Oracle
Monthly
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications exposes a network-accessible, low-complexity attack path that allows any low-privileged authenticated user to fully take over the application via HTTP. Affected versions span 22.3 through 26.6, a multi-year range covering a substantial portion of the deployed base. No public exploit has been identified at time of analysis; however, Oracle's own characterization of this as 'easily exploitable' and the complete C/I/A impact make this a high-priority remediation target from the August 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3-26.6) allows a low-privileged, network-authenticated attacker to read the entirety of accessible CRM data and perform limited unauthorized data writes via standard HTTP requests. The vulnerability carries a confirmed scope change, meaning successful exploitation of the Siebel Cloud Manager component can cascade to compromise data in additional integrated Oracle products beyond the initial target. No public exploit code has been identified at time of analysis, but the low attack complexity combined with only a low-privilege requirement makes this a realistic and urgent patching priority for any organization running a Siebel CRM Cloud deployment.
Unauthorized data access and manipulation in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by low-privileged, network-connected attackers via HTTP against the Siebel Cloud Manager component. Successful exploitation grants complete read access to all CRM data and the ability to create, delete, or modify critical records, with no availability disruption to the service itself. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and low privilege requirement lower the bar for a targeted threat actor with valid credentials.
Full takeover of Oracle U.S. Federal Financials (versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker over HTTP, with successful exploitation resulting in complete compromise of confidentiality, integrity, and availability. The Internal Operations component within Oracle E-Business Suite exposes this attack surface to any authenticated network user, requiring no user interaction and no elevated permissions beyond a basic account. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and high impact make this a priority patching target for affected federal agencies.
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.6, lets a remote unauthenticated attacker fully compromise the system over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) with a 9.8 base score and full high impact on confidentiality, integrity, and availability marks this as a pre-authentication, network-reachable critical flaw disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially-exploitable, unauthenticated profile makes it a high-priority patch target.
Privilege-based takeover of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible via the Siebel Cloud Manager component, where a low-privileged attacker with HTTP network access can fully compromise the application. Because the flaw carries a scope change, successful attacks can significantly impact additional connected products beyond Siebel itself. Rated CVSS 3.1 9.9 with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis.
Full takeover of PeopleSoft Enterprise CC Common Application Objects version 9.2 is achievable by an unauthenticated remote attacker via the Oracle Net protocol. Despite the high-severity classification (CVSS 8.1), the attack complexity is rated High, meaning specific technical conditions must be satisfied for exploitation to succeed. No public exploit code exists at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the full C:H/I:H/A:H impact (confidentiality, integrity, and availability) makes this a meaningful risk for organizations running PeopleSoft 9.2 in network-accessible configurations.
Unauthorized data exposure and partial denial-of-service in Oracle Complex Maintenance, Repair and Overhaul (CMRO) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read critical or complete CMRO application data across a scope boundary into additional Oracle E-Business Suite components. The vulnerability resides in the Production component and is exploitable over HTTP without user interaction, though high attack complexity limits opportunistic exploitation. No public exploit code or CISA KEV listing exists at time of analysis; Oracle has issued remediation via the August 2026 Critical Patch Update.
Oracle BI Publisher's BI Platform Security component allows a low-privileged, network-adjacent attacker to compromise confidentiality, integrity, and availability of the platform via HTTP without user interaction. Affected versions span the full supported lifecycle - 8.2.0.0.0, 12.2.1.4.0, and the current 26.01.0.0.0 - making this broadly applicable across Oracle Analytics deployments. The flaw is tagged as an authentication bypass, meaning a minimally authenticated user may escalate access well beyond their assigned privileges to read or destroy critical report data and partially disrupt service. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote unauthenticated exploitation of Oracle Business Intelligence Enterprise Edition's Pod Admin component allows attackers to access critical analytics data and cause partial service disruption over HTTP without credentials. Versions 8.2.0.0.0 and 26.01.0.0.0 are confirmed affected, with a CVSS 3.1 score of 8.2 reflecting low attack complexity and no authentication or user interaction requirement. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog; Oracle has addressed it in the August 2026 Critical Patch Update.
Full platform takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is achievable by a local attacker holding low-privileged OS credentials on the host where the Agent Next Gen component executes. Oracle's advisory explicitly characterizes this as 'easily exploitable,' with no user interaction and no elevated authentication beyond an initial local logon required. No public exploit has been identified at time of analysis, but the combination of low attack complexity, high-impact outcome across all three pillars, and Oracle's own severity language makes this a priority for any enterprise Oracle infrastructure team.
Unauthorized data access in Oracle Enterprise Asset Management (E-Business Suite, Linear Asset Management component), versions 12.2.3 through 12.2.15, is achievable by a low-privileged authenticated network attacker over HTTP when a victim interacts with attacker-controlled content, resulting in complete confidentiality exposure and limited integrity compromise with a confirmed scope change to additional products. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) combined with an Authentication Bypass tag from the reporter suggests a client-side attack pathway - likely cross-site scripting or a similar injection technique - where a victim must interact with attacker-influenced material to trigger the exploit. No public exploit code has been identified and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Local authentication bypass in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows any user with OS-level logon access to the hosting infrastructure to read all data managed by the Content Server component without Oracle application credentials. The scope change designation (S:C in the CVSS vector) indicates successful exploitation may further compromise additional Oracle Fusion Middleware products co-located on the same host. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Full takeover of Oracle Hyperion Calculation Manager version 11.2.25.0.000 is achievable by an unauthenticated remote attacker over HTTP, resulting in complete loss of confidentiality, integrity, and availability. The attack is classified as difficult to exploit (AC:H), meaning specific conditions must align, but no credentials or user interaction are required once those conditions are met. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the severity of impact warrants priority patching for any affected deployment.
Local privilege escalation in Oracle WebCenter Content's Content Server component allows low-privileged infrastructure users to achieve full system takeover across versions 12.2.1.4.0 and 14.1.2.0.0. Oracle classifies this as 'easily exploitable,' requiring only a low-privileged local logon to the host server - no network access or user interaction needed - with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the takeover outcome and low exploitation complexity elevate practical risk for affected deployments.
Full system takeover of Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a low-privileged, network-connected attacker exploiting the Content Server component via HTTP, provided a separate victim user performs some form of interaction. Despite the severe outcome - complete compromise of confidentiality, integrity, and availability - the CVSS vector signals above-average exploitation complexity (AC:H) and a mandatory human-interaction requirement (UI:R), meaning opportunistic, automated attacks are unlikely. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Remote authentication bypass in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to gain unauthorized access to all content managed by the platform and perform limited data modification, provided a victim user interacts with attacker-controlled material. The Oracle August 2026 CPU advisory confirms both supported release trains are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of unauthenticated network access, low complexity, and a high confidentiality impact makes this a priority patch for any Oracle Fusion Middleware deployment.
Unauthenticated remote exploitation of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 via HTTP allows an attacker to create, delete, or modify critical platform-managed data through the Event Management component, with secondary impacts on confidentiality and service availability. The Oracle-published CVSS 8.6 score reflects a low-complexity, no-privilege-required attack path, making this accessible to non-sophisticated threat actors with network access. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Full platform takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is achievable by any low-privileged attacker with HTTP access to the Application Config Console component. The CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms low attack complexity, no user interaction, and full confidentiality, integrity, and availability impact - directly corroborated by Oracle's own characterization of the outcome as complete platform compromise. No public exploit has been identified at time of analysis, but Oracle has released a fix via the August 2026 Critical Security Patch Update.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows unauthenticated network attackers to fully compromise both confidentiality and integrity of all data accessible within the product via HTTP. The flaw resides in the Security component and, once triggered, grants read, creation, deletion, and modification access to critical data - impacts consistent with complete data ownership. Human interaction from a victim is required (UI:R), suggesting a CSRF-style or socially-engineered delivery vector; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Full system compromise of Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by a low-privileged network attacker via HTTP, with the Security component identified as the vulnerable surface. The CVSS 3.1 score of 8.8 reflects high impacts across confidentiality, integrity, and availability, consistent with Oracle's own characterization of complete product 'takeover.' No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and minimal privilege requirements make this a credible near-term exploitation target.
Full takeover of Oracle JD Edwards EnterpriseOne Tools is achievable by a low-privileged remote attacker via HTTP, affecting all 9.2.x releases through 9.2.26.4. The vulnerability resides in the Installation Security component and requires only a low-privileged account with no user interaction, which Oracle itself classifies as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete C/I/A impact profile represents a critical business risk for organizations running JD Edwards ERP environments.
Full compromise of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.4) is possible via the Web Runtime SEC component, where an unauthenticated attacker with only HTTP network access can achieve complete takeover of the product. Oracle rates this CVSS 3.1 9.8 with full confidentiality, integrity, and availability loss and describes it as 'easily exploitable,' meaning no special skill or preconditions are needed. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patch item.
Unauthorized data access and manipulation in Oracle JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.4 is achievable by any low-privileged network attacker over HTTP, with no user interaction required. Tagged as an authentication bypass in the E1 IOT Orchestrator Security component, the vulnerability exposes both confidentiality and integrity of all data accessible to the Orchestrator - including critical business records - to unauthorized reads, creates, deletes, and modifications. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range make this a credible risk for all unpatched deployments.
Remote data compromise in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0-9.2.26.4) allows a low-privileged authenticated attacker to fully breach confidentiality and integrity of critical ERP data via HTTP, with no user interaction required. The vulnerability resides in the Business Logic Infra SEC component and is tagged as an Authentication Bypass, indicating the flaw permits unauthorized escalation beyond the attacker's assigned privilege level. No public exploit has been identified at time of analysis; Oracle's August 2026 Critical Patch Update is the designated remediation vehicle.
Full system takeover is achievable against JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.4 by an unauthenticated remote attacker over TLS, exploiting a flaw in the E1 IOT Orchestrator Security component. Successful exploitation results in complete compromise of confidentiality, integrity, and availability - effectively a full orchestrator takeover. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the high-severity impact warrants priority attention for Oracle JD Edwards deployments.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes critical data and partial availability loss to low-privileged network attackers via a flaw in its Security component, accessible over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms easy network exploitation requiring only a low-privilege account with no interaction, yielding high confidentiality impact and partial denial of service. Notably, the 'Authentication Bypass' tag in the intelligence data suggests the effective exploitation barrier may be lower than the PR:L metric implies. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Full compromise of Oracle Internet Directory (OID) LDAP Server is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the LDAP service over the network can take over the directory instance. The flaw scores CVSS 9.8 with high confidentiality, integrity, and availability impact and is addressed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege escalation to full takeover in Oracle Internet Directory (OID) 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access over LDAP to fully compromise the directory server, with a scope change that can significantly impact other products relying on it. Rated CVSS 9.9 with high confidentiality, integrity, and availability impact, it was reported by Oracle and addressed in the August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Internet Directory (OID) is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 through its OID LDAP Server component, where an unauthenticated remote attacker with LDAP network access can fully compromise the directory service. Rated CVSS 10.0 with a scope change (S:C), successful exploitation can pivot beyond OID to significantly impact additional products that depend on it. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the maximum severity and identity-infrastructure role make this a top-priority patch.
Full takeover of Oracle Virtual Directory (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by low-privileged network attackers via the LDAP protocol with no user interaction required. Oracle classifies this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability compromise of the Virtual Directory Server. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, though the combination of network accessibility, low attack complexity, and low privilege requirement makes this a credible priority for Oracle Fusion Middleware environments.
Unauthenticated remote data exposure in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows network-based attackers to access critical or all portal-accessible data via HTTP with no privileges or user interaction required. Tagged as an Authentication Bypass in the Oracle CPUAUG2026 advisory, the vulnerability carries a changed scope, meaning successful exploitation can cascade to impact additional Oracle Fusion Middleware products integrated with the portal. No public exploit has been identified at time of analysis, and remediation is available through Oracle's Critical Security Patch Update for August 2026.
Full takeover of Oracle WebCenter Portal is achievable by an unauthenticated remote attacker via HTTP, affecting the Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 of the Fusion Middleware stack. The CVSS vector rates this 8.1 due to high attack complexity (AC:H), meaning exploitation requires specific but unspecified preconditions to be met - yet successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the Oracle CPU August 2026 advisory confirms the vulnerability is vendor-acknowledged.
Unauthenticated remote compromise of Oracle WebCenter Portal's Runtime Tools component exposes critical data through an authentication bypass vulnerability patched in Oracle's August 2026 Critical Patch Update. Affected versions 12.2.1.4.0 and 14.1.2.0.0 allow any network-accessible attacker to gain complete read access to all data handled by the portal - and, due to a confirmed scope change, potentially reach data in additional connected Oracle Fusion Middleware products. No public exploit or KEV listing is confirmed at time of analysis, but the absence of authentication requirements and low attack complexity make this a high-priority remediation target.
Cross-context data exposure in Oracle WebCenter Portal's Runtime Tools component allows a low-privileged, network-authenticated attacker to compromise confidentiality at high severity and integrity at limited scope, with a scope change that can impact additional Oracle Fusion Middleware products. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, and Oracle classifies this as 'easily exploitable' despite the user-interaction requirement. No public exploit or CISA KEV listing has been identified at time of analysis, but the Oracle-tagged 'Authentication Bypass' descriptor suggests privilege escalation beyond the attacker's granted access level is central to the vulnerability's mechanism.
Unauthenticated remote exploitation of Oracle WebCenter Portal's Runtime Tools component (versions 12.2.1.4.0 and 14.1.2.0.0) enables a network-based authentication bypass over HTTP, contingent on a single human-interaction step by a target user. Successful exploitation yields complete confidentiality exposure of all data accessible to the portal instance and limited unauthorized write capability, with scope-change implications that can cascade into co-hosted Oracle Fusion Middleware products. Oracle confirmed the issue through its August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized read and write access to critical data in Oracle WebCenter Portal's Runtime Tools component is achievable by a low-privileged, network-authenticated attacker over HTTP, contingent on victim user interaction. Successful exploitation triggers a scope change - extending compromise beyond WebCenter Portal to additional Oracle Fusion Middleware products - resulting in full confidentiality and integrity impact on critical portal data. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Oracle WebCenter Portal's Runtime Tools component exposes a high-severity, network-exploitable authentication bypass affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged, remote-authenticated attacker who can induce a victim user to interact with a malicious HTTP request can bypass authorization controls to gain complete read access to all WebCenter Portal data and perform unauthorized creation, deletion, or modification of critical data - including scope-change impact to additional Oracle Fusion Middleware products. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Full takeover of Oracle WebCenter Portal is achievable by any low-privileged authenticated user over HTTP, affecting both currently supported release lines - 12.2.1.4.0 and 14.1.2.0.0 - in the Runtime Tools component. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation demands minimal prerequisites: a valid portal account and network reachability, with no interaction from other users required and no special configuration needed beyond a standard supported deployment. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Oracle CPU patches are routinely reverse-engineered shortly after release, narrowing the safe patching window significantly for exposed instances.
Full takeover of Oracle WebCenter Portal is achievable by a low-privileged network attacker exploiting a flaw in the Runtime Tools component via HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0 within the Oracle Fusion Middleware product line. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, with a confirmed scope change indicating that connected Fusion Middleware components beyond the portal itself may also be impacted. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's August 2026 Critical Security Patch Update (CSPU) confirms the vulnerability and is the primary remediation vehicle.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 expose a high-severity flaw in the Runtime Tools component that allows a low-privileged, network-accessible attacker to gain complete read access to all portal-accessible data and perform limited data manipulation and partial denial of service via HTTP. The vulnerability is rated CVSS 7.6 and disclosed as part of Oracle's Critical Patch Update for August 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the intelligence metadata suggests potential elevation from low-privilege access that warrants close attention.
Privilege-escalating account takeover in Oracle Hyperion Calculation Manager 11.2.25.0.000 (Security component) lets a low-privileged, network-adjacent attacker send crafted HTTP requests that fully compromise the product and, because of a CVSS scope change, spill impact into additional connected Oracle Hyperion products. Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss; it was disclosed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle WebCenter Portal 14.1.2.0.0 exposes critical confidential data through an authentication bypass in its Runtime Tools component, reachable by any low-privileged user over HTTP. Oracle explicitly classifies this as 'easily exploitable' and assigns a scope-change designation (S:C), meaning successful exploitation can spill over into additional Oracle Fusion Middleware products integrated with the portal. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and broad network accessibility make this straightforward to trigger once the bypass mechanism is understood.
Authentication bypass in Oracle WebCenter Portal's Runtime Tools component allows unauthenticated remote attackers to compromise confidentiality and integrity of critical portal data across affected versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability carries a CVSS 3.1 score of 8.7 with scope change (S:C), meaning successful exploitation can cascade beyond WebCenter Portal to impact additional products within the Oracle Fusion Middleware stack. No public exploit code has been identified at time of analysis, and high attack complexity (AC:H) limits opportunistic exploitation, though the authentication bypass nature and scope change elevate priority for Oracle-heavy environments.
Oracle WebCenter Portal Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged, network-authenticated attackers to bypass authorization controls and achieve full read and write access to critical portal data via HTTP. The vulnerability is tagged as an Authentication Bypass, meaning an authenticated user with minimal privileges can escalate access beyond their intended authorization boundary. No public exploit has been identified at time of analysis, and it is not currently listed in the CISA KEV catalog, though the low attack complexity makes it a realistic threat in any environment where untrusted low-privileged accounts exist.
Oracle WebCenter Portal's Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 is exploitable over HTTP by unauthenticated remote attackers, subject to victim user interaction, enabling unauthorized modification or deletion of portal data and a partial denial of service. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector confirms low-complexity network exploitation requiring no credentials, only that a victim user be induced to interact with attacker-controlled content. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's August 2026 Critical Patch Update.
Full takeover of Oracle Identity Manager (OIM) is achievable by any low-privileged, network-authenticated attacker exploiting a flaw in the OIM Legacy UI component of Oracle Fusion Middleware. Both actively supported versions - 12.2.1.4.0 and 14.1.2.1.0 - are affected, and the attack requires only HTTP network access with minimal credentials, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high impact make this a high-priority patching target.
Full takeover of Oracle Identity Manager is possible when a low-privileged attacker reaches the OIM Legacy UI component over the network via RMI, per Oracle's August 2026 Critical Patch Update (CVE-2026-61066). The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation can compromise the identity platform itself and cascade into other products that trust it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and identity-provider blast radius make it a top-priority patch.
Full system takeover of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker with network access over HTTP. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact with no user interaction required, classifying this as an easily exploitable, high-severity vulnerability within Oracle's Fusion Middleware portfolio. No public exploit has been identified at time of analysis, but Oracle's explicit use of 'takeover' language in the advisory indicates the potential for complete system compromise.
Authentication bypass in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) enables unauthenticated remote attackers to gain unauthorized read access to critical application data and perform limited write operations via HTTP. Rated CVSS 8.2, this flaw requires no credentials, no user interaction, and no special network position, making it exploitable against any internet-exposed WebCenter Sites deployment. No public exploit code has been identified at time of analysis; the vulnerability was disclosed through Oracle's August 2026 Critical Patch Update.
Unauthenticated network exploitation of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows remote attackers to compromise confidentiality, integrity, and availability via HTTP without requiring any credentials or user interaction. Oracle's own advisory characterizes this as 'easily exploitable,' and the Authentication Bypass tag corroborates the PR:N CVSS metric, indicating the flaw circumvents access controls entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-prerequisite nature make this a high-priority patching target for any organization running the affected Fusion Middleware component.
Full system takeover in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is achievable by any low-privileged attacker with network access over HTTP, resulting in complete compromise of confidentiality, integrity, and availability. Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' materially lowering the skill threshold for attackers. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity, full-impact CVSS vector, and broad coverage across both active release branches warrant urgent remediation across Oracle Fusion Middleware deployments.
Full compromise of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by any low-privileged authenticated user with HTTP network access, requiring neither elevated rights nor user interaction. Oracle's own disclosure language characterizes this as 'easily exploitable,' and the resulting impact is described as complete system takeover - implying full loss of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low attack barrier and critical business function of enterprise WCM platforms make this an immediate patching priority.
Unauthenticated remote access in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 exposes the full confidential data set accessible to the platform and permits limited unauthorized data modification via standard HTTP, with no credentials or user interaction required. Oracle confirmed this in its August 2026 Critical Patch Update (CPU), classifying it as easily exploitable with a network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass nature and low attack complexity make this a high-priority remediation target for all organizations running the affected versions.
Full takeover of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a high-privileged, network-based attacker over HTTP, with a scope change that lets impact spill into other Oracle Fusion Middleware components. The flaw yields complete loss of confidentiality, integrity, and availability (CVSS 3.1 9.1) and was addressed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote exploitation of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows network-accessible attackers to achieve complete read access to all application-accessible data, perform limited unauthorized data modification, and cause partial denial of service - all via HTTP with no credentials or user interaction required. The 'Authentication Bypass' tag in multi-source intelligence corroborates the PR:N CVSS metric, indicating the flaw circumvents access controls prior to any authentication gate. No CISA KEV listing or public proof-of-concept has been identified at time of analysis, though the low attack complexity (AC:L) makes opportunistic exploitation feasible once technical details circulate.
Full system takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged authenticated attacker over HTTP, with Oracle's own advisory characterizing the flaw as 'easily exploitable.' Successful exploitation yields complete compromise of confidentiality, integrity, and availability of the affected WebCenter Sites instance. No public exploit code or active exploitation has been confirmed at time of analysis, though the low attack complexity and severity of impact make this a high-priority remediation target.
Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote, unauthenticated attacker to compromise the platform over HTTP, with attacks capable of spilling beyond WebCenter Sites into other products due to a security scope change. Rated CVSS 9.0, the flaw yields complete confidentiality, integrity, and availability loss, though the high attack complexity (AC:H) means exploitation is non-trivial. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed via Oracle's August 2026 Critical Patch Update.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 expose a full-takeover vulnerability that low-privileged, network-based attackers can exploit over HTTP without user interaction. Oracle's August 2026 Critical Patch Update characterizes this as 'easily exploitable,' with successful attacks achieving complete confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV active-exploitation listing has been identified at the time of analysis, but the low attack complexity combined with the severity of impact warrants urgent patching across all affected deployments.
Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0), a component of Oracle Fusion Middleware, allows a low-privileged attacker with HTTP network access to fully compromise the server and, due to a scope change, significantly impact additional connected products. Oracle rates this CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's August 2026 Critical Patch Update.
Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote, unauthenticated attacker to compromise the application over HTTP with low attack complexity. Rated CVSS 3.1 9.8 with complete confidentiality, integrity, and availability impact, this flaw was disclosed by Oracle in the August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Full system takeover of Oracle WebCenter Sites is achievable by a low-privileged, network-connected attacker via HTTP, with Oracle itself classifying this as 'easily exploitable.' Both currently supported versions - 12.2.1.4.0 and 14.1.2.0.0 - within the Oracle Fusion Middleware product line are confirmed affected, covering the entirety of the active install base. The CVSS 3.1 score of 8.8 (C:H/I:H/A:H) reflects complete compromise of confidentiality, integrity, and availability; no public exploit code or CISA KEV listing has been identified at the time of this analysis.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 within the Fusion Middleware stack expose an unauthenticated remote attack surface over HTTP, enabling network-accessible attackers to perform unauthorized creation, deletion, or modification of critical content data across all accessible WebCenter Sites instances, as well as cause a partial denial of service. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) confirms minimal attack complexity with no authentication or user interaction required, which Oracle's own advisory characterizes as 'easily exploitable'. No public exploit or CISA KEV listing has been identified at time of analysis, though the zero-prerequisite exploitation profile elevates urgency for exposed deployments.
Unauthenticated remote exploitation of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows network-adjacent or internet-facing attackers to perform unauthorized creation, deletion, or modification of critical content data, and to partially degrade service availability via HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, user interaction, or special configuration is required, placing this in the highest-risk category for unauthenticated web vulnerabilities. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the low attack complexity warrants prompt remediation.
Full read/write compromise of Oracle WebCenter Sites is possible by remote, unauthenticated attackers over HTTP against versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the flaw CVSS 9.1 and describes it as easily exploitable, granting an attacker unauthorized creation, deletion, and modification of critical data plus full read access to all WebCenter Sites accessible data, though availability is unaffected. It is tagged as an authentication bypass; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 expose all managed content to unauthenticated remote attackers via an HTTP-accessible authentication bypass. The flaw, tagged explicitly as Authentication Bypass by Oracle, enables complete unauthorized read access to every data asset within the WebCenter Sites platform without credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-complexity, zero-authentication attack profile makes opportunistic exploitation readily achievable by any attacker with HTTP reach to the application.
Full takeover of Oracle Managed File Transfer (Oracle Fusion Middleware, MFT Runtime Server) is possible when a low-privileged attacker with network access reaches the T3 or IIOP protocol interface. The flaw carries a CVSS 3.1 base score of 9.9 and, critically, involves a scope change (S:C) so successful attacks may significantly impact additional products beyond MFT itself. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity, low privilege requirement, and network exposure via WebLogic-style T3/IIOP make it a high-priority patch.
Full system takeover of Oracle SOA Suite is achievable by any low-privileged network attacker targeting the B2B Engine component via HTTP, with no user interaction required. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, covering both the long-term supported and newer release trains of this enterprise middleware. The CVSS 3.1 score of 8.8 reflects high impacts across confidentiality, integrity, and availability - consistent with a complete compromise scenario. No public exploit or CISA KEV listing has been identified at time of analysis.
Privilege-scoped data compromise in Oracle Web Services Manager (OWSM), a component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, allows a low-privileged attacker with HTTP network access to read and modify all OWSM-accessible critical data, with a scope change that can significantly impact additional integrated products. Tagged by the reporter as an authentication bypass, the flaw carries a CVSS 3.1 base score of 9.6 driven by high confidentiality and integrity impact plus scope change. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is achievable by a high-privileged, remote attacker exploiting the Microsoft Active Directory component via LDAP, with confirmed scope change impacting additional Oracle Fusion Middleware products. The vendor-assessed outcome is complete loss of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the category of serious but not actively weaponized vulnerabilities pending patch application.
High-severity data compromise in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows a network-authenticated, high-privileged attacker to fully read and modify critical identity connector data, with confirmed scope change enabling impact on additional downstream products. The vulnerability is tagged 'Authentication Bypass', suggesting the flaw undermines access control enforcement within the Connector Server component despite requiring elevated initial credentials, resulting in a CVSS 3.1 base score of 8.7. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation and full takeover of the Oracle Identity Manager Connector (Core component of Oracle Fusion Middleware) is possible for a low-privileged attacker with network access over TLS, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Because the flaw carries a scope change, a successful attack can pivot beyond the connector to significantly impact additional products, driving the CVSS 3.1 base score to 9.9. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently theoretical but the low attack complexity makes it a high patching priority.
Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 expose critical identity and access management data to local, low-privileged attackers who can engineer mandatory third-party user interaction, with successful exploitation crossing scope boundaries into additional Oracle Fusion Middleware components. The CVSS 3.1 base score of 7.2 reflects high confidentiality and integrity impacts under a scope-change scenario, though the local attack vector and high complexity substantially constrain real-world reach. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is possible by an unauthenticated attacker positioned on the same physical network segment as the connector host, resulting in complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's August 2026 Critical Patch Update, the vulnerability carries a CVSS 3.1 score of 7.5 but is significantly constrained by its adjacent-only attack vector and high attack complexity. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Full takeover of Oracle Identity Manager Connector is achievable by an unauthenticated remote attacker communicating over TLS, affecting the Core component of versions 12.2.1.4.0 and 14.1.2.1.0 under Oracle Fusion Middleware. The CVSS vector confirms network reachability with no privileges or user interaction required, though high attack complexity (AC:H) indicates that exploitation demands specific conditions beyond a simple point-and-shoot approach. No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete confidentiality, integrity, and availability impact makes successful exploitation a full system compromise.
Local privilege escalation in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows a low-privileged attacker with local logon access to the hosting infrastructure to achieve full takeover of the connector, impacting confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects straightforward exploitation once local access is obtained - no elevated privileges, no user interaction, and no complex attack conditions are required. No public exploit code or active exploitation has been identified at time of analysis; this is disclosed as part of Oracle's August 2026 Critical Patch Update. Note: The intelligence tag 'Information Disclosure' conflicts with the CVSS C:H/I:H/A:H impact profile and the 'takeover' language in the description - the actual scope of impact is broader than disclosure alone and should not be understated.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Oracle Fusion Middleware, Core component) lets a low-privileged, network-adjacent attacker fully compromise the Connector over TLS, with a scope change that can significantly impact other integrated products. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, carrying a CVSS 3.1 base score of 9.9 (C:H/I:H/A:H). No public exploit is identified at time of analysis, and the issue is addressed in Oracle's August 2026 Critical Patch Update.
Unauthorized data exposure in Oracle WebCenter Content's Content Server allows authenticated low-privileged users to access critical or complete enterprise content data over HTTP, with a CVSS 3.1 scope change (S:C) signaling collateral impact on additional Oracle Fusion Middleware components in the same environment. Affecting supported versions 14.1.2.0.0 and 12.2.1.4.0, the vulnerability is tagged as an authentication bypass and carries a CVSS 3.1 score of 7.7, reflecting low attack complexity and no user interaction once a valid account is held. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the straightforward exploitation conditions make patching urgent for environments with broadly distributed low-privileged accounts.
Oracle WebCenter Content's Content Server component, in versions 14.1.2.0.0 and 12.2.1.4.0, exposes an authentication bypass that allows a low-privileged remote attacker to achieve full confidentiality and integrity compromise of all accessible content data - and, due to a confirmed scope change, may significantly impact additional Oracle Fusion Middleware products integrated with the platform. Exploitation is network-accessible over HTTP with low complexity but requires a valid low-privileged account and human interaction from a separate victim, classifying this as a socially-engineered or CSRF-class attack surface. No public exploit code and no CISA KEV listing have been identified at time of analysis; the vulnerability was disclosed as part of Oracle's August 2026 Critical Security Patch Update.
Unauthorized data access and tampering in Oracle WebCenter Content's Content Server component allows unauthenticated remote attackers to fully read or manipulate all managed content via HTTP. Both supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and successful exploitation can cascade beyond the Content Server itself to impact additional Oracle Fusion Middleware products within the same deployment environment. No public exploit has been identified at time of analysis, but the unauthenticated network vector combined with a scope change rating makes this a high-priority item for any organization running this ECM platform.
Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware, WLS Core Components) allows a network attacker to fully take over the server via the RMI protocol. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, with a CVSS 3.1 base score of 9.8 reflecting full confidentiality, integrity, and availability loss. No public exploit was identified at time of analysis, but the 'easily exploitable' rating and unauthenticated RMI attack surface make this a top-priority patch.
Oracle Scripting versions 12.2.3 through 12.2.15, as part of Oracle E-Business Suite, exposes an easily exploitable flaw in its Internal Operations component that enables a low-privileged network attacker to achieve full system takeover over HTTP. The vulnerability scores CVSS 3.1 8.8, reflecting High impacts across all three pillars - Confidentiality, Integrity, and Availability - with low attack complexity and no user interaction required. No public exploit has been identified at time of analysis, but the minimal authentication barrier and network accessibility make this a high-urgency remediation target for organizations running Oracle EBS.
PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 contain an authentication bypass in the Security component, exploitable by a low-privileged attacker with local infrastructure access to achieve full confidentiality and integrity compromise of PeopleTools data, with scope change enabling lateral impact across additional integrated Oracle products. The local attack vector (AV:L) and high complexity (AC:H) constrain exploitation to insider threats or post-compromise scenarios, but the S:C scope change and H/H confidentiality-integrity impact make successful exploitation highly consequential in large Oracle ERP environments. No public exploit code or active exploitation has been identified at time of analysis.
Complete takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthenticated remote attacker over the T3 and IIOP protocols in the Client Bundle component. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects easy, network-based exploitation yielding full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
Full-system takeover of Oracle WebCenter Enterprise Capture (Oracle Fusion Middleware, Client Bundle component) is achievable by a remote, unauthenticated attacker reaching the server over the T3 or IIOP protocols. Oracle rates this CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable,' meaning a single crafted protocol interaction can yield complete compromise of the Capture instance. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of reliable Java-deserialization exploitation in the WebLogic/Fusion Middleware stack.
Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 expose a network-accessible LDAP authorization bypass that enables a low-privileged authenticated attacker to gain unauthorized access to critical or complete directory data. Intelligence sources tag this as an authentication bypass in the OUD Core component, with confirmed scope change impact on additional Oracle Fusion Middleware products consuming OUD identity data. No active exploitation confirmed at time of analysis and no public exploit code has been identified; however, the low attack complexity and network accessibility make this a credible priority for Oracle Fusion Middleware environments.
Full takeover of Oracle PeopleSoft Enterprise PeopleTools is achievable by an unauthenticated remote attacker targeting the nVision component via HTTP on versions 8.61 through 8.63. The attack requires that a victim user interact with attacker-controlled content - consistent with a client-side exploitation pattern such as XSS or CSRF - after which the attacker achieves complete compromise with high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and absence of any authentication requirement lower the bar for targeted exploitation against internet-accessible PeopleSoft deployments.
Authentication bypass in Oracle WebCenter Content's Content Server component allows unauthenticated attackers with adjacent network access to fully compromise data confidentiality and integrity across versions 12.2.1.4.0 and 14.1.2.0.0. The scope change designation confirms that successful exploitation can cascade beyond WebCenter Content itself to additional Oracle Fusion Middleware products. Disclosed via Oracle's August 2026 Critical Security Patch Update, with no public exploit identified at time of analysis.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the product. Oracle rates this CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning no credentials or user interaction are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-takeover profile makes it a top-priority patch in Oracle's August 2026 Critical Patch Update.
Full takeover of JD Edwards EnterpriseOne US Payroll version 9.2 is achievable by a low-privileged, network-adjacent attacker via the JDENET protocol, with successful exploitation yielding complete confidentiality, integrity, and availability compromise of the payroll system. Oracle rates this High severity (CVSS 7.5) under the August 2026 Critical Patch Update; the high attack complexity (AC:H) is the primary barrier to mass exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications exposes a network-accessible, low-complexity attack path that allows any low-privileged authenticated user to fully take over the application via HTTP. Affected versions span 22.3 through 26.6, a multi-year range covering a substantial portion of the deployed base. No public exploit has been identified at time of analysis; however, Oracle's own characterization of this as 'easily exploitable' and the complete C/I/A impact make this a high-priority remediation target from the August 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3-26.6) allows a low-privileged, network-authenticated attacker to read the entirety of accessible CRM data and perform limited unauthorized data writes via standard HTTP requests. The vulnerability carries a confirmed scope change, meaning successful exploitation of the Siebel Cloud Manager component can cascade to compromise data in additional integrated Oracle products beyond the initial target. No public exploit code has been identified at time of analysis, but the low attack complexity combined with only a low-privilege requirement makes this a realistic and urgent patching priority for any organization running a Siebel CRM Cloud deployment.
Unauthorized data access and manipulation in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by low-privileged, network-connected attackers via HTTP against the Siebel Cloud Manager component. Successful exploitation grants complete read access to all CRM data and the ability to create, delete, or modify critical records, with no availability disruption to the service itself. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and low privilege requirement lower the bar for a targeted threat actor with valid credentials.
Full takeover of Oracle U.S. Federal Financials (versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker over HTTP, with successful exploitation resulting in complete compromise of confidentiality, integrity, and availability. The Internal Operations component within Oracle E-Business Suite exposes this attack surface to any authenticated network user, requiring no user interaction and no elevated permissions beyond a basic account. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and high impact make this a priority patching target for affected federal agencies.
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.6, lets a remote unauthenticated attacker fully compromise the system over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) with a 9.8 base score and full high impact on confidentiality, integrity, and availability marks this as a pre-authentication, network-reachable critical flaw disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially-exploitable, unauthenticated profile makes it a high-priority patch target.
Privilege-based takeover of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible via the Siebel Cloud Manager component, where a low-privileged attacker with HTTP network access can fully compromise the application. Because the flaw carries a scope change, successful attacks can significantly impact additional connected products beyond Siebel itself. Rated CVSS 3.1 9.9 with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis.
Full takeover of PeopleSoft Enterprise CC Common Application Objects version 9.2 is achievable by an unauthenticated remote attacker via the Oracle Net protocol. Despite the high-severity classification (CVSS 8.1), the attack complexity is rated High, meaning specific technical conditions must be satisfied for exploitation to succeed. No public exploit code exists at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the full C:H/I:H/A:H impact (confidentiality, integrity, and availability) makes this a meaningful risk for organizations running PeopleSoft 9.2 in network-accessible configurations.
Unauthorized data exposure and partial denial-of-service in Oracle Complex Maintenance, Repair and Overhaul (CMRO) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read critical or complete CMRO application data across a scope boundary into additional Oracle E-Business Suite components. The vulnerability resides in the Production component and is exploitable over HTTP without user interaction, though high attack complexity limits opportunistic exploitation. No public exploit code or CISA KEV listing exists at time of analysis; Oracle has issued remediation via the August 2026 Critical Patch Update.
Oracle BI Publisher's BI Platform Security component allows a low-privileged, network-adjacent attacker to compromise confidentiality, integrity, and availability of the platform via HTTP without user interaction. Affected versions span the full supported lifecycle - 8.2.0.0.0, 12.2.1.4.0, and the current 26.01.0.0.0 - making this broadly applicable across Oracle Analytics deployments. The flaw is tagged as an authentication bypass, meaning a minimally authenticated user may escalate access well beyond their assigned privileges to read or destroy critical report data and partially disrupt service. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote unauthenticated exploitation of Oracle Business Intelligence Enterprise Edition's Pod Admin component allows attackers to access critical analytics data and cause partial service disruption over HTTP without credentials. Versions 8.2.0.0.0 and 26.01.0.0.0 are confirmed affected, with a CVSS 3.1 score of 8.2 reflecting low attack complexity and no authentication or user interaction requirement. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog; Oracle has addressed it in the August 2026 Critical Patch Update.
Full platform takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is achievable by a local attacker holding low-privileged OS credentials on the host where the Agent Next Gen component executes. Oracle's advisory explicitly characterizes this as 'easily exploitable,' with no user interaction and no elevated authentication beyond an initial local logon required. No public exploit has been identified at time of analysis, but the combination of low attack complexity, high-impact outcome across all three pillars, and Oracle's own severity language makes this a priority for any enterprise Oracle infrastructure team.
Unauthorized data access in Oracle Enterprise Asset Management (E-Business Suite, Linear Asset Management component), versions 12.2.3 through 12.2.15, is achievable by a low-privileged authenticated network attacker over HTTP when a victim interacts with attacker-controlled content, resulting in complete confidentiality exposure and limited integrity compromise with a confirmed scope change to additional products. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) combined with an Authentication Bypass tag from the reporter suggests a client-side attack pathway - likely cross-site scripting or a similar injection technique - where a victim must interact with attacker-influenced material to trigger the exploit. No public exploit code has been identified and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Local authentication bypass in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows any user with OS-level logon access to the hosting infrastructure to read all data managed by the Content Server component without Oracle application credentials. The scope change designation (S:C in the CVSS vector) indicates successful exploitation may further compromise additional Oracle Fusion Middleware products co-located on the same host. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Full takeover of Oracle Hyperion Calculation Manager version 11.2.25.0.000 is achievable by an unauthenticated remote attacker over HTTP, resulting in complete loss of confidentiality, integrity, and availability. The attack is classified as difficult to exploit (AC:H), meaning specific conditions must align, but no credentials or user interaction are required once those conditions are met. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the severity of impact warrants priority patching for any affected deployment.
Local privilege escalation in Oracle WebCenter Content's Content Server component allows low-privileged infrastructure users to achieve full system takeover across versions 12.2.1.4.0 and 14.1.2.0.0. Oracle classifies this as 'easily exploitable,' requiring only a low-privileged local logon to the host server - no network access or user interaction needed - with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the takeover outcome and low exploitation complexity elevate practical risk for affected deployments.
Full system takeover of Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a low-privileged, network-connected attacker exploiting the Content Server component via HTTP, provided a separate victim user performs some form of interaction. Despite the severe outcome - complete compromise of confidentiality, integrity, and availability - the CVSS vector signals above-average exploitation complexity (AC:H) and a mandatory human-interaction requirement (UI:R), meaning opportunistic, automated attacks are unlikely. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Remote authentication bypass in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to gain unauthorized access to all content managed by the platform and perform limited data modification, provided a victim user interacts with attacker-controlled material. The Oracle August 2026 CPU advisory confirms both supported release trains are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of unauthenticated network access, low complexity, and a high confidentiality impact makes this a priority patch for any Oracle Fusion Middleware deployment.
Unauthenticated remote exploitation of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 via HTTP allows an attacker to create, delete, or modify critical platform-managed data through the Event Management component, with secondary impacts on confidentiality and service availability. The Oracle-published CVSS 8.6 score reflects a low-complexity, no-privilege-required attack path, making this accessible to non-sophisticated threat actors with network access. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Full platform takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is achievable by any low-privileged attacker with HTTP access to the Application Config Console component. The CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms low attack complexity, no user interaction, and full confidentiality, integrity, and availability impact - directly corroborated by Oracle's own characterization of the outcome as complete platform compromise. No public exploit has been identified at time of analysis, but Oracle has released a fix via the August 2026 Critical Security Patch Update.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows unauthenticated network attackers to fully compromise both confidentiality and integrity of all data accessible within the product via HTTP. The flaw resides in the Security component and, once triggered, grants read, creation, deletion, and modification access to critical data - impacts consistent with complete data ownership. Human interaction from a victim is required (UI:R), suggesting a CSRF-style or socially-engineered delivery vector; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Full system compromise of Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by a low-privileged network attacker via HTTP, with the Security component identified as the vulnerable surface. The CVSS 3.1 score of 8.8 reflects high impacts across confidentiality, integrity, and availability, consistent with Oracle's own characterization of complete product 'takeover.' No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and minimal privilege requirements make this a credible near-term exploitation target.
Full takeover of Oracle JD Edwards EnterpriseOne Tools is achievable by a low-privileged remote attacker via HTTP, affecting all 9.2.x releases through 9.2.26.4. The vulnerability resides in the Installation Security component and requires only a low-privileged account with no user interaction, which Oracle itself classifies as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete C/I/A impact profile represents a critical business risk for organizations running JD Edwards ERP environments.
Full compromise of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.4) is possible via the Web Runtime SEC component, where an unauthenticated attacker with only HTTP network access can achieve complete takeover of the product. Oracle rates this CVSS 3.1 9.8 with full confidentiality, integrity, and availability loss and describes it as 'easily exploitable,' meaning no special skill or preconditions are needed. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patch item.
Unauthorized data access and manipulation in Oracle JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.4 is achievable by any low-privileged network attacker over HTTP, with no user interaction required. Tagged as an authentication bypass in the E1 IOT Orchestrator Security component, the vulnerability exposes both confidentiality and integrity of all data accessible to the Orchestrator - including critical business records - to unauthorized reads, creates, deletes, and modifications. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range make this a credible risk for all unpatched deployments.
Remote data compromise in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0-9.2.26.4) allows a low-privileged authenticated attacker to fully breach confidentiality and integrity of critical ERP data via HTTP, with no user interaction required. The vulnerability resides in the Business Logic Infra SEC component and is tagged as an Authentication Bypass, indicating the flaw permits unauthorized escalation beyond the attacker's assigned privilege level. No public exploit has been identified at time of analysis; Oracle's August 2026 Critical Patch Update is the designated remediation vehicle.
Full system takeover is achievable against JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.4 by an unauthenticated remote attacker over TLS, exploiting a flaw in the E1 IOT Orchestrator Security component. Successful exploitation results in complete compromise of confidentiality, integrity, and availability - effectively a full orchestrator takeover. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the high-severity impact warrants priority attention for Oracle JD Edwards deployments.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes critical data and partial availability loss to low-privileged network attackers via a flaw in its Security component, accessible over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms easy network exploitation requiring only a low-privilege account with no interaction, yielding high confidentiality impact and partial denial of service. Notably, the 'Authentication Bypass' tag in the intelligence data suggests the effective exploitation barrier may be lower than the PR:L metric implies. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Full compromise of Oracle Internet Directory (OID) LDAP Server is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the LDAP service over the network can take over the directory instance. The flaw scores CVSS 9.8 with high confidentiality, integrity, and availability impact and is addressed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege escalation to full takeover in Oracle Internet Directory (OID) 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access over LDAP to fully compromise the directory server, with a scope change that can significantly impact other products relying on it. Rated CVSS 9.9 with high confidentiality, integrity, and availability impact, it was reported by Oracle and addressed in the August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Internet Directory (OID) is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 through its OID LDAP Server component, where an unauthenticated remote attacker with LDAP network access can fully compromise the directory service. Rated CVSS 10.0 with a scope change (S:C), successful exploitation can pivot beyond OID to significantly impact additional products that depend on it. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the maximum severity and identity-infrastructure role make this a top-priority patch.
Full takeover of Oracle Virtual Directory (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by low-privileged network attackers via the LDAP protocol with no user interaction required. Oracle classifies this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability compromise of the Virtual Directory Server. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, though the combination of network accessibility, low attack complexity, and low privilege requirement makes this a credible priority for Oracle Fusion Middleware environments.
Unauthenticated remote data exposure in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows network-based attackers to access critical or all portal-accessible data via HTTP with no privileges or user interaction required. Tagged as an Authentication Bypass in the Oracle CPUAUG2026 advisory, the vulnerability carries a changed scope, meaning successful exploitation can cascade to impact additional Oracle Fusion Middleware products integrated with the portal. No public exploit has been identified at time of analysis, and remediation is available through Oracle's Critical Security Patch Update for August 2026.
Full takeover of Oracle WebCenter Portal is achievable by an unauthenticated remote attacker via HTTP, affecting the Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 of the Fusion Middleware stack. The CVSS vector rates this 8.1 due to high attack complexity (AC:H), meaning exploitation requires specific but unspecified preconditions to be met - yet successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the Oracle CPU August 2026 advisory confirms the vulnerability is vendor-acknowledged.
Unauthenticated remote compromise of Oracle WebCenter Portal's Runtime Tools component exposes critical data through an authentication bypass vulnerability patched in Oracle's August 2026 Critical Patch Update. Affected versions 12.2.1.4.0 and 14.1.2.0.0 allow any network-accessible attacker to gain complete read access to all data handled by the portal - and, due to a confirmed scope change, potentially reach data in additional connected Oracle Fusion Middleware products. No public exploit or KEV listing is confirmed at time of analysis, but the absence of authentication requirements and low attack complexity make this a high-priority remediation target.
Cross-context data exposure in Oracle WebCenter Portal's Runtime Tools component allows a low-privileged, network-authenticated attacker to compromise confidentiality at high severity and integrity at limited scope, with a scope change that can impact additional Oracle Fusion Middleware products. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, and Oracle classifies this as 'easily exploitable' despite the user-interaction requirement. No public exploit or CISA KEV listing has been identified at time of analysis, but the Oracle-tagged 'Authentication Bypass' descriptor suggests privilege escalation beyond the attacker's granted access level is central to the vulnerability's mechanism.
Unauthenticated remote exploitation of Oracle WebCenter Portal's Runtime Tools component (versions 12.2.1.4.0 and 14.1.2.0.0) enables a network-based authentication bypass over HTTP, contingent on a single human-interaction step by a target user. Successful exploitation yields complete confidentiality exposure of all data accessible to the portal instance and limited unauthorized write capability, with scope-change implications that can cascade into co-hosted Oracle Fusion Middleware products. Oracle confirmed the issue through its August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized read and write access to critical data in Oracle WebCenter Portal's Runtime Tools component is achievable by a low-privileged, network-authenticated attacker over HTTP, contingent on victim user interaction. Successful exploitation triggers a scope change - extending compromise beyond WebCenter Portal to additional Oracle Fusion Middleware products - resulting in full confidentiality and integrity impact on critical portal data. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Oracle WebCenter Portal's Runtime Tools component exposes a high-severity, network-exploitable authentication bypass affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged, remote-authenticated attacker who can induce a victim user to interact with a malicious HTTP request can bypass authorization controls to gain complete read access to all WebCenter Portal data and perform unauthorized creation, deletion, or modification of critical data - including scope-change impact to additional Oracle Fusion Middleware products. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Full takeover of Oracle WebCenter Portal is achievable by any low-privileged authenticated user over HTTP, affecting both currently supported release lines - 12.2.1.4.0 and 14.1.2.0.0 - in the Runtime Tools component. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation demands minimal prerequisites: a valid portal account and network reachability, with no interaction from other users required and no special configuration needed beyond a standard supported deployment. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Oracle CPU patches are routinely reverse-engineered shortly after release, narrowing the safe patching window significantly for exposed instances.
Full takeover of Oracle WebCenter Portal is achievable by a low-privileged network attacker exploiting a flaw in the Runtime Tools component via HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0 within the Oracle Fusion Middleware product line. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, with a confirmed scope change indicating that connected Fusion Middleware components beyond the portal itself may also be impacted. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's August 2026 Critical Security Patch Update (CSPU) confirms the vulnerability and is the primary remediation vehicle.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 expose a high-severity flaw in the Runtime Tools component that allows a low-privileged, network-accessible attacker to gain complete read access to all portal-accessible data and perform limited data manipulation and partial denial of service via HTTP. The vulnerability is rated CVSS 7.6 and disclosed as part of Oracle's Critical Patch Update for August 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the intelligence metadata suggests potential elevation from low-privilege access that warrants close attention.
Privilege-escalating account takeover in Oracle Hyperion Calculation Manager 11.2.25.0.000 (Security component) lets a low-privileged, network-adjacent attacker send crafted HTTP requests that fully compromise the product and, because of a CVSS scope change, spill impact into additional connected Oracle Hyperion products. Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss; it was disclosed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle WebCenter Portal 14.1.2.0.0 exposes critical confidential data through an authentication bypass in its Runtime Tools component, reachable by any low-privileged user over HTTP. Oracle explicitly classifies this as 'easily exploitable' and assigns a scope-change designation (S:C), meaning successful exploitation can spill over into additional Oracle Fusion Middleware products integrated with the portal. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and broad network accessibility make this straightforward to trigger once the bypass mechanism is understood.
Authentication bypass in Oracle WebCenter Portal's Runtime Tools component allows unauthenticated remote attackers to compromise confidentiality and integrity of critical portal data across affected versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability carries a CVSS 3.1 score of 8.7 with scope change (S:C), meaning successful exploitation can cascade beyond WebCenter Portal to impact additional products within the Oracle Fusion Middleware stack. No public exploit code has been identified at time of analysis, and high attack complexity (AC:H) limits opportunistic exploitation, though the authentication bypass nature and scope change elevate priority for Oracle-heavy environments.
Oracle WebCenter Portal Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged, network-authenticated attackers to bypass authorization controls and achieve full read and write access to critical portal data via HTTP. The vulnerability is tagged as an Authentication Bypass, meaning an authenticated user with minimal privileges can escalate access beyond their intended authorization boundary. No public exploit has been identified at time of analysis, and it is not currently listed in the CISA KEV catalog, though the low attack complexity makes it a realistic threat in any environment where untrusted low-privileged accounts exist.
Oracle WebCenter Portal's Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 is exploitable over HTTP by unauthenticated remote attackers, subject to victim user interaction, enabling unauthorized modification or deletion of portal data and a partial denial of service. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector confirms low-complexity network exploitation requiring no credentials, only that a victim user be induced to interact with attacker-controlled content. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's August 2026 Critical Patch Update.
Full takeover of Oracle Identity Manager (OIM) is achievable by any low-privileged, network-authenticated attacker exploiting a flaw in the OIM Legacy UI component of Oracle Fusion Middleware. Both actively supported versions - 12.2.1.4.0 and 14.1.2.1.0 - are affected, and the attack requires only HTTP network access with minimal credentials, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high impact make this a high-priority patching target.
Full takeover of Oracle Identity Manager is possible when a low-privileged attacker reaches the OIM Legacy UI component over the network via RMI, per Oracle's August 2026 Critical Patch Update (CVE-2026-61066). The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation can compromise the identity platform itself and cascade into other products that trust it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and identity-provider blast radius make it a top-priority patch.
Full system takeover of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker with network access over HTTP. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact with no user interaction required, classifying this as an easily exploitable, high-severity vulnerability within Oracle's Fusion Middleware portfolio. No public exploit has been identified at time of analysis, but Oracle's explicit use of 'takeover' language in the advisory indicates the potential for complete system compromise.
Authentication bypass in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) enables unauthenticated remote attackers to gain unauthorized read access to critical application data and perform limited write operations via HTTP. Rated CVSS 8.2, this flaw requires no credentials, no user interaction, and no special network position, making it exploitable against any internet-exposed WebCenter Sites deployment. No public exploit code has been identified at time of analysis; the vulnerability was disclosed through Oracle's August 2026 Critical Patch Update.
Unauthenticated network exploitation of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows remote attackers to compromise confidentiality, integrity, and availability via HTTP without requiring any credentials or user interaction. Oracle's own advisory characterizes this as 'easily exploitable,' and the Authentication Bypass tag corroborates the PR:N CVSS metric, indicating the flaw circumvents access controls entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-prerequisite nature make this a high-priority patching target for any organization running the affected Fusion Middleware component.
Full system takeover in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is achievable by any low-privileged attacker with network access over HTTP, resulting in complete compromise of confidentiality, integrity, and availability. Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' materially lowering the skill threshold for attackers. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity, full-impact CVSS vector, and broad coverage across both active release branches warrant urgent remediation across Oracle Fusion Middleware deployments.
Full compromise of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by any low-privileged authenticated user with HTTP network access, requiring neither elevated rights nor user interaction. Oracle's own disclosure language characterizes this as 'easily exploitable,' and the resulting impact is described as complete system takeover - implying full loss of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low attack barrier and critical business function of enterprise WCM platforms make this an immediate patching priority.
Unauthenticated remote access in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 exposes the full confidential data set accessible to the platform and permits limited unauthorized data modification via standard HTTP, with no credentials or user interaction required. Oracle confirmed this in its August 2026 Critical Patch Update (CPU), classifying it as easily exploitable with a network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass nature and low attack complexity make this a high-priority remediation target for all organizations running the affected versions.
Full takeover of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a high-privileged, network-based attacker over HTTP, with a scope change that lets impact spill into other Oracle Fusion Middleware components. The flaw yields complete loss of confidentiality, integrity, and availability (CVSS 3.1 9.1) and was addressed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote exploitation of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows network-accessible attackers to achieve complete read access to all application-accessible data, perform limited unauthorized data modification, and cause partial denial of service - all via HTTP with no credentials or user interaction required. The 'Authentication Bypass' tag in multi-source intelligence corroborates the PR:N CVSS metric, indicating the flaw circumvents access controls prior to any authentication gate. No CISA KEV listing or public proof-of-concept has been identified at time of analysis, though the low attack complexity (AC:L) makes opportunistic exploitation feasible once technical details circulate.
Full system takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged authenticated attacker over HTTP, with Oracle's own advisory characterizing the flaw as 'easily exploitable.' Successful exploitation yields complete compromise of confidentiality, integrity, and availability of the affected WebCenter Sites instance. No public exploit code or active exploitation has been confirmed at time of analysis, though the low attack complexity and severity of impact make this a high-priority remediation target.
Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote, unauthenticated attacker to compromise the platform over HTTP, with attacks capable of spilling beyond WebCenter Sites into other products due to a security scope change. Rated CVSS 9.0, the flaw yields complete confidentiality, integrity, and availability loss, though the high attack complexity (AC:H) means exploitation is non-trivial. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed via Oracle's August 2026 Critical Patch Update.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 expose a full-takeover vulnerability that low-privileged, network-based attackers can exploit over HTTP without user interaction. Oracle's August 2026 Critical Patch Update characterizes this as 'easily exploitable,' with successful attacks achieving complete confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV active-exploitation listing has been identified at the time of analysis, but the low attack complexity combined with the severity of impact warrants urgent patching across all affected deployments.
Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0), a component of Oracle Fusion Middleware, allows a low-privileged attacker with HTTP network access to fully compromise the server and, due to a scope change, significantly impact additional connected products. Oracle rates this CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's August 2026 Critical Patch Update.
Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote, unauthenticated attacker to compromise the application over HTTP with low attack complexity. Rated CVSS 3.1 9.8 with complete confidentiality, integrity, and availability impact, this flaw was disclosed by Oracle in the August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Full system takeover of Oracle WebCenter Sites is achievable by a low-privileged, network-connected attacker via HTTP, with Oracle itself classifying this as 'easily exploitable.' Both currently supported versions - 12.2.1.4.0 and 14.1.2.0.0 - within the Oracle Fusion Middleware product line are confirmed affected, covering the entirety of the active install base. The CVSS 3.1 score of 8.8 (C:H/I:H/A:H) reflects complete compromise of confidentiality, integrity, and availability; no public exploit code or CISA KEV listing has been identified at the time of this analysis.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 within the Fusion Middleware stack expose an unauthenticated remote attack surface over HTTP, enabling network-accessible attackers to perform unauthorized creation, deletion, or modification of critical content data across all accessible WebCenter Sites instances, as well as cause a partial denial of service. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) confirms minimal attack complexity with no authentication or user interaction required, which Oracle's own advisory characterizes as 'easily exploitable'. No public exploit or CISA KEV listing has been identified at time of analysis, though the zero-prerequisite exploitation profile elevates urgency for exposed deployments.
Unauthenticated remote exploitation of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows network-adjacent or internet-facing attackers to perform unauthorized creation, deletion, or modification of critical content data, and to partially degrade service availability via HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, user interaction, or special configuration is required, placing this in the highest-risk category for unauthenticated web vulnerabilities. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the low attack complexity warrants prompt remediation.
Full read/write compromise of Oracle WebCenter Sites is possible by remote, unauthenticated attackers over HTTP against versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the flaw CVSS 9.1 and describes it as easily exploitable, granting an attacker unauthorized creation, deletion, and modification of critical data plus full read access to all WebCenter Sites accessible data, though availability is unaffected. It is tagged as an authentication bypass; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 expose all managed content to unauthenticated remote attackers via an HTTP-accessible authentication bypass. The flaw, tagged explicitly as Authentication Bypass by Oracle, enables complete unauthorized read access to every data asset within the WebCenter Sites platform without credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-complexity, zero-authentication attack profile makes opportunistic exploitation readily achievable by any attacker with HTTP reach to the application.
Full takeover of Oracle Managed File Transfer (Oracle Fusion Middleware, MFT Runtime Server) is possible when a low-privileged attacker with network access reaches the T3 or IIOP protocol interface. The flaw carries a CVSS 3.1 base score of 9.9 and, critically, involves a scope change (S:C) so successful attacks may significantly impact additional products beyond MFT itself. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity, low privilege requirement, and network exposure via WebLogic-style T3/IIOP make it a high-priority patch.
Full system takeover of Oracle SOA Suite is achievable by any low-privileged network attacker targeting the B2B Engine component via HTTP, with no user interaction required. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, covering both the long-term supported and newer release trains of this enterprise middleware. The CVSS 3.1 score of 8.8 reflects high impacts across confidentiality, integrity, and availability - consistent with a complete compromise scenario. No public exploit or CISA KEV listing has been identified at time of analysis.
Privilege-scoped data compromise in Oracle Web Services Manager (OWSM), a component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, allows a low-privileged attacker with HTTP network access to read and modify all OWSM-accessible critical data, with a scope change that can significantly impact additional integrated products. Tagged by the reporter as an authentication bypass, the flaw carries a CVSS 3.1 base score of 9.6 driven by high confidentiality and integrity impact plus scope change. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is achievable by a high-privileged, remote attacker exploiting the Microsoft Active Directory component via LDAP, with confirmed scope change impacting additional Oracle Fusion Middleware products. The vendor-assessed outcome is complete loss of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the category of serious but not actively weaponized vulnerabilities pending patch application.
High-severity data compromise in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows a network-authenticated, high-privileged attacker to fully read and modify critical identity connector data, with confirmed scope change enabling impact on additional downstream products. The vulnerability is tagged 'Authentication Bypass', suggesting the flaw undermines access control enforcement within the Connector Server component despite requiring elevated initial credentials, resulting in a CVSS 3.1 base score of 8.7. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation and full takeover of the Oracle Identity Manager Connector (Core component of Oracle Fusion Middleware) is possible for a low-privileged attacker with network access over TLS, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Because the flaw carries a scope change, a successful attack can pivot beyond the connector to significantly impact additional products, driving the CVSS 3.1 base score to 9.9. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently theoretical but the low attack complexity makes it a high patching priority.
Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 expose critical identity and access management data to local, low-privileged attackers who can engineer mandatory third-party user interaction, with successful exploitation crossing scope boundaries into additional Oracle Fusion Middleware components. The CVSS 3.1 base score of 7.2 reflects high confidentiality and integrity impacts under a scope-change scenario, though the local attack vector and high complexity substantially constrain real-world reach. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is possible by an unauthenticated attacker positioned on the same physical network segment as the connector host, resulting in complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's August 2026 Critical Patch Update, the vulnerability carries a CVSS 3.1 score of 7.5 but is significantly constrained by its adjacent-only attack vector and high attack complexity. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Full takeover of Oracle Identity Manager Connector is achievable by an unauthenticated remote attacker communicating over TLS, affecting the Core component of versions 12.2.1.4.0 and 14.1.2.1.0 under Oracle Fusion Middleware. The CVSS vector confirms network reachability with no privileges or user interaction required, though high attack complexity (AC:H) indicates that exploitation demands specific conditions beyond a simple point-and-shoot approach. No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete confidentiality, integrity, and availability impact makes successful exploitation a full system compromise.
Local privilege escalation in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows a low-privileged attacker with local logon access to the hosting infrastructure to achieve full takeover of the connector, impacting confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects straightforward exploitation once local access is obtained - no elevated privileges, no user interaction, and no complex attack conditions are required. No public exploit code or active exploitation has been identified at time of analysis; this is disclosed as part of Oracle's August 2026 Critical Patch Update. Note: The intelligence tag 'Information Disclosure' conflicts with the CVSS C:H/I:H/A:H impact profile and the 'takeover' language in the description - the actual scope of impact is broader than disclosure alone and should not be understated.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Oracle Fusion Middleware, Core component) lets a low-privileged, network-adjacent attacker fully compromise the Connector over TLS, with a scope change that can significantly impact other integrated products. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, carrying a CVSS 3.1 base score of 9.9 (C:H/I:H/A:H). No public exploit is identified at time of analysis, and the issue is addressed in Oracle's August 2026 Critical Patch Update.
Unauthorized data exposure in Oracle WebCenter Content's Content Server allows authenticated low-privileged users to access critical or complete enterprise content data over HTTP, with a CVSS 3.1 scope change (S:C) signaling collateral impact on additional Oracle Fusion Middleware components in the same environment. Affecting supported versions 14.1.2.0.0 and 12.2.1.4.0, the vulnerability is tagged as an authentication bypass and carries a CVSS 3.1 score of 7.7, reflecting low attack complexity and no user interaction once a valid account is held. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the straightforward exploitation conditions make patching urgent for environments with broadly distributed low-privileged accounts.
Oracle WebCenter Content's Content Server component, in versions 14.1.2.0.0 and 12.2.1.4.0, exposes an authentication bypass that allows a low-privileged remote attacker to achieve full confidentiality and integrity compromise of all accessible content data - and, due to a confirmed scope change, may significantly impact additional Oracle Fusion Middleware products integrated with the platform. Exploitation is network-accessible over HTTP with low complexity but requires a valid low-privileged account and human interaction from a separate victim, classifying this as a socially-engineered or CSRF-class attack surface. No public exploit code and no CISA KEV listing have been identified at time of analysis; the vulnerability was disclosed as part of Oracle's August 2026 Critical Security Patch Update.
Unauthorized data access and tampering in Oracle WebCenter Content's Content Server component allows unauthenticated remote attackers to fully read or manipulate all managed content via HTTP. Both supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and successful exploitation can cascade beyond the Content Server itself to impact additional Oracle Fusion Middleware products within the same deployment environment. No public exploit has been identified at time of analysis, but the unauthenticated network vector combined with a scope change rating makes this a high-priority item for any organization running this ECM platform.
Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware, WLS Core Components) allows a network attacker to fully take over the server via the RMI protocol. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, with a CVSS 3.1 base score of 9.8 reflecting full confidentiality, integrity, and availability loss. No public exploit was identified at time of analysis, but the 'easily exploitable' rating and unauthenticated RMI attack surface make this a top-priority patch.
Oracle Scripting versions 12.2.3 through 12.2.15, as part of Oracle E-Business Suite, exposes an easily exploitable flaw in its Internal Operations component that enables a low-privileged network attacker to achieve full system takeover over HTTP. The vulnerability scores CVSS 3.1 8.8, reflecting High impacts across all three pillars - Confidentiality, Integrity, and Availability - with low attack complexity and no user interaction required. No public exploit has been identified at time of analysis, but the minimal authentication barrier and network accessibility make this a high-urgency remediation target for organizations running Oracle EBS.
PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 contain an authentication bypass in the Security component, exploitable by a low-privileged attacker with local infrastructure access to achieve full confidentiality and integrity compromise of PeopleTools data, with scope change enabling lateral impact across additional integrated Oracle products. The local attack vector (AV:L) and high complexity (AC:H) constrain exploitation to insider threats or post-compromise scenarios, but the S:C scope change and H/H confidentiality-integrity impact make successful exploitation highly consequential in large Oracle ERP environments. No public exploit code or active exploitation has been identified at time of analysis.
Complete takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthenticated remote attacker over the T3 and IIOP protocols in the Client Bundle component. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects easy, network-based exploitation yielding full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
Full-system takeover of Oracle WebCenter Enterprise Capture (Oracle Fusion Middleware, Client Bundle component) is achievable by a remote, unauthenticated attacker reaching the server over the T3 or IIOP protocols. Oracle rates this CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable,' meaning a single crafted protocol interaction can yield complete compromise of the Capture instance. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of reliable Java-deserialization exploitation in the WebLogic/Fusion Middleware stack.
Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 expose a network-accessible LDAP authorization bypass that enables a low-privileged authenticated attacker to gain unauthorized access to critical or complete directory data. Intelligence sources tag this as an authentication bypass in the OUD Core component, with confirmed scope change impact on additional Oracle Fusion Middleware products consuming OUD identity data. No active exploitation confirmed at time of analysis and no public exploit code has been identified; however, the low attack complexity and network accessibility make this a credible priority for Oracle Fusion Middleware environments.
Full takeover of Oracle PeopleSoft Enterprise PeopleTools is achievable by an unauthenticated remote attacker targeting the nVision component via HTTP on versions 8.61 through 8.63. The attack requires that a victim user interact with attacker-controlled content - consistent with a client-side exploitation pattern such as XSS or CSRF - after which the attacker achieves complete compromise with high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and absence of any authentication requirement lower the bar for targeted exploitation against internet-accessible PeopleSoft deployments.
Authentication bypass in Oracle WebCenter Content's Content Server component allows unauthenticated attackers with adjacent network access to fully compromise data confidentiality and integrity across versions 12.2.1.4.0 and 14.1.2.0.0. The scope change designation confirms that successful exploitation can cascade beyond WebCenter Content itself to additional Oracle Fusion Middleware products. Disclosed via Oracle's August 2026 Critical Security Patch Update, with no public exploit identified at time of analysis.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the product. Oracle rates this CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning no credentials or user interaction are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-takeover profile makes it a top-priority patch in Oracle's August 2026 Critical Patch Update.
Full takeover of JD Edwards EnterpriseOne US Payroll version 9.2 is achievable by a low-privileged, network-adjacent attacker via the JDENET protocol, with successful exploitation yielding complete confidentiality, integrity, and availability compromise of the payroll system. Oracle rates this High severity (CVSS 7.5) under the August 2026 Critical Patch Update; the high attack complexity (AC:H) is the primary barrier to mass exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.