauthorized read of CRM data (low confidentiality impact), and the ability to cause a complete, repeatable denial-of-service crash of the application. No public exploit code and no CISA KEV listing are confirmed at time of analysis; EPSS data was not supplied in the source intelligence.
Local privilege escalation in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the application via the Siebel Cloud Manager component. Successful exploitation results in complete application takeover with high confidentiality, integrity, and availability impacts. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible through the Siebel Cloud Manager component via crafted HTTP requests, requiring no privileges or user interaction. An attacker can gain full read access to all Siebel CRM Cloud data, perform limited unauthorized writes, and cause a partial denial of service, and because the flaw carries a scope change, exploitation can significantly impact additional connected products beyond Siebel itself. Rated CVSS 9.9; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Flow Manufacturing versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains a vulnerability in its Internal Operations component that allows a low-privileged, network-authenticated attacker to fully compromise the system via HTTP with no user interaction required. The vendor characterizes this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete loss of confidentiality, integrity, and availability - constituting a full product takeover rather than the narrower 'Information Disclosure' tag in the intelligence metadata would suggest. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Full takeover of Oracle Work in Process (WIP), a manufacturing execution module in Oracle E-Business Suite, is achievable by a low-privileged local attacker exploiting a flaw in the Internal Operations component across versions 12.2.3 through 12.2.15. The CVSS vector (AV:L/AC:H/PR:L) constrains exploitation to authenticated infrastructure-level access with high attack complexity, significantly limiting opportunistic or remote attack paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, successful exploitation yields complete compromise of confidentiality, integrity, and availability of the WIP instance.
Oracle Email Center versions 12.2.3 through 12.2.15 contains a network-exploitable authentication bypass in its Message Component that allows unauthenticated remote attackers to gain unauthorized access to critical data and perform limited data manipulation via HTTP, contingent on victim user interaction. The scope change embedded in the CVSS vector (S:C) indicates successful exploitation can extend impact beyond Email Center to other Oracle E-Business Suite components, materially amplifying real-world risk beyond the immediate application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this vulnerability in the August 2026 Critical Patch Update.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component allows complete read and write access to all CRM data without credentials. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms low-complexity, zero-authentication exploitation, constrained only by the requirement for physical or logical adjacency to the target network segment. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the authentication bypass tag and high integrity/confidentiality impact make this a serious concern for any environment with exposed CRM infrastructure.
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileged, network-accessible attacker via HTTP against the Siebel Cloud Manager component, with no user interaction required. Oracle classifies this as 'easily exploitable' and the CVSS vector confirms high impact across confidentiality, integrity, and availability - consistent with a complete system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across four years of releases materially raises real-world risk for unpatched enterprise deployments.
Oracle MES for Process Manufacturing versions 12.2.3 through 12.2.15 exposes unauthenticated remote attackers to complete confidentiality compromise and partial integrity loss via HTTP, contingent on a victim's interaction. The scope change in the CVSS vector confirms that a successful attack can cascade beyond the MES module itself into additional Oracle E-Business Suite components. No public exploit code or CISA KEV active-exploitation confirmation exists at time of analysis, but the low attack complexity and zero privilege requirement make this a credible phishing or watering-hole vector against manufacturing-sector targets.
Local privilege abuse in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) allows a low-privileged OS-level user on the hosting infrastructure to compromise the Siebel Cloud Manager component, achieving full read access to all CRM application data and limited write access, with a confirmed scope change extending impact to additional co-hosted products. The attack vector is local infrastructure access, making this primarily an insider threat or post-compromise lateral movement risk rather than an external internet-facing exposure. No public exploit has been identified, and Oracle addressed this vulnerability in the August 2026 Critical Patch Update (CPU Aug 2026).
High-privileged remote exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component enables full confidentiality and integrity compromise of Siebel data, with a documented scope change allowing cascading impact on additional Oracle products in the environment. Oracle's August 2026 Critical Security Patch Update discloses a CVSS 3.1 base score of 8.7, reflecting network-accessible exploitation requiring no interaction but demanding high-privilege credentials. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data disclosure in Oracle Financials Common Modules (Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged authenticated attacker with HTTP network access to bypass access controls in the Common Components layer, gaining unauthorized read access to critical or complete financial data. The scope change (S:C) confirmed in the CVSS vector means successful exploitation can cascade into data exposure across additional Oracle EBS products beyond the directly vulnerable module. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this a straightforward exploitation path for any authenticated EBS user.