Oracle
Monthly
Oracle WebCenter Content's Content Server component, within the Oracle Fusion Middleware stack, exposes a network-reachable integrity compromise affecting versions 12.2.1.4.0 and 14.1.2.0.0. High-privileged authenticated attackers can access the service via HTTP to arbitrarily create, delete, or modify critical repository data, read a subset of accessible content, and cause partial denial of service - with a confirmed scope change indicating potential cascading impact on additional Oracle Fusion Middleware products. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content's Content Server component, in versions 12.2.1.4.0 and 14.1.2.0.0, contains an authentication bypass vulnerability reachable over HTTP without credentials, carrying a CVSS 3.1 base score of 8.7. Successful exploitation enables an unauthenticated remote attacker to gain both full read access and full create/delete/modify access to critical content data, with a confirmed scope change meaning downstream Oracle Fusion Middleware components may also be impacted. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the Authentication Bypass tag and high attack complexity signal a non-trivial but realistic threat to unpatched deployments.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose a high-complexity, network-accessible flaw in the Content Server component that allows low-privileged authenticated attackers to gain unauthorized read access to critical content data and perform limited data manipulation. The vulnerability carries a scope-change designation, meaning successful exploitation can extend impact beyond WebCenter Content itself to adjacent Oracle Fusion Middleware products. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, though the 'Authentication Bypass' tag from ENISA EUVD introduces residual uncertainty about the true privilege prerequisite.
Complete takeover of Oracle WebCenter Enterprise Capture is possible via the Client Bundle component, where an unauthenticated network attacker leveraging the RMI protocol can fully compromise the affected server. Oracle's August 2026 Critical Patch Update rates this at CVSS 9.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis, though the trivial exploitability (AC:L, PR:N) and RMI attack surface make it a high-priority patch item.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by an unauthenticated attacker reaching the product over Java RMI, per Oracle's August 2026 Critical Patch Update. The flaw is rated CVSS 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable,' affecting versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach, no authentication, and complete compromise makes it a top-priority patch.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose a network-accessible, unauthenticated vulnerability in the Content Server component that can be triggered via HTTP with user interaction, resulting in a scope change affecting additional products. Successful exploitation grants attackers complete read access to all data accessible within Oracle WebCenter Content and limited write capabilities (insert/update/delete) against some accessible data. No public exploit or CISA KEV listing has been identified at time of analysis, though the Oracle-assigned tag of 'Authentication Bypass' and the high CVSS score of 8.2 warrant prompt patching within Oracle Critical Patch Update cycles.
Remote authentication bypass in Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to fully compromise confidentiality and integrity of managed content - including unauthorized creation, deletion, and modification of critical data - across both affected release lines 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope-change flag (S:C) indicates successful exploitation can cascade to affect additional Oracle Fusion Middleware products beyond WebCenter Content itself. Attack complexity is rated High (AC:H), meaning specific and difficult-to-reproduce conditions must be met, but no authentication or user interaction is required. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content's Content Server component harbors an authentication bypass exploitable by unauthenticated remote attackers over HTTP, affecting both actively supported versions (12.2.1.4.0 and 14.1.2.0.0) of this Oracle Fusion Middleware product. Successful exploitation grants complete unauthorized read and write access to all content managed by the system, with a confirmed scope change that can extend impact to additional Oracle Fusion Middleware products in the same deployment. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated network vector paired with high confidentiality and integrity impacts makes this a meaningful risk for organizations running exposed affected deployments.
Unauthorized read and write access to critical enterprise content data is achievable in Oracle WebCenter Content's Content Server component via an authentication bypass exploitable over HTTP. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, an unauthenticated remote attacker who overcomes the high attack complexity barrier can exfiltrate all accessible content or create, modify, and delete critical records. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local privilege exploitation in Oracle WebCenter Content 14.1.2.0.0 enables a low-privileged, authenticated user with system logon access to fully compromise the Content Server component. The attacker can read, create, delete, or modify all data accessible within Oracle WebCenter Content, and the confirmed scope change means attacks can cascade into additional co-hosted Oracle Fusion Middleware products. No public exploit has been identified at time of analysis, but the low attack complexity and wide data impact make this a high-priority patch target for any environment running this middleware version.
Remote takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated network attacker to fully compromise the product via the WebLogic T3 and IIOP protocols exposed by the Client Bundle component. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), reflecting easy, no-privilege exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the T3/IIOP attack class is historically a high-value target in Oracle Fusion Middleware.
Remote unauthenticated compromise of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) allows an attacker with only network/HTTP reach to create, delete, or modify critical data, read a subset of accessible data, and cause partial denial of service. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and Oracle explicitly flags a scope change meaning successful attacks may significantly impact other products beyond Capture itself. Rated CVSS 3.1 9.9; disclosed in the Oracle Critical Patch Update of August 2026 with no public exploit identified at time of analysis.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network-accessible attackers to fully compromise both the confidentiality and integrity of all data accessible to the service. The vulnerability carries a CVSS 3.1 score of 7.4, tempered by high attack complexity (AC:H), meaning specific, non-trivial conditions must be satisfied for exploitation. Disclosed via Oracle's Critical Patch Update for August 2026, no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote disclosure of all Oracle Unified Directory data is possible via the LDAP protocol in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Unified Directory (Oracle Fusion Middleware). The 'Authentication Bypass' tag and a CVSS vector of AV:N/AC:L/PR:N/UI:N confirm that a network-accessible attacker with no credentials can exploit the OUD Core component to read critical or complete directory data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a straightforward target for opportunistic scanning.
Oracle WebCenter Content's Content Server component in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is exploitable by a low-privileged authenticated attacker over HTTP who can lure a higher-privileged victim into interacting with malicious content, resulting in unauthorized access to critical data and partial data manipulation with confirmed scope impact beyond WebCenter Content itself. Tagged as an authentication bypass by Oracle, this vulnerability carries a CVSS 3.1 base score of 7.6 and is classified as easily exploitable in Oracle's August 2026 Critical Patch Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote access to all confidential data managed by Oracle WebCenter Content's Content Server component is achievable across two currently supported Fusion Middleware release lines. Tagged as an authentication bypass, this vulnerability allows a network-accessible attacker to read sensitive documents and managed content by sending HTTP requests without supplying any credentials, requiring no user interaction and no elevated privileges. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-authentication, low-complexity attack profile makes this a high-priority remediation item for any deployment reachable from untrusted network segments.
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to fully read, create, modify or delete all Content Server-accessible data and cause a partial denial of service. Oracle rates it CVSS 9.6, driven by a scope change (S:C) meaning successful attacks can significantly impact products beyond WebCenter Content itself. Exploitation requires tricking a legitimate user into an action (UI:R); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated network exploitation of Oracle WebCenter Content's Content Server component allows a remote attacker to achieve full confidentiality and integrity compromise of all accessible content data, with a scope change that can significantly impact additional Oracle Fusion Middleware products in the same environment. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's Critical Patch Update of August 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Authentication Bypass tag and PR:N vector confirm no credentials are required to initiate an attack. The AC:H rating indicates exploitation is non-trivial and requires meeting specific, undisclosed conditions.
Local privilege escalation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 enables a low-privileged attacker with infrastructure logon access to achieve full system takeover via the Tuxedo middleware component. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires physical or session-level access to the host and involves high attack complexity, materially limiting opportunistic exploitation despite the complete CIA impact. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via its August 2026 Critical Security Patch Update.
Unauthenticated remote data exposure in Oracle Unified Directory allows attackers with network access via LDAP to read all directory-accessible data without credentials. Affected versions 12.2.1.4.0 and 14.1.2.1.0 of this Fusion Middleware identity store component are vulnerable to what Oracle and ENISA tag as an authentication bypass. With a CVSS 3.1 score of 7.5 and an AV:N/AC:L/PR:N/UI:N vector, exploitation is considered trivial for any attacker with network reach to the LDAP service port. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack surface makes this a high-priority patch target for organizations running OUD as a directory backend.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61-8.63) is achievable by a network-accessible, highly privileged attacker via a flaw in the PeopleCode component over HTTP. Successful exploitation results in complete confidentiality, integrity, and availability impact - Oracle characterizes the outcome as a full 'takeover' of the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, and the PR:H requirement narrows the realistic attacker population to those already holding administrative-level credentials.
SQL-based exploitation in Oracle PeopleSoft Enterprise PeopleTools Configuration Manager (versions 8.61-8.63) enables a low-privileged authenticated attacker to achieve full system takeover over the network. The vulnerability is rated CVSS 8.8 High with complete Confidentiality, Integrity, and Availability impacts, and Oracle's own description characterizes it as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad enterprise deployment footprint make this a credible priority for organizations running affected PeopleTools versions.
Local code execution and data compromise in Oracle PeopleSoft Enterprise PeopleTools (Data Mover component) affects versions 8.61 through 8.63, requiring a highly privileged attacker with physical or logical infrastructure access and human interaction from a secondary party. Successful exploitation results in full confidentiality and integrity compromise of PeopleTools data, potential modification or deletion of critical records, and partial denial of service, with a confirmed scope change that can cascade impact to additional dependent PeopleSoft products. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Oracle CSPU August 2026 advisory confirms this as a patched, vendor-acknowledged vulnerability.
Privilege-abusing data compromise in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 14.1.2.0.0 and 12.2.1.4.0 lets a low-privileged attacker with Oracle Net network access read, alter, create, or delete all platform-accessible data, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 9.6 (Critical) with high confidentiality and integrity impact but no availability impact, this is remotely reachable and low-complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Oracle Service Delivery Platform's Messaging Enabler component (versions 14.1.2.0.0 and 12.2.1.4.0 within Oracle Fusion Middleware) can be compromised by unauthenticated remote attackers via TCP, enabling unauthorized creation, deletion, or modification of critical data and repeated complete denial of service. The CVSS S:C scope change signals that a successful attack can cascade to additional Fusion Middleware products sharing the same deployment, amplifying organizational impact beyond the directly targeted platform. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) requirement reduces the likelihood of opportunistic mass exploitation.
Full remote takeover of Oracle Hyperion Calculation Manager 11.2.25.0.000 is possible by an unauthenticated attacker over HTTP, per Oracle's Critical Patch Update advisory (CSPUAUG2026). The flaw sits in the product's Security component and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8). No public exploit code or CISA KEV listing is identified at time of analysis, but the trivial exploitability and network reach make it a high-priority patch item.
Authentication bypass in Oracle PeopleSoft Enterprise PeopleTools (Install and Packaging component) versions 8.61 through 8.63 exposes critical HR and ERP data to unauthenticated network attackers over HTTP. Successful exploitation grants complete confidentiality and integrity compromise of all PeopleSoft-accessible data, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and CVSS AC:H rating indicates meaningful exploitation complexity, but the absence of any authentication requirement elevates organizational urgency.
Unauthenticated confidentiality breach in Oracle Unified Directory (OUD Core) exposes all directory-accessible data via LDAP. Both supported releases - 12.2.1.4.0 and 14.1.2.1.0 - are affected, confirming this is not a legacy-only issue. The 'Authentication Bypass' tag combined with a PR:N/AV:N CVSS vector indicates attackers can read sensitive directory contents without credentials over the network; no public exploit or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle Unified Directory (OUD) 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged attacker with LDAP network access exploiting a flaw in the OUD Core component. The CVSS scope-change indicator (S:C) confirms that successful exploitation extends beyond the directory service itself, potentially compromising dependent Oracle Fusion Middleware applications that rely on OUD for identity and authentication services. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle has acknowledged and addressed the issue in its August 2026 Critical Security Update.
Full takeover of Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged network attacker via LDAP, resulting in complete compromise of confidentiality, integrity, and availability of the directory service. The CVSS Scope:Changed indicator confirms that successful exploitation can cascade into additional Oracle Fusion Middleware components that depend on OUD for authentication or directory services, amplifying the blast radius beyond the directory itself. No public exploit code or CISA KEV listing has been identified at time of analysis, but the catastrophic impact profile and identity-backbone role of LDAP directories make this a high-priority patching target under Oracle's August 2026 Critical Patch Update.
Full system takeover is achievable against Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 via an unauthenticated HTTP attack targeting the Integration Broker component. The vulnerability carries a CVSS 3.1 score of 8.1 with complete confidentiality, integrity, and availability impact, though the AC:H metric indicates exploitation is not trivial and requires meeting specific attack complexity conditions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack path and full-takeover impact class make this a high-priority patching candidate for organizations running affected PeopleTools versions.
Local privilege escalation in Oracle Enterprise Manager for Systems Infrastructure (versions 13.5 and 24.1) allows a low-privileged authenticated local user to fully compromise the Agent component, resulting in complete takeover of the system with high confidentiality, integrity, and availability impact. The vulnerability is easily exploitable per Oracle's advisory, requiring only a valid local logon - no additional complexity or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full-takeover impact makes this a high-priority patching target for any organization running the affected component.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 is possible via the Business Interlink component, where a remote unauthenticated attacker sending crafted HTTP requests can take over the product. Oracle rates this at CVSS 9.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch in the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Siebel CRM Integration's REST component across versions 17.0 through 26.6 can yield complete loss of data confidentiality and integrity. Tagged as an authentication bypass, the vulnerability permits network-accessible attackers to read all CRM data and perform unauthorized create, delete, or modify operations without credentials. No public exploit has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update addresses the issue.
Local privilege escalation with scope change in Oracle Siebel CRM's Email Marketing component affects versions 17.0 through 26.6, confirmed via the Oracle August 2026 Critical Security Update advisory (EUVD-2026-61438). Low-privileged attackers with existing logon access to the Siebel infrastructure can, under difficult-to-reproduce conditions, bypass access controls to read or modify critical marketing data and cascade impacts to other integrated Siebel products. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated network exploitation of the Oracle Siebel CRM Marketing component enables critical data theft and unauthorized modification across all Marketing-accessible records. Tagged explicitly as an Authentication Bypass, the flaw allows a remote attacker with no credentials to compromise the confidentiality and integrity of sensitive CRM marketing data via HTTP, affecting all supported versions from 17.0 through 26.6. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the PR:N/UI:N vector means no user interaction or account is required, making the authentication bypass self-sufficient once the high-complexity exploitation conditions are met.
Unauthorized access to critical CRM data and partial data manipulation in Oracle Siebel CRM Deployment (versions 17.0-26.6) is achievable via the Migration component by any low-privileged attacker with HTTP network access, with a documented scope change indicating that successful exploitation can cascade to affect additional Oracle products beyond the directly targeted component. The CVSS 3.1 base score of 8.5 reflects low attack complexity and no user interaction requirement, making exploitation straightforward for any holder of a valid low-privilege credential. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though the breadth of affected versions spanning nearly a decade of releases represents substantial organizational exposure.
Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) contains an authentication bypass flaw enabling unauthenticated network attackers to fully compromise data confidentiality and integrity over HTTPS. The 'Authentication Bypass' tag from the Oracle reporter confirms the vulnerability class: an attacker who satisfies the high-complexity exploitation condition can read all CRM data and perform unauthorized creation, modification, or deletion of records. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Unauthenticated remote access to Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) exposes all CRM integration data to unauthorized disclosure and enables partial denial of service via plain HTTP. The vulnerability requires no credentials, no user interaction, and no special configuration beyond the REST interface being reachable, making it exploitable by any network-adjacent or internet-facing attacker. No public exploit has been identified at time of analysis, but Oracle's Critical Patch Update for August 2026 confirms the issue and its severity classification of CVSS 8.2.
Oracle Siebel CRM Deployment's Server Infrastructure component exposes versions 17.0 through 26.6 to an unauthenticated, network-based authentication bypass over HTTP that can result in complete compromise of CRM data confidentiality and integrity. The high complexity rating (AC:H) tempers immediate mass-exploitation risk, but the Authentication Bypass tag combined with C:H and I:H impact means a successful attacker achieves full read and write access to all CRM-accessible data - including customer records, sales pipelines, and service data - without presenting valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's Critical Security Patch Update for August 2026 addresses this vulnerability.
Oracle Siebel CRM Deployment's Application Interface component (versions 17.0 through 26.6) exposes complete read and write access to all CRM data to unauthenticated attackers positioned on the adjacent network segment. The CVSS vector confirms zero authentication requirements and low attack complexity, meaning any actor with access to the physical communication segment hosting the Siebel server can silently exfiltrate or corrupt the entire CRM dataset. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, but the authentication bypass classification combined with high confidentiality and integrity impact makes this a credible priority for organizations with insufficiently segmented internal networks.
Full takeover of Oracle Payments (Oracle E-Business Suite, File Transmission component) is possible by remote unauthenticated attackers over HTTP, affecting supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing profile makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation is possible in Oracle Payments (E-Business Suite component: File Transmission) across versions 12.2.3 through 12.2.15 via an authentication bypass exploitable over HTTP. A low-privileged network attacker can obtain complete read access to all Oracle Payments data and perform unauthorized insert, update, or delete operations against a subset of that data. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'easily exploitable' vendor classification combined with low attack complexity elevates real-world risk for unpatched EBS environments.
Integrity and availability compromise in Oracle Siebel Apps - Marketing (versions 17.0 through 26.6) is reachable by any low-privileged, network-authenticated attacker over HTTP with no user interaction required. Successful exploitation allows unauthorized creation, deletion, or modification of critical Marketing data, and can cause a complete denial of service via persistent hang or crash of the Marketing component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible threat in environments running unpatched Siebel deployments.
Full takeover of Oracle General Ledger (versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker via HTTP, exploiting an undisclosed flaw in the Internal Operations component of Oracle E-Business Suite. The CVSS vector confirms complete confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with application-level takeover. Notably, the intelligence tags classify this as 'Information Disclosure,' which conflicts with the described takeover impact - this discrepancy warrants verification against the Oracle August 2026 CSPU advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full takeover of Oracle Siebel Apps - Marketing is achievable by any low-privileged attacker with network access via HTTP, affecting all supported versions from 17.0 through 26.6. The CVSS 3.1 score of 8.8 reflects complete compromise of confidentiality, integrity, and availability, meaning an attacker can read, modify, or destroy data and disrupt service entirely. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a realistic threat for any internet- or intranet-exposed Siebel Marketing deployment.
Remote authentication bypass in Oracle Siebel CRM Integration's REST component affects all supported versions from 17.0 through 26.6, enabling unauthenticated network attackers to achieve full read and write access to critical CRM data via crafted HTTPS requests. The vulnerability is tagged Authentication Bypass, indicating that REST API access controls can be circumvented without credentials despite a high attack complexity (AC:H) rating that suggests exploitation requires precise crafting or internal state knowledge. No public exploit identified at time of analysis, but the combination of unauthenticated access and high confidentiality and integrity impact warrants priority patching under Oracle's August 2026 Critical Patch Update.
Full takeover of Oracle Siebel CRM's Marketing component is achievable by a low-privileged, network-accessible attacker exploiting a difficult-to-trigger condition via HTTP, affecting all supported versions from 17.0 through 26.6. Successful exploitation results in complete confidentiality, integrity, and availability compromise of the Marketing module - effectively a full component takeover. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog; however, Oracle's August 2026 Critical Patch Update confirms the flaw and releases a remediation.
Authentication bypass in Oracle Internet Procurement Connector (Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows unauthenticated remote attackers to compromise the Internal Operations component via HTTP, resulting in unauthorized read access to or manipulation of critical procurement data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impacts moderated by high attack complexity (AC:H), meaning exploitation requires specific conditions to be met despite requiring no credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized data exfiltration and limited data manipulation in Oracle Siebel Artificial Intelligence (versions 25.12 through 26.6) is achievable by any low-privileged, network-adjacent attacker over HTTP, with no user interaction required. Oracle's own advisory classifies this as 'easily exploitable,' and the scope change metric confirms that successful exploitation can cascade beyond the AI component to impact additional Siebel CRM products. No public exploit or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and broad confidentiality impact (C:H) make this a high-priority patching target for Oracle Siebel deployments.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM's Search component allows complete read and write access to all CRM data across versions 17.0 through 26.6. Successful exploitation enables creation, deletion, and modification of critical data as well as full confidentiality compromise without any prior authentication or user interaction. No public exploit identified at time of analysis, and this vulnerability is not currently listed in CISA KEV, though its low-complexity, unauthenticated nature makes it a credible priority for organizations with exposed Siebel deployments.
Unauthenticated remote compromise of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.6) allows a network attacker over HTTP to read all Marketing-accessible data and to force a complete, repeatable denial of service. The flaw is rated CVSS 3.1 9.1 and is tagged as an authentication bypass, meaning no credentials are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of no authentication, low attack complexity, and high confidentiality/availability impact makes it a high-priority patch.
Local privilege escalation in Oracle Siebel CRM Deployment (versions 17.0 through 26.6) allows a low-privileged local attacker to achieve full takeover of the affected installation, impacting confidentiality, integrity, and availability. The attack targets the Installation component and requires only logon access to the host infrastructure - no remote vector or user interaction is involved. No public exploit code and no active exploitation have been identified at time of analysis; however, the low attack complexity (AC:L) makes post-access exploitation straightforward.
Unauthorized data disclosure and partial service disruption affect Oracle Siebel CRM's Marketing component across versions 17.0 through 26.6, exploitable by a low-privileged authenticated attacker via HTTP without requiring user interaction. The flaw enables complete read access to all data within the Siebel Apps - Marketing scope alongside degraded service availability, as confirmed by Oracle's August 2026 Critical Security Patch Update. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover in Oracle Siebel CRM's Marketing component is achievable by low-privileged authenticated attackers over HTTP across all versions 17.0 through 26.6. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no user interaction required, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the straightforward exploitation conditions and full-triad impact make this a high-priority patch target for any organization running exposed Siebel Marketing instances.
Oracle General Ledger within E-Business Suite versions 12.2.3 through 12.2.15 exposes critical financial data to high-privileged network attackers through a flaw in the Internal Operations component accessible over HTTP. Successful exploitation grants complete read access to all General Ledger data and partial write capability, with a confirmed scope change meaning compromise can cascade to additional Oracle EBS products. Disclosed through Oracle's August 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.
Complete system takeover of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 through 8.63) is achievable by unauthenticated network attackers via HTTP, specifically through the PIA Core Technology component. Despite the high attack complexity rating (AC:H), successful exploitation yields full confidentiality, integrity, and availability compromise - effectively handing an attacker control over the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the impact warrants prioritized remediation through Oracle's August 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Web Services Manager (OWSM), part of Oracle Fusion Middleware's Web Services Security component, lets a remote unauthenticated attacker read, create, delete, or modify all OWSM-accessible data over HTTP. Tagged as an authentication bypass, it affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Compromise of Oracle WebCenter Portal's Composer component - versions 12.2.1.4.0 and 14.1.2.0.0 - allows an authenticated low-privilege attacker over HTTP to achieve high-integrity impact, including unauthorized creation, deletion, and modification of critical portal data, limited confidentiality exposure, and partial denial of service. The CVSS scope change (S:C) indicates exploitation can cascade to additional Oracle Fusion Middleware products beyond WebCenter Portal itself. Disclosed in Oracle's August 2026 Critical Security Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle WebCenter Portal is achievable by a low-privileged network attacker targeting the Composer component via Java RMI in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle describes the vulnerability as 'easily exploitable,' with the CVSS 3.1 score of 8.8 reflecting complete Confidentiality, Integrity, and Availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and this CVE has not appeared in the CISA Known Exploited Vulnerabilities catalog, though it is disclosed as part of Oracle's Critical Patch Update for August 2026.
Privilege-escalating account/system takeover in Oracle WebCenter Portal (Fusion Middleware, Composer component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an authenticated low-privileged attacker reach full compromise over HTTP. Because the flaw carries a scope change (S:C), successful exploitation can pivot beyond WebCenter Portal to impact additional products, and Oracle rates it CVSS 9.9. No public exploit identified at time of analysis, but the near-maximum score, low attack complexity, and minimal privilege requirement make it a top-tier patch priority.
Full takeover of Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged, network-authenticated attacker targeting the Composer component over HTTP. Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' with high impact across confidentiality, integrity, and availability and no user interaction required. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, low privilege requirement, and complete portal compromise warrants urgent patching priority for all affected deployments.
Unauthenticated data compromise and denial of service in Oracle WebCenter Portal (Fusion Middleware, Portlet Services component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker with only HTTP network access and no credentials can read or fully access all portal-accessible data and can force a hang or repeatable crash (complete DoS) of the portal. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Identity Manager (Oracle Fusion Middleware) affects the OIM Legacy UI component in versions 12.2.1.4.0 and 14.1.2.1.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the identity-management platform. The maximum CVSS 3.1 base score of 9.8 reflects complete loss of confidentiality, integrity, and availability, and because OIM governs enterprise identity and access, compromise cascades to every system it provisions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile makes it a high priority for immediate patching.
Remote network compromise of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 enables a low-privileged authenticated attacker to achieve full system takeover via the Authentication Engine over HTTP, with no user interaction required. Oracle's August 2026 Critical Patch Update advisory rates this CVSS 8.8 (High) and explicitly describes it as 'easily exploitable,' with complete confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Identity Manager (OIM Legacy UI) in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware allows a low-privileged remote attacker to fully take over the identity management platform via the T3 and IIOP protocols. The attack requires no user interaction and low complexity, resulting in complete confidentiality, integrity, and availability compromise of the OIM system. No public exploit has been identified at time of analysis, but the low barrier to exploitation makes this a critical patching priority for any enterprise running the affected versions.
Full product takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Legacy UI component) allows a remote, unauthenticated attacker to compromise the identity-governance platform over HTTP. Rated CVSS 9.8 with high confidentiality, integrity, and availability impact, this issue is trivially exploitable and requires no user interaction; at time of analysis there is no public exploit identified and it is not listed in CISA KEV. Because OIM brokers provisioning and access to downstream enterprise systems, a takeover here has cascading blast radius across connected accounts and applications.
Full compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged attacker over HTTP, resulting in complete takeover of the OIM instance. Because the flaw carries a scope change, successful exploitation can significantly impact additional connected products beyond OIM itself, elevating this from a single-product compromise to a potential identity-fabric breach. Disclosed in Oracle's August 2026 Critical Patch Update with a CVSS 3.1 base score of 9.9; no public exploit identified at time of analysis.
Full system takeover of Oracle Identity Manager is achievable by low-privileged network attackers via the OIM Legacy UI component using the T3 or IIOP protocols. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's Identity Manager product. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, effectively handing an attacker full control over the identity management platform. No public exploit has been identified at the time of analysis, and this issue is disclosed as part of Oracle's Critical Patch Update for August 2026.
Full takeover of Oracle Identity Manager via its Legacy UI component is achievable by any low-privileged, network-authenticated attacker over HTTP. Affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, with complete confidentiality, integrity, and availability impact - Oracle's own advisory characterizes the outcome as system takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) and minimal privilege bar (PR:L) make this a realistic target once any authenticated foothold exists in an exposed OIM deployment.
Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 expose a high-severity Security component flaw enabling authenticated high-privileged attackers to compromise the system via HTTP, with confirmed scope change affecting additional downstream products. Exploitation allows complete unauthorized read and write access to all OIM-accessible data, including critical identity and access management records. No public exploit has been identified at time of analysis, and this vulnerability was disclosed as part of Oracle's Critical Patch Update for August 2026.
Remote takeover of Oracle WebLogic Server is possible when a low-privileged attacker reaches the server over the T3 or IIOP protocols, abusing a flaw in the Core component to fully compromise the host. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and because the attack carries a scope change it can significantly impact products beyond WebLogic itself. Oracle rates it CVSS 9.9; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the CVSS profile matches historically weaponized WebLogic T3/IIOP deserialization bugs.
Unauthenticated remote data disclosure in Oracle WebLogic Server Core allows network-accessible attackers to exfiltrate all data reachable by the server via the T3 or IIOP protocols, with confirmed scope change impact on additional downstream systems. Tagged as an Authentication Bypass by Oracle, this affects four active release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - making it a broad exposure across the WebLogic installed base. No public exploit identified at time of analysis, and remediation is available through Oracle's Critical Patch Update (CPU) August 2026.
Remote takeover of Oracle WebLogic Server is possible when an unauthenticated attacker reaches the server's IIOP interface over the network, letting them fully compromise the Core component with high confidentiality, integrity, and availability impact. The flaw affects supported releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and is rated CVSS 9.8 by Oracle. No public exploit identified at time of analysis, but the pattern matches prior high-impact WebLogic IIOP deserialization flaws that were rapidly weaponized.
Unauthenticated remote takeover in Oracle WebLogic Server (Fusion Middleware Core) lets a network attacker fully compromise the server via the T3 and IIOP protocols with no credentials and no user interaction. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the class of flaw and the low attack complexity make it a top-priority patch.
Unauthorized data access and modification in Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a low-privileged network attacker targeting the Internal Operations component via HTTP. Successful exploitation grants complete read and write access to critical GL financial data plus partial availability disruption - a severe outcome for any organization relying on EBS for financial record integrity. The 'Authentication Bypass' tag suggests the vulnerability allows a low-privileged authenticated user to escalate effective access beyond their authorization level; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote integrity compromise and denial-of-service in Oracle WebLogic Server's Core component allows a low-privileged, network-accessible attacker to corrupt or destroy critical application data and crash the server via HTTP. All currently supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected, giving this vulnerability a wide blast radius across enterprise Oracle Fusion Middleware deployments. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, but Oracle's own characterization of the flaw as 'easily exploitable' combined with only a low-privilege account requirement makes patching under the August 2026 CPU urgent.
Full server takeover of Oracle WebLogic Server is achievable by a low-privileged network attacker exploiting a flaw in the Core component via the T3 or IIOP protocols. All four currently supported versions - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are confirmed affected per Oracle's Critical Patch Update for August 2026. Although High Attack Complexity (AC:H) limits opportunistic mass exploitation, successful attacks yield complete confidentiality, integrity, and availability compromise; no public exploit identified at time of analysis.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a remote, unauthenticated attacker with network access via the T3 or IIOP protocols to completely compromise affected instances (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0). The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity and availability impact and requires no privileges or user interaction. There is no public exploit identified at time of analysis, but WebLogic T3/IIOP deserialization flaws are historically rapid targets for weaponization.
Remote unauthenticated denial-of-service and partial data integrity compromise in Oracle MySQL Cluster's NDB Operator component allows network attackers to crash or hang the cluster and perform unauthorized data modifications. Affected versions span three active release lines: 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make exploitation straightforward against exposed deployments.
Unauthenticated data tampering and denial of service in Oracle Hospitality Simphony POS (versions 19.8-19.8.5, 19.9-19.9.3, 19.10-19.10.1) lets a remote attacker with only HTTP network access create, delete, or modify all Simphony-accessible data and force a repeatable crash. Oracle rates it CVSS 3.1 9.1 with high integrity and availability impact and describes it as easily exploitable, though there is no public exploit identified at time of analysis. It was reported by Oracle's own security team and fixed in the August 2026 Critical Patch Update.
Unauthenticated remote access to Oracle Hospitality Simphony's POS component enables complete unauthorized read access to all application data via an HTTP-based authentication bypass across three actively supported release lines. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms that no credentials, interaction, or special configuration are required - any network-reachable attacker can exploit the flaw. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Full server takeover in Oracle WebLogic Server Core component is achievable by unauthenticated remote attackers via the T3 and IIOP protocols, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Successful exploitation yields complete compromise of confidentiality, integrity, and availability of the targeted server instance. No public exploit has been identified at time of analysis, and exploitation is constrained by high attack complexity; however, WebLogic's T3/IIOP surface has a well-established history of critical deserialization exploits that warrants prioritized patching.
Oracle Outside In Technology 8.5.8 is susceptible to a local exploitation path that results in complete system takeover, affecting all three security pillars - confidentiality, integrity, and availability. The attack requires an unauthenticated adversary with logon access to the host infrastructure and human interaction from a separate user to trigger the vulnerable code path, placing this in the category of local privilege-escalation or malicious-file-processing attacks. No public exploit has been identified at time of analysis, but the severity of the impact (full takeover) and low attack complexity warrant prioritized patching per the Oracle CPU August 2026 advisory.
Full system takeover is possible in Oracle Outside In Technology 8.5.8 via a locally-delivered malicious document that exploits a flaw in the Outside In Core parsing component. An unauthenticated attacker who can induce a local user to open or process a crafted file can achieve complete compromise of confidentiality, integrity, and availability on the host. No public exploit has been identified at time of analysis, but the low attack complexity and broad CIA impact make this a credible priority for Oracle enterprise environments.
Full takeover of Oracle Outside In Technology 8.5.8 is achievable by a local attacker who can position a malicious file for processing by an authorized user on the same host, exploiting a low-complexity flaw in the Outside In Core parsing engine. The vulnerability affects Oracle Fusion Middleware deployments running OIT 8.5.8 and yields complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) and absence of privilege requirements (PR:N) make this straightforward to exploit for any attacker who has already achieved local system access.
Unauthenticated remote data exposure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows any network-accessible attacker to read critical or all data managed by the platform via HTTP, without any credentials or user interaction. The Lifecycle Management component contains an authentication bypass (per vendor tags) that collapses access controls entirely, exposing sensitive enterprise performance management data. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low-complexity, zero-privilege CVSS vector indicates straightforward exploitability for any attacker with network reach.
Full system takeover via Oracle Outside In Technology 8.5.8 is achievable by a local attacker exploiting a flaw in the PDF Export SDK component, requiring no application-level privileges but depending on human interaction from another user on the same infrastructure. The attack vector is strictly local (AV:L), confining risk to hosts where the SDK executes, yet successful exploitation yields complete confidentiality, integrity, and availability compromise of the affected process and host. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Patch Update.
Unauthenticated remote access to sensitive financial data is possible in Oracle Hyperion Financial Reporting version 11.2.25.0.000 via an authentication bypass in its Server component, exploitable over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no interaction, and no special configuration is required - making this trivially exploitable from any network-reachable position. Impact is limited to confidentiality, but the data exposed (financial reporting data) carries significant business and regulatory risk. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in Budibase's Oracle datasource connector (versions before 3.40.0) exposes the underlying Oracle database to arbitrary read and write operations by authenticated platform users. The post-write row lookup query concatenates table names into SQL identifiers without escaping double-quote characters, enabling injection of arbitrary SQL that executes under the datasource's Oracle database user account. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 score of 8.8 reflects high C/I/A impact but is tempered by significant access preconditions including high privilege requirements and an atypical table-naming condition.
Oracle WebCenter Content's Content Server component, within the Oracle Fusion Middleware stack, exposes a network-reachable integrity compromise affecting versions 12.2.1.4.0 and 14.1.2.0.0. High-privileged authenticated attackers can access the service via HTTP to arbitrarily create, delete, or modify critical repository data, read a subset of accessible content, and cause partial denial of service - with a confirmed scope change indicating potential cascading impact on additional Oracle Fusion Middleware products. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content's Content Server component, in versions 12.2.1.4.0 and 14.1.2.0.0, contains an authentication bypass vulnerability reachable over HTTP without credentials, carrying a CVSS 3.1 base score of 8.7. Successful exploitation enables an unauthenticated remote attacker to gain both full read access and full create/delete/modify access to critical content data, with a confirmed scope change meaning downstream Oracle Fusion Middleware components may also be impacted. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the Authentication Bypass tag and high attack complexity signal a non-trivial but realistic threat to unpatched deployments.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose a high-complexity, network-accessible flaw in the Content Server component that allows low-privileged authenticated attackers to gain unauthorized read access to critical content data and perform limited data manipulation. The vulnerability carries a scope-change designation, meaning successful exploitation can extend impact beyond WebCenter Content itself to adjacent Oracle Fusion Middleware products. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, though the 'Authentication Bypass' tag from ENISA EUVD introduces residual uncertainty about the true privilege prerequisite.
Complete takeover of Oracle WebCenter Enterprise Capture is possible via the Client Bundle component, where an unauthenticated network attacker leveraging the RMI protocol can fully compromise the affected server. Oracle's August 2026 Critical Patch Update rates this at CVSS 9.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis, though the trivial exploitability (AC:L, PR:N) and RMI attack surface make it a high-priority patch item.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by an unauthenticated attacker reaching the product over Java RMI, per Oracle's August 2026 Critical Patch Update. The flaw is rated CVSS 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable,' affecting versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach, no authentication, and complete compromise makes it a top-priority patch.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose a network-accessible, unauthenticated vulnerability in the Content Server component that can be triggered via HTTP with user interaction, resulting in a scope change affecting additional products. Successful exploitation grants attackers complete read access to all data accessible within Oracle WebCenter Content and limited write capabilities (insert/update/delete) against some accessible data. No public exploit or CISA KEV listing has been identified at time of analysis, though the Oracle-assigned tag of 'Authentication Bypass' and the high CVSS score of 8.2 warrant prompt patching within Oracle Critical Patch Update cycles.
Remote authentication bypass in Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to fully compromise confidentiality and integrity of managed content - including unauthorized creation, deletion, and modification of critical data - across both affected release lines 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope-change flag (S:C) indicates successful exploitation can cascade to affect additional Oracle Fusion Middleware products beyond WebCenter Content itself. Attack complexity is rated High (AC:H), meaning specific and difficult-to-reproduce conditions must be met, but no authentication or user interaction is required. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content's Content Server component harbors an authentication bypass exploitable by unauthenticated remote attackers over HTTP, affecting both actively supported versions (12.2.1.4.0 and 14.1.2.0.0) of this Oracle Fusion Middleware product. Successful exploitation grants complete unauthorized read and write access to all content managed by the system, with a confirmed scope change that can extend impact to additional Oracle Fusion Middleware products in the same deployment. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated network vector paired with high confidentiality and integrity impacts makes this a meaningful risk for organizations running exposed affected deployments.
Unauthorized read and write access to critical enterprise content data is achievable in Oracle WebCenter Content's Content Server component via an authentication bypass exploitable over HTTP. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, an unauthenticated remote attacker who overcomes the high attack complexity barrier can exfiltrate all accessible content or create, modify, and delete critical records. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local privilege exploitation in Oracle WebCenter Content 14.1.2.0.0 enables a low-privileged, authenticated user with system logon access to fully compromise the Content Server component. The attacker can read, create, delete, or modify all data accessible within Oracle WebCenter Content, and the confirmed scope change means attacks can cascade into additional co-hosted Oracle Fusion Middleware products. No public exploit has been identified at time of analysis, but the low attack complexity and wide data impact make this a high-priority patch target for any environment running this middleware version.
Remote takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated network attacker to fully compromise the product via the WebLogic T3 and IIOP protocols exposed by the Client Bundle component. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), reflecting easy, no-privilege exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the T3/IIOP attack class is historically a high-value target in Oracle Fusion Middleware.
Remote unauthenticated compromise of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) allows an attacker with only network/HTTP reach to create, delete, or modify critical data, read a subset of accessible data, and cause partial denial of service. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and Oracle explicitly flags a scope change meaning successful attacks may significantly impact other products beyond Capture itself. Rated CVSS 3.1 9.9; disclosed in the Oracle Critical Patch Update of August 2026 with no public exploit identified at time of analysis.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network-accessible attackers to fully compromise both the confidentiality and integrity of all data accessible to the service. The vulnerability carries a CVSS 3.1 score of 7.4, tempered by high attack complexity (AC:H), meaning specific, non-trivial conditions must be satisfied for exploitation. Disclosed via Oracle's Critical Patch Update for August 2026, no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote disclosure of all Oracle Unified Directory data is possible via the LDAP protocol in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Unified Directory (Oracle Fusion Middleware). The 'Authentication Bypass' tag and a CVSS vector of AV:N/AC:L/PR:N/UI:N confirm that a network-accessible attacker with no credentials can exploit the OUD Core component to read critical or complete directory data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a straightforward target for opportunistic scanning.
Oracle WebCenter Content's Content Server component in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is exploitable by a low-privileged authenticated attacker over HTTP who can lure a higher-privileged victim into interacting with malicious content, resulting in unauthorized access to critical data and partial data manipulation with confirmed scope impact beyond WebCenter Content itself. Tagged as an authentication bypass by Oracle, this vulnerability carries a CVSS 3.1 base score of 7.6 and is classified as easily exploitable in Oracle's August 2026 Critical Patch Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote access to all confidential data managed by Oracle WebCenter Content's Content Server component is achievable across two currently supported Fusion Middleware release lines. Tagged as an authentication bypass, this vulnerability allows a network-accessible attacker to read sensitive documents and managed content by sending HTTP requests without supplying any credentials, requiring no user interaction and no elevated privileges. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-authentication, low-complexity attack profile makes this a high-priority remediation item for any deployment reachable from untrusted network segments.
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to fully read, create, modify or delete all Content Server-accessible data and cause a partial denial of service. Oracle rates it CVSS 9.6, driven by a scope change (S:C) meaning successful attacks can significantly impact products beyond WebCenter Content itself. Exploitation requires tricking a legitimate user into an action (UI:R); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated network exploitation of Oracle WebCenter Content's Content Server component allows a remote attacker to achieve full confidentiality and integrity compromise of all accessible content data, with a scope change that can significantly impact additional Oracle Fusion Middleware products in the same environment. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's Critical Patch Update of August 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Authentication Bypass tag and PR:N vector confirm no credentials are required to initiate an attack. The AC:H rating indicates exploitation is non-trivial and requires meeting specific, undisclosed conditions.
Local privilege escalation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 enables a low-privileged attacker with infrastructure logon access to achieve full system takeover via the Tuxedo middleware component. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires physical or session-level access to the host and involves high attack complexity, materially limiting opportunistic exploitation despite the complete CIA impact. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via its August 2026 Critical Security Patch Update.
Unauthenticated remote data exposure in Oracle Unified Directory allows attackers with network access via LDAP to read all directory-accessible data without credentials. Affected versions 12.2.1.4.0 and 14.1.2.1.0 of this Fusion Middleware identity store component are vulnerable to what Oracle and ENISA tag as an authentication bypass. With a CVSS 3.1 score of 7.5 and an AV:N/AC:L/PR:N/UI:N vector, exploitation is considered trivial for any attacker with network reach to the LDAP service port. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack surface makes this a high-priority patch target for organizations running OUD as a directory backend.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61-8.63) is achievable by a network-accessible, highly privileged attacker via a flaw in the PeopleCode component over HTTP. Successful exploitation results in complete confidentiality, integrity, and availability impact - Oracle characterizes the outcome as a full 'takeover' of the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, and the PR:H requirement narrows the realistic attacker population to those already holding administrative-level credentials.
SQL-based exploitation in Oracle PeopleSoft Enterprise PeopleTools Configuration Manager (versions 8.61-8.63) enables a low-privileged authenticated attacker to achieve full system takeover over the network. The vulnerability is rated CVSS 8.8 High with complete Confidentiality, Integrity, and Availability impacts, and Oracle's own description characterizes it as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad enterprise deployment footprint make this a credible priority for organizations running affected PeopleTools versions.
Local code execution and data compromise in Oracle PeopleSoft Enterprise PeopleTools (Data Mover component) affects versions 8.61 through 8.63, requiring a highly privileged attacker with physical or logical infrastructure access and human interaction from a secondary party. Successful exploitation results in full confidentiality and integrity compromise of PeopleTools data, potential modification or deletion of critical records, and partial denial of service, with a confirmed scope change that can cascade impact to additional dependent PeopleSoft products. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Oracle CSPU August 2026 advisory confirms this as a patched, vendor-acknowledged vulnerability.
Privilege-abusing data compromise in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 14.1.2.0.0 and 12.2.1.4.0 lets a low-privileged attacker with Oracle Net network access read, alter, create, or delete all platform-accessible data, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 9.6 (Critical) with high confidentiality and integrity impact but no availability impact, this is remotely reachable and low-complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Oracle Service Delivery Platform's Messaging Enabler component (versions 14.1.2.0.0 and 12.2.1.4.0 within Oracle Fusion Middleware) can be compromised by unauthenticated remote attackers via TCP, enabling unauthorized creation, deletion, or modification of critical data and repeated complete denial of service. The CVSS S:C scope change signals that a successful attack can cascade to additional Fusion Middleware products sharing the same deployment, amplifying organizational impact beyond the directly targeted platform. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) requirement reduces the likelihood of opportunistic mass exploitation.
Full remote takeover of Oracle Hyperion Calculation Manager 11.2.25.0.000 is possible by an unauthenticated attacker over HTTP, per Oracle's Critical Patch Update advisory (CSPUAUG2026). The flaw sits in the product's Security component and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8). No public exploit code or CISA KEV listing is identified at time of analysis, but the trivial exploitability and network reach make it a high-priority patch item.
Authentication bypass in Oracle PeopleSoft Enterprise PeopleTools (Install and Packaging component) versions 8.61 through 8.63 exposes critical HR and ERP data to unauthenticated network attackers over HTTP. Successful exploitation grants complete confidentiality and integrity compromise of all PeopleSoft-accessible data, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and CVSS AC:H rating indicates meaningful exploitation complexity, but the absence of any authentication requirement elevates organizational urgency.
Unauthenticated confidentiality breach in Oracle Unified Directory (OUD Core) exposes all directory-accessible data via LDAP. Both supported releases - 12.2.1.4.0 and 14.1.2.1.0 - are affected, confirming this is not a legacy-only issue. The 'Authentication Bypass' tag combined with a PR:N/AV:N CVSS vector indicates attackers can read sensitive directory contents without credentials over the network; no public exploit or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle Unified Directory (OUD) 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged attacker with LDAP network access exploiting a flaw in the OUD Core component. The CVSS scope-change indicator (S:C) confirms that successful exploitation extends beyond the directory service itself, potentially compromising dependent Oracle Fusion Middleware applications that rely on OUD for identity and authentication services. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle has acknowledged and addressed the issue in its August 2026 Critical Security Update.
Full takeover of Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged network attacker via LDAP, resulting in complete compromise of confidentiality, integrity, and availability of the directory service. The CVSS Scope:Changed indicator confirms that successful exploitation can cascade into additional Oracle Fusion Middleware components that depend on OUD for authentication or directory services, amplifying the blast radius beyond the directory itself. No public exploit code or CISA KEV listing has been identified at time of analysis, but the catastrophic impact profile and identity-backbone role of LDAP directories make this a high-priority patching target under Oracle's August 2026 Critical Patch Update.
Full system takeover is achievable against Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 via an unauthenticated HTTP attack targeting the Integration Broker component. The vulnerability carries a CVSS 3.1 score of 8.1 with complete confidentiality, integrity, and availability impact, though the AC:H metric indicates exploitation is not trivial and requires meeting specific attack complexity conditions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack path and full-takeover impact class make this a high-priority patching candidate for organizations running affected PeopleTools versions.
Local privilege escalation in Oracle Enterprise Manager for Systems Infrastructure (versions 13.5 and 24.1) allows a low-privileged authenticated local user to fully compromise the Agent component, resulting in complete takeover of the system with high confidentiality, integrity, and availability impact. The vulnerability is easily exploitable per Oracle's advisory, requiring only a valid local logon - no additional complexity or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full-takeover impact makes this a high-priority patching target for any organization running the affected component.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 is possible via the Business Interlink component, where a remote unauthenticated attacker sending crafted HTTP requests can take over the product. Oracle rates this at CVSS 9.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch in the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Siebel CRM Integration's REST component across versions 17.0 through 26.6 can yield complete loss of data confidentiality and integrity. Tagged as an authentication bypass, the vulnerability permits network-accessible attackers to read all CRM data and perform unauthorized create, delete, or modify operations without credentials. No public exploit has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update addresses the issue.
Local privilege escalation with scope change in Oracle Siebel CRM's Email Marketing component affects versions 17.0 through 26.6, confirmed via the Oracle August 2026 Critical Security Update advisory (EUVD-2026-61438). Low-privileged attackers with existing logon access to the Siebel infrastructure can, under difficult-to-reproduce conditions, bypass access controls to read or modify critical marketing data and cascade impacts to other integrated Siebel products. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated network exploitation of the Oracle Siebel CRM Marketing component enables critical data theft and unauthorized modification across all Marketing-accessible records. Tagged explicitly as an Authentication Bypass, the flaw allows a remote attacker with no credentials to compromise the confidentiality and integrity of sensitive CRM marketing data via HTTP, affecting all supported versions from 17.0 through 26.6. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the PR:N/UI:N vector means no user interaction or account is required, making the authentication bypass self-sufficient once the high-complexity exploitation conditions are met.
Unauthorized access to critical CRM data and partial data manipulation in Oracle Siebel CRM Deployment (versions 17.0-26.6) is achievable via the Migration component by any low-privileged attacker with HTTP network access, with a documented scope change indicating that successful exploitation can cascade to affect additional Oracle products beyond the directly targeted component. The CVSS 3.1 base score of 8.5 reflects low attack complexity and no user interaction requirement, making exploitation straightforward for any holder of a valid low-privilege credential. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though the breadth of affected versions spanning nearly a decade of releases represents substantial organizational exposure.
Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) contains an authentication bypass flaw enabling unauthenticated network attackers to fully compromise data confidentiality and integrity over HTTPS. The 'Authentication Bypass' tag from the Oracle reporter confirms the vulnerability class: an attacker who satisfies the high-complexity exploitation condition can read all CRM data and perform unauthorized creation, modification, or deletion of records. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Unauthenticated remote access to Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) exposes all CRM integration data to unauthorized disclosure and enables partial denial of service via plain HTTP. The vulnerability requires no credentials, no user interaction, and no special configuration beyond the REST interface being reachable, making it exploitable by any network-adjacent or internet-facing attacker. No public exploit has been identified at time of analysis, but Oracle's Critical Patch Update for August 2026 confirms the issue and its severity classification of CVSS 8.2.
Oracle Siebel CRM Deployment's Server Infrastructure component exposes versions 17.0 through 26.6 to an unauthenticated, network-based authentication bypass over HTTP that can result in complete compromise of CRM data confidentiality and integrity. The high complexity rating (AC:H) tempers immediate mass-exploitation risk, but the Authentication Bypass tag combined with C:H and I:H impact means a successful attacker achieves full read and write access to all CRM-accessible data - including customer records, sales pipelines, and service data - without presenting valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's Critical Security Patch Update for August 2026 addresses this vulnerability.
Oracle Siebel CRM Deployment's Application Interface component (versions 17.0 through 26.6) exposes complete read and write access to all CRM data to unauthenticated attackers positioned on the adjacent network segment. The CVSS vector confirms zero authentication requirements and low attack complexity, meaning any actor with access to the physical communication segment hosting the Siebel server can silently exfiltrate or corrupt the entire CRM dataset. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, but the authentication bypass classification combined with high confidentiality and integrity impact makes this a credible priority for organizations with insufficiently segmented internal networks.
Full takeover of Oracle Payments (Oracle E-Business Suite, File Transmission component) is possible by remote unauthenticated attackers over HTTP, affecting supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing profile makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation is possible in Oracle Payments (E-Business Suite component: File Transmission) across versions 12.2.3 through 12.2.15 via an authentication bypass exploitable over HTTP. A low-privileged network attacker can obtain complete read access to all Oracle Payments data and perform unauthorized insert, update, or delete operations against a subset of that data. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'easily exploitable' vendor classification combined with low attack complexity elevates real-world risk for unpatched EBS environments.
Integrity and availability compromise in Oracle Siebel Apps - Marketing (versions 17.0 through 26.6) is reachable by any low-privileged, network-authenticated attacker over HTTP with no user interaction required. Successful exploitation allows unauthorized creation, deletion, or modification of critical Marketing data, and can cause a complete denial of service via persistent hang or crash of the Marketing component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible threat in environments running unpatched Siebel deployments.
Full takeover of Oracle General Ledger (versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker via HTTP, exploiting an undisclosed flaw in the Internal Operations component of Oracle E-Business Suite. The CVSS vector confirms complete confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with application-level takeover. Notably, the intelligence tags classify this as 'Information Disclosure,' which conflicts with the described takeover impact - this discrepancy warrants verification against the Oracle August 2026 CSPU advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full takeover of Oracle Siebel Apps - Marketing is achievable by any low-privileged attacker with network access via HTTP, affecting all supported versions from 17.0 through 26.6. The CVSS 3.1 score of 8.8 reflects complete compromise of confidentiality, integrity, and availability, meaning an attacker can read, modify, or destroy data and disrupt service entirely. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a realistic threat for any internet- or intranet-exposed Siebel Marketing deployment.
Remote authentication bypass in Oracle Siebel CRM Integration's REST component affects all supported versions from 17.0 through 26.6, enabling unauthenticated network attackers to achieve full read and write access to critical CRM data via crafted HTTPS requests. The vulnerability is tagged Authentication Bypass, indicating that REST API access controls can be circumvented without credentials despite a high attack complexity (AC:H) rating that suggests exploitation requires precise crafting or internal state knowledge. No public exploit identified at time of analysis, but the combination of unauthenticated access and high confidentiality and integrity impact warrants priority patching under Oracle's August 2026 Critical Patch Update.
Full takeover of Oracle Siebel CRM's Marketing component is achievable by a low-privileged, network-accessible attacker exploiting a difficult-to-trigger condition via HTTP, affecting all supported versions from 17.0 through 26.6. Successful exploitation results in complete confidentiality, integrity, and availability compromise of the Marketing module - effectively a full component takeover. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog; however, Oracle's August 2026 Critical Patch Update confirms the flaw and releases a remediation.
Authentication bypass in Oracle Internet Procurement Connector (Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows unauthenticated remote attackers to compromise the Internal Operations component via HTTP, resulting in unauthorized read access to or manipulation of critical procurement data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impacts moderated by high attack complexity (AC:H), meaning exploitation requires specific conditions to be met despite requiring no credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized data exfiltration and limited data manipulation in Oracle Siebel Artificial Intelligence (versions 25.12 through 26.6) is achievable by any low-privileged, network-adjacent attacker over HTTP, with no user interaction required. Oracle's own advisory classifies this as 'easily exploitable,' and the scope change metric confirms that successful exploitation can cascade beyond the AI component to impact additional Siebel CRM products. No public exploit or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and broad confidentiality impact (C:H) make this a high-priority patching target for Oracle Siebel deployments.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM's Search component allows complete read and write access to all CRM data across versions 17.0 through 26.6. Successful exploitation enables creation, deletion, and modification of critical data as well as full confidentiality compromise without any prior authentication or user interaction. No public exploit identified at time of analysis, and this vulnerability is not currently listed in CISA KEV, though its low-complexity, unauthenticated nature makes it a credible priority for organizations with exposed Siebel deployments.
Unauthenticated remote compromise of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.6) allows a network attacker over HTTP to read all Marketing-accessible data and to force a complete, repeatable denial of service. The flaw is rated CVSS 3.1 9.1 and is tagged as an authentication bypass, meaning no credentials are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of no authentication, low attack complexity, and high confidentiality/availability impact makes it a high-priority patch.
Local privilege escalation in Oracle Siebel CRM Deployment (versions 17.0 through 26.6) allows a low-privileged local attacker to achieve full takeover of the affected installation, impacting confidentiality, integrity, and availability. The attack targets the Installation component and requires only logon access to the host infrastructure - no remote vector or user interaction is involved. No public exploit code and no active exploitation have been identified at time of analysis; however, the low attack complexity (AC:L) makes post-access exploitation straightforward.
Unauthorized data disclosure and partial service disruption affect Oracle Siebel CRM's Marketing component across versions 17.0 through 26.6, exploitable by a low-privileged authenticated attacker via HTTP without requiring user interaction. The flaw enables complete read access to all data within the Siebel Apps - Marketing scope alongside degraded service availability, as confirmed by Oracle's August 2026 Critical Security Patch Update. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover in Oracle Siebel CRM's Marketing component is achievable by low-privileged authenticated attackers over HTTP across all versions 17.0 through 26.6. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no user interaction required, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the straightforward exploitation conditions and full-triad impact make this a high-priority patch target for any organization running exposed Siebel Marketing instances.
Oracle General Ledger within E-Business Suite versions 12.2.3 through 12.2.15 exposes critical financial data to high-privileged network attackers through a flaw in the Internal Operations component accessible over HTTP. Successful exploitation grants complete read access to all General Ledger data and partial write capability, with a confirmed scope change meaning compromise can cascade to additional Oracle EBS products. Disclosed through Oracle's August 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.
Complete system takeover of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 through 8.63) is achievable by unauthenticated network attackers via HTTP, specifically through the PIA Core Technology component. Despite the high attack complexity rating (AC:H), successful exploitation yields full confidentiality, integrity, and availability compromise - effectively handing an attacker control over the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the impact warrants prioritized remediation through Oracle's August 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Web Services Manager (OWSM), part of Oracle Fusion Middleware's Web Services Security component, lets a remote unauthenticated attacker read, create, delete, or modify all OWSM-accessible data over HTTP. Tagged as an authentication bypass, it affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Compromise of Oracle WebCenter Portal's Composer component - versions 12.2.1.4.0 and 14.1.2.0.0 - allows an authenticated low-privilege attacker over HTTP to achieve high-integrity impact, including unauthorized creation, deletion, and modification of critical portal data, limited confidentiality exposure, and partial denial of service. The CVSS scope change (S:C) indicates exploitation can cascade to additional Oracle Fusion Middleware products beyond WebCenter Portal itself. Disclosed in Oracle's August 2026 Critical Security Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle WebCenter Portal is achievable by a low-privileged network attacker targeting the Composer component via Java RMI in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle describes the vulnerability as 'easily exploitable,' with the CVSS 3.1 score of 8.8 reflecting complete Confidentiality, Integrity, and Availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and this CVE has not appeared in the CISA Known Exploited Vulnerabilities catalog, though it is disclosed as part of Oracle's Critical Patch Update for August 2026.
Privilege-escalating account/system takeover in Oracle WebCenter Portal (Fusion Middleware, Composer component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an authenticated low-privileged attacker reach full compromise over HTTP. Because the flaw carries a scope change (S:C), successful exploitation can pivot beyond WebCenter Portal to impact additional products, and Oracle rates it CVSS 9.9. No public exploit identified at time of analysis, but the near-maximum score, low attack complexity, and minimal privilege requirement make it a top-tier patch priority.
Full takeover of Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged, network-authenticated attacker targeting the Composer component over HTTP. Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' with high impact across confidentiality, integrity, and availability and no user interaction required. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, low privilege requirement, and complete portal compromise warrants urgent patching priority for all affected deployments.
Unauthenticated data compromise and denial of service in Oracle WebCenter Portal (Fusion Middleware, Portlet Services component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker with only HTTP network access and no credentials can read or fully access all portal-accessible data and can force a hang or repeatable crash (complete DoS) of the portal. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Identity Manager (Oracle Fusion Middleware) affects the OIM Legacy UI component in versions 12.2.1.4.0 and 14.1.2.1.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the identity-management platform. The maximum CVSS 3.1 base score of 9.8 reflects complete loss of confidentiality, integrity, and availability, and because OIM governs enterprise identity and access, compromise cascades to every system it provisions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile makes it a high priority for immediate patching.
Remote network compromise of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 enables a low-privileged authenticated attacker to achieve full system takeover via the Authentication Engine over HTTP, with no user interaction required. Oracle's August 2026 Critical Patch Update advisory rates this CVSS 8.8 (High) and explicitly describes it as 'easily exploitable,' with complete confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Identity Manager (OIM Legacy UI) in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware allows a low-privileged remote attacker to fully take over the identity management platform via the T3 and IIOP protocols. The attack requires no user interaction and low complexity, resulting in complete confidentiality, integrity, and availability compromise of the OIM system. No public exploit has been identified at time of analysis, but the low barrier to exploitation makes this a critical patching priority for any enterprise running the affected versions.
Full product takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Legacy UI component) allows a remote, unauthenticated attacker to compromise the identity-governance platform over HTTP. Rated CVSS 9.8 with high confidentiality, integrity, and availability impact, this issue is trivially exploitable and requires no user interaction; at time of analysis there is no public exploit identified and it is not listed in CISA KEV. Because OIM brokers provisioning and access to downstream enterprise systems, a takeover here has cascading blast radius across connected accounts and applications.
Full compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged attacker over HTTP, resulting in complete takeover of the OIM instance. Because the flaw carries a scope change, successful exploitation can significantly impact additional connected products beyond OIM itself, elevating this from a single-product compromise to a potential identity-fabric breach. Disclosed in Oracle's August 2026 Critical Patch Update with a CVSS 3.1 base score of 9.9; no public exploit identified at time of analysis.
Full system takeover of Oracle Identity Manager is achievable by low-privileged network attackers via the OIM Legacy UI component using the T3 or IIOP protocols. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's Identity Manager product. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, effectively handing an attacker full control over the identity management platform. No public exploit has been identified at the time of analysis, and this issue is disclosed as part of Oracle's Critical Patch Update for August 2026.
Full takeover of Oracle Identity Manager via its Legacy UI component is achievable by any low-privileged, network-authenticated attacker over HTTP. Affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, with complete confidentiality, integrity, and availability impact - Oracle's own advisory characterizes the outcome as system takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) and minimal privilege bar (PR:L) make this a realistic target once any authenticated foothold exists in an exposed OIM deployment.
Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 expose a high-severity Security component flaw enabling authenticated high-privileged attackers to compromise the system via HTTP, with confirmed scope change affecting additional downstream products. Exploitation allows complete unauthorized read and write access to all OIM-accessible data, including critical identity and access management records. No public exploit has been identified at time of analysis, and this vulnerability was disclosed as part of Oracle's Critical Patch Update for August 2026.
Remote takeover of Oracle WebLogic Server is possible when a low-privileged attacker reaches the server over the T3 or IIOP protocols, abusing a flaw in the Core component to fully compromise the host. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and because the attack carries a scope change it can significantly impact products beyond WebLogic itself. Oracle rates it CVSS 9.9; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the CVSS profile matches historically weaponized WebLogic T3/IIOP deserialization bugs.
Unauthenticated remote data disclosure in Oracle WebLogic Server Core allows network-accessible attackers to exfiltrate all data reachable by the server via the T3 or IIOP protocols, with confirmed scope change impact on additional downstream systems. Tagged as an Authentication Bypass by Oracle, this affects four active release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - making it a broad exposure across the WebLogic installed base. No public exploit identified at time of analysis, and remediation is available through Oracle's Critical Patch Update (CPU) August 2026.
Remote takeover of Oracle WebLogic Server is possible when an unauthenticated attacker reaches the server's IIOP interface over the network, letting them fully compromise the Core component with high confidentiality, integrity, and availability impact. The flaw affects supported releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and is rated CVSS 9.8 by Oracle. No public exploit identified at time of analysis, but the pattern matches prior high-impact WebLogic IIOP deserialization flaws that were rapidly weaponized.
Unauthenticated remote takeover in Oracle WebLogic Server (Fusion Middleware Core) lets a network attacker fully compromise the server via the T3 and IIOP protocols with no credentials and no user interaction. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the class of flaw and the low attack complexity make it a top-priority patch.
Unauthorized data access and modification in Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a low-privileged network attacker targeting the Internal Operations component via HTTP. Successful exploitation grants complete read and write access to critical GL financial data plus partial availability disruption - a severe outcome for any organization relying on EBS for financial record integrity. The 'Authentication Bypass' tag suggests the vulnerability allows a low-privileged authenticated user to escalate effective access beyond their authorization level; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote integrity compromise and denial-of-service in Oracle WebLogic Server's Core component allows a low-privileged, network-accessible attacker to corrupt or destroy critical application data and crash the server via HTTP. All currently supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected, giving this vulnerability a wide blast radius across enterprise Oracle Fusion Middleware deployments. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, but Oracle's own characterization of the flaw as 'easily exploitable' combined with only a low-privilege account requirement makes patching under the August 2026 CPU urgent.
Full server takeover of Oracle WebLogic Server is achievable by a low-privileged network attacker exploiting a flaw in the Core component via the T3 or IIOP protocols. All four currently supported versions - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are confirmed affected per Oracle's Critical Patch Update for August 2026. Although High Attack Complexity (AC:H) limits opportunistic mass exploitation, successful attacks yield complete confidentiality, integrity, and availability compromise; no public exploit identified at time of analysis.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a remote, unauthenticated attacker with network access via the T3 or IIOP protocols to completely compromise affected instances (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0). The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity and availability impact and requires no privileges or user interaction. There is no public exploit identified at time of analysis, but WebLogic T3/IIOP deserialization flaws are historically rapid targets for weaponization.
Remote unauthenticated denial-of-service and partial data integrity compromise in Oracle MySQL Cluster's NDB Operator component allows network attackers to crash or hang the cluster and perform unauthorized data modifications. Affected versions span three active release lines: 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make exploitation straightforward against exposed deployments.
Unauthenticated data tampering and denial of service in Oracle Hospitality Simphony POS (versions 19.8-19.8.5, 19.9-19.9.3, 19.10-19.10.1) lets a remote attacker with only HTTP network access create, delete, or modify all Simphony-accessible data and force a repeatable crash. Oracle rates it CVSS 3.1 9.1 with high integrity and availability impact and describes it as easily exploitable, though there is no public exploit identified at time of analysis. It was reported by Oracle's own security team and fixed in the August 2026 Critical Patch Update.
Unauthenticated remote access to Oracle Hospitality Simphony's POS component enables complete unauthorized read access to all application data via an HTTP-based authentication bypass across three actively supported release lines. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms that no credentials, interaction, or special configuration are required - any network-reachable attacker can exploit the flaw. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Full server takeover in Oracle WebLogic Server Core component is achievable by unauthenticated remote attackers via the T3 and IIOP protocols, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Successful exploitation yields complete compromise of confidentiality, integrity, and availability of the targeted server instance. No public exploit has been identified at time of analysis, and exploitation is constrained by high attack complexity; however, WebLogic's T3/IIOP surface has a well-established history of critical deserialization exploits that warrants prioritized patching.
Oracle Outside In Technology 8.5.8 is susceptible to a local exploitation path that results in complete system takeover, affecting all three security pillars - confidentiality, integrity, and availability. The attack requires an unauthenticated adversary with logon access to the host infrastructure and human interaction from a separate user to trigger the vulnerable code path, placing this in the category of local privilege-escalation or malicious-file-processing attacks. No public exploit has been identified at time of analysis, but the severity of the impact (full takeover) and low attack complexity warrant prioritized patching per the Oracle CPU August 2026 advisory.
Full system takeover is possible in Oracle Outside In Technology 8.5.8 via a locally-delivered malicious document that exploits a flaw in the Outside In Core parsing component. An unauthenticated attacker who can induce a local user to open or process a crafted file can achieve complete compromise of confidentiality, integrity, and availability on the host. No public exploit has been identified at time of analysis, but the low attack complexity and broad CIA impact make this a credible priority for Oracle enterprise environments.
Full takeover of Oracle Outside In Technology 8.5.8 is achievable by a local attacker who can position a malicious file for processing by an authorized user on the same host, exploiting a low-complexity flaw in the Outside In Core parsing engine. The vulnerability affects Oracle Fusion Middleware deployments running OIT 8.5.8 and yields complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) and absence of privilege requirements (PR:N) make this straightforward to exploit for any attacker who has already achieved local system access.
Unauthenticated remote data exposure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows any network-accessible attacker to read critical or all data managed by the platform via HTTP, without any credentials or user interaction. The Lifecycle Management component contains an authentication bypass (per vendor tags) that collapses access controls entirely, exposing sensitive enterprise performance management data. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low-complexity, zero-privilege CVSS vector indicates straightforward exploitability for any attacker with network reach.
Full system takeover via Oracle Outside In Technology 8.5.8 is achievable by a local attacker exploiting a flaw in the PDF Export SDK component, requiring no application-level privileges but depending on human interaction from another user on the same infrastructure. The attack vector is strictly local (AV:L), confining risk to hosts where the SDK executes, yet successful exploitation yields complete confidentiality, integrity, and availability compromise of the affected process and host. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Patch Update.
Unauthenticated remote access to sensitive financial data is possible in Oracle Hyperion Financial Reporting version 11.2.25.0.000 via an authentication bypass in its Server component, exploitable over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no interaction, and no special configuration is required - making this trivially exploitable from any network-reachable position. Impact is limited to confidentiality, but the data exposed (financial reporting data) carries significant business and regulatory risk. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in Budibase's Oracle datasource connector (versions before 3.40.0) exposes the underlying Oracle database to arbitrary read and write operations by authenticated platform users. The post-write row lookup query concatenates table names into SQL identifiers without escaping double-quote characters, enabling injection of arbitrary SQL that executes under the datasource's Oracle database user account. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 score of 8.8 reflects high C/I/A impact but is tempered by significant access preconditions including high privilege requirements and an atypical table-naming condition.