Oracle
Monthly
Full takeover of Oracle PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 is possible when an unauthenticated remote attacker reaches the vulnerable Integration component over HTTPS. Oracle rates this 9.8 (CVSS 3.1) with high confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning no authentication, privileges, or user interaction are required. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low-complexity unauthenticated profile makes it a priority patch in the Oracle July 2026 Critical Patch Update.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise FIN Manufacturing Argentina 9.1 (Manufacturing component) lets a remote attacker read, create, modify, or delete all data accessible to the module over HTTP with no credentials. Oracle rates it CVSS 3.1 9.1 (Confidentiality and Integrity High, Availability None); it was disclosed in the Oracle Critical Patch Update of July 2026 and carries an 'Authentication Bypass' tag. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, network-based attacker fully compromise the module over HTTP. Oracle rates the flaw CVSS 8.8 with high confidentiality, integrity, and availability impact and classifies it as "easily exploitable," meaning an authenticated user with minimal privileges can escalate to full control of the affected product. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but Oracle's own "easily exploitable" language signals a low barrier once credentials are held.
Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, authenticated attacker send crafted HTTP requests to fully compromise the module and, due to a scope change, impact adjacent PeopleSoft products and data. Rated CVSS 9.9 with full confidentiality, integrity, and availability loss, this is disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eSettlements component) lets an unauthenticated attacker on the adjacent network segment read confidential PeopleSoft data and make limited unauthorized modifications. The flaw carries a scope change, so a successful attack can significantly impact products beyond the vulnerable module. No public exploit identified at time of analysis, and no EPSS or KEV signal is provided; the 8.2 CVSS score is driven by high confidentiality impact plus scope change rather than remote internet exploitability.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker to reach the module over HTTP and achieve high-impact modification of critical data, limited data disclosure, and a partial denial of service. Because Oracle assigns a scope change (S:C), a successful attack can reach beyond the vulnerable module and significantly impact additional PeopleSoft products, which drives the 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. The CVSS 3.1 base score is 9.1 (C:H/I:H, no availability impact) and the flaw is described by Oracle as easily exploitable, with an "Authentication Bypass" tag reinforcing the PR:N vector. No public exploit is identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.
Unauthenticated remote compromise of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Integration component) allows a network attacker to reach critical data and, because of a scope change, to impact additional PeopleSoft products beyond the vulnerable module. The flaw is rated CVSS 3.1 9.9 and is trivially exploitable over HTTP with no authentication or user interaction, yielding full read of accessible data plus partial write and partial denial-of-service. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the near-maximal score and unauthenticated network vector make it a high-priority patching candidate.
Unauthenticated information disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Staffing component) lets a remote attacker send crafted HTTP requests to read critical data, potentially achieving complete access to all data accessible to the affected module. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.5, but the impact is confined to confidentiality (no integrity or availability effect). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle PeopleSoft Enterprise HCM Global Payroll Switzerland 9.2 is possible via network-facing HTTP by an attacker who already holds high application privileges, per Oracle's July 2026 Critical Patch Update. Because the flaw carries a scope change, successful attacks can reach beyond the Global Payroll Switzerland component into additional PeopleSoft products, yielding full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the low attack complexity (CVSS 9.1) makes it a priority patch for organizations running this payroll module.
Data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (eProcurement component) lets a remote unauthenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. The flaw is rated CVSS 3.1 7.4 with high confidentiality and integrity impact but no availability impact, and is difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor advisory ties the fix to the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Integration component) is possible by an unauthenticated remote attacker over HTTP, with Oracle rating the flaw CVSS 9.8 and describing 'takeover' of the affected module. Disclosed in Oracle's July 2026 Critical Patch Update (CPUJUL2026), the issue affects the Brazilian financial-localization objects of the PeopleSoft Financials suite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Common Objects component) allows a remote unauthenticated attacker to reach and read critical financial data over HTTP. Oracle rates it easily exploitable with a CVSS 3.1 base of 7.5 and confidentiality-only impact (C:H/I:N/A:N), and it is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Takeover of Oracle Communications Converged Application Server 8.3 is possible via a flaw in its RTP Proxy component, exploitable only by a high-privileged attacker with local logon to the host where the server runs. The CVSS 3.1 vector (AV:L/AC:H/PR:H/S:C) reflects difficult exploitation requiring existing elevated access, but a scope change means a successful attack can impact additional products beyond the server itself, with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Full server takeover in Oracle Communications Converged Application Server 8.2 and 8.3 (Core component) is possible for an unauthenticated remote attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Successful attacks yield high confidentiality, integrity, and availability impact (CVSS 3.1 8.1), but the attack is rated high-complexity (AC:H), meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, indicating no confirmed active exploitation.
Full compromise (takeover) of Oracle Communications Converged Application Server 8.3 is possible via its Security component, where a high-privileged attacker with TLS network access can achieve confidentiality, integrity, and availability loss that also crosses a trust boundary to affect additional products (scope change). CVSS 3.1 scores this 8.0 despite high attack complexity and a high-privilege prerequisite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS value was supplied.
Full takeover of Oracle Communications Converged Application Server 8.2 and 8.3 is possible for a remote, unauthenticated attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 9.0 with a scope change (S:C), a successful attack can compromise confidentiality, integrity, and availability of the server and significantly impact additional connected products, though high attack complexity (AC:H) makes exploitation non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broad data compromise in Oracle E-Business Suite Secure Enterprise Search (Search Integration Engine) affects EBS versions 12.2.3 through 12.2.15, where a network attacker with only low-level authenticated access over HTTP can read, create, modify, or delete all data accessible to the Secure Enterprise Search component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N) rates it 8.1 High, reflecting low attack complexity and full confidentiality and integrity impact without availability loss. No public exploit identified at time of analysis, though the vendor's 'Authentication Bypass' tagging suggests weak access-control enforcement in the affected component.
Full takeover of the Oracle Database RDBMS component is possible for a low-privileged attacker who holds the Execute DBMS_CLOUD privilege and can reach the server over Oracle Net, affecting Database 19.3-19.31 and 23.4.0-23.26.2. Because the CVSS vector carries a scope change (S:C), a successful attack can pivot beyond the database to significantly impact additional products, yielding full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; the 9.9 base score is driven by low attack complexity and the scope change rather than by unauthenticated access.
Unauthorized data compromise in Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 (Security component) lets a remote, unauthenticated attacker read, create, modify, or delete all data accessible to the application over HTTPS. Rated CVSS 3.1 7.4 with high confidentiality and integrity impact but no availability impact, and flagged by Oracle with an Authentication Bypass characteristic. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation is rated high-complexity by Oracle.
Full takeover of Oracle PeopleSoft In-Memory Project Discovery 9.2 is possible when a low-privileged attacker with network access over HTTP exploits the Project Discovery component, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change (S:C), meaning successful attacks can significantly impact additional products beyond the vulnerable component itself, with complete loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low exploitation barrier make it a high remediation priority.
Unauthorized data compromise in Oracle PeopleSoft Enterprise SCM eProcurement 9.2 (Manage Requisition Status component) lets a remote, unauthenticated attacker read all module-accessible data and perform limited updates over HTTP, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 9.3 (Critical) and tagged as an authentication bypass, the flaw is easily exploitable without user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data modification in Oracle PeopleSoft Enterprise SCM Purchasing 9.2 (Purchasing component) allows a remote, unauthenticated attacker with HTTP network access to create, delete, or modify critical Purchasing data and read a subset of accessible data. Oracle rates it CVSS 3.1 8.2 and describes it as easily exploitable with no privileges or user interaction, and its own tagging characterizes the flaw as an authentication bypass. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, so risk is currently driven by exposure rather than confirmed active exploitation.
Account takeover in Oracle PeopleSoft Enterprise FIN Program Management 9.2 (Primavera Integration component) lets a low-privileged, authenticated remote attacker fully compromise the module by luring a separate legitimate user into interacting with malicious HTTP content, with a scope change that spills the impact into other integrated Oracle products. Oracle rates it CVSS 3.1 9.0 with full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis; it is disclosed only via the Oracle July 2026 Critical Patch Update.
Remote unauthenticated compromise of Oracle PeopleSoft Enterprise FIN Expenses 9.2 (Expenses component) allows attackers with only HTTP network access to read, create, delete or modify all Expenses-accessible data and to cause a partial denial of service. Rated CVSS 3.1 9.4 and flagged by Oracle as easily exploitable, meaning no authentication or user interaction is required. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low-complexity unauthenticated profile makes it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Local privilege-boundary compromise in Oracle Solaris 11.3 and 11.4 (Utility component) allows a low-privileged attacker with a local logon to gain unauthorized read and write access to critical Solaris data, with a scope change that can significantly impact additional products beyond Solaris itself. The flaw carries a CVSS 3.1 base score of 7.5 despite requiring high attack complexity, reflecting the high confidentiality and integrity impact combined with scope change. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle PeopleSoft Enterprise CRM Common Objects 9.2.23 is possible by a remote, unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Although the flaw resides in the CRM Common Objects component, a scope change means a successful attack can cascade into other PeopleSoft products and result in complete takeover of the affected component. Oracle rates it CVSS 9.0 but flags it as difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 allows attackers with only network/HTTP access to read, create, delete, or modify any data the identity platform can reach. Tagged by the reporter as an authentication bypass, this flaw carries a CVSS 9.1 rating driven by high confidentiality and integrity impact, and because OIM governs enterprise identity and account provisioning, a successful attack effectively hands over control of user identity data. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Complete takeover of Oracle Identity Manager is possible through its OIM Legacy UI component, allowing a remote unauthenticated attacker with only HTTP network access to fully compromise the confidentiality, integrity, and availability of the identity governance platform. Affected releases are the Fusion Middleware bundles 12.2.1.4.0 and 14.1.2.1.0. Oracle rates this CVSS 9.8 and addressed it in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows a low-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity, and availability impact. The Oracle July 2026 Critical Patch Update rates this CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H). No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Agile Engineering Data Management 6.2.1 (Install component) lets attackers with only HTTP network access modify or destroy critical PLM data, read a subset of accessible data, and trigger a complete denial of service. Oracle rates it CVSS 9.4 and describes it as easily exploitable, but it is not in CISA KEV and no public exploit has been identified. The combination of no authentication requirement with high integrity and availability impact makes it a serious exposure for any network-reachable deployment.
Unauthorized data disclosure in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows an unauthenticated attacker on the adjacent network segment to compromise confidentiality and, due to a scope change, impact additional connected products. The flaw is rated CVSS 3.1 7.4 with confidentiality-only impact and no integrity or availability effect. There is no public exploit identified at time of analysis, and it was disclosed by Oracle in the July 2026 Critical Patch Update.
Unauthenticated remote compromise of Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) lets network attackers read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 9.1 driven by full confidentiality and integrity impact, and community tagging labels it an authentication bypass. No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided.
Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible when a remote, unauthenticated attacker reaches the Reporting component over HTTP, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (C:H/I:H/A:H) reflects that a successful attack yields full confidentiality, integrity, and availability compromise of the product. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication, low-complexity profile makes it a high patch priority.
Sensitive data compromise in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) lets a low-privileged, network-authenticated attacker read all application-accessible data and make limited unauthorized modifications, with a scope change that can significantly impact additional products. Oracle rates it easily exploitable but it requires tricking a separate user into interaction (UI:R), yielding a CVSS 3.1 base score of 7.6. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) allows a low-privileged, network-authenticated attacker to compromise confidentiality, integrity, and availability over HTTP. Oracle rates this 8.8 and describes it as 'easily exploitable,' meaning any user holding a valid low-level account can escalate to full application control. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and high impact make it a strong patch priority.
Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) allows a low-privileged, network-authenticated attacker to compromise the entire application over HTTP. Oracle rates the flaw as easily exploitable with high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and it is not on CISA KEV; the only source is Oracle's July 2026 Critical Patch Update.
Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the product's Installation component and yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthorized critical-data access and partial denial of service in Oracle Product Lifecycle Analytics 3.6.1 (Supply Chain suite, Installation Issues component) allows a remote, unauthenticated attacker over HTTP to fully read all data the application can access and partially disrupt service. The flaw carries a scope change, so successful attacks may significantly impact adjacent Oracle products beyond the analytics component itself. Rated CVSS 3.1 9.3 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege-to-scope-change compromise in Oracle Product Lifecycle Analytics 3.6.1 (Oracle Supply Chain, Installation Issues component) lets an attacker with logon access to the host where the software runs take over the application without application-level credentials. Successful exploitation yields full read and write access to all data accessible to Oracle Product Lifecycle Analytics and, because of a CVSS scope change, may significantly impact other products on the same infrastructure. No public exploit identified at time of analysis; the flaw was reported by Oracle and fixed in the July 2026 Critical Patch Update.
Unauthorized data access and manipulation in Oracle Agile PLM 9.3.6 (Security component) allows a remote unauthenticated attacker with HTTP access to read, create, delete, or modify all Agile PLM-accessible data. The high attack complexity (AC:H) means exploitation requires specific conditions the attacker cannot fully control, which lowers real-world exploitability despite the network-facing, no-authentication vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'Authentication Bypass' tag and full confidentiality/integrity impact make this a meaningful patch priority for exposed deployments.
Unauthorized data disclosure in Oracle Agile PLM 9.3.6 (Security component) lets a remote, unauthenticated attacker reach critical business data over HTTP without any user interaction. The Oracle CPU (July 2026) and EUVD tagging characterize this as an authentication-bypass-class weakness yielding full read access to all Agile PLM-accessible data. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Agile PLM 9.3.6 (Security component) allows a remote attacker with only HTTP network access to read, create, delete, or modify all data accessible to the application. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 9.1; no public exploit identified at time of analysis, and it is not listed in CISA KEV. It was reported by Oracle's own security team and addressed in the Oracle July 2026 Critical Patch Update.
Full product takeover of Oracle Agile PLM 9.3.6 (Product Lifecycle Management) is possible by an unauthenticated remote attacker over HTTP against the Security component, per Oracle Critical Patch Update July 2026. The CVSS 3.1 base score is 8.1 with high attack complexity, meaning exploitation is difficult and likely requires specific conditions or timing to succeed, but a successful attack yields complete compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied.
Account takeover in Oracle Agile PLM 9.3.6 (Security component) lets a low-privileged, remotely authenticated attacker fully compromise the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated easily exploitable with high confidentiality, integrity, and availability impact (CVSS 8.8) and results in complete takeover of the Agile PLM instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full compromise of Oracle Agile PLM 9.3.6 (Security component) allows an unauthenticated remote attacker to take over the application over HTTP with no user interaction. Rated CVSS 9.8 with high impact to confidentiality, integrity, and availability, this flaw is disclosed via Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch for internet- or intranet-exposed instances.
Full application takeover in Oracle Agile PLM 9.3.6 (Product Lifecycle Management) is possible via the User and User Group component, where a low-privileged authenticated user with HTTP network access can escalate to complete compromise of confidentiality, integrity, and availability. Rated CVSS 3.1 8.8 (High) and disclosed in Oracle's Critical Patch Update of July 2026, exploitation requires only valid low-level credentials and low attack complexity, making it attractive for insider or credential-theft abuse. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service and information disclosure in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a low-privileged, network-adjacent attacker send crafted HTTP requests to hang or repeatedly crash the service (complete DoS) and read a subset of accessible data. The flaw is rated CVSS 3.1 7.1 and was disclosed by Oracle in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle characterizes it as easily exploitable.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach the Content Acquisition System over HTTPS and read, create, modify, or delete all data accessible to the product. The 'Authentication Bypass' tagging combined with PR:N in the CVSS vector indicates the flaw defeats access controls without credentials, though the high attack complexity (AC:H) means exploitation is non-trivial. No public exploit identified at time of analysis and the issue is not in CISA KEV; it was disclosed by Oracle in the July 2026 Critical Patch Update.
Full product takeover in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Forge component) lets an unauthenticated remote attacker compromise confidentiality, integrity and availability over HTTP, per Oracle's CVSS 3.1 8.1 rating. Exploitation is rated high-complexity (AC:H), so it requires specific conditions or timing rather than a trivial single request. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller) allows a low-privileged local attacker with logon access to read, create, modify, or delete all data accessible to the product. The flaw carries a CVSS 3.1 base score of 7.1 (C:H/I:H, no availability impact) and is described by Oracle as 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it was disclosed in the Oracle Critical Patch Update of July 2026.
Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Controller, which an unauthenticated attacker can reach over HTTP to fully compromise the product. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its network-facing, no-authentication profile makes it a high-priority patch item.
Sensitive data disclosure and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) let a low-privileged, network-based attacker read all data accessible to the application and hang or repeatedly crash the service over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and availability impact but no integrity impact. Disclosed in the Oracle July 2026 Critical Patch Update; no public exploit identified at time of analysis and not listed in CISA KEV.
Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 lets a remote, unauthenticated attacker read all data accessible to the Experience Manager component over HTTP. Oracle rates it CVSS 7.5 with high confidentiality impact and no integrity or availability effect, and the reporter tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, no-privilege profile makes it a straightforward information-disclosure risk.
Unauthorized data disclosure in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker abuse the exposed RMI interface of the Experience Manager component to read critical or all Guided Search accessible data. Scored CVSS 3.1 7.5 with confidentiality-only impact and rated 'easily exploitable' by Oracle, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Disclosed in Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach sensitive data over HTTP, with Oracle and the EUVD entry tagging the flaw as an authentication bypass. The CVSS 3.1 base score of 7.5 reflects a high-confidentiality, no-integrity, no-availability impact, and Oracle labels it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a credible target once patch details are reverse-engineered.
Unauthenticated data compromise in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) allows remote attackers over HTTPS to read, create, modify, or delete all data accessible to the service without any credentials. Oracle rates this CVSS 9.1 with high confidentiality and integrity impact and characterizes it as 'easily exploitable,' and the intelligence tags flag an authentication-bypass class issue. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis.
Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a remote attacker send crafted HTTP requests to read all data accessible to the service and to crash or hang it completely. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and availability impact and no integrity impact; disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the combination of network reachability, no authentication, and low complexity makes it an urgent patch priority.
Complete takeover of Oracle Commerce Guided Search Platform Services 11.4.0 (formerly Endeca) is possible by an unauthenticated remote attacker sending crafted HTTP requests to the Forge component. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and lack of authentication make it a high-priority patch target.
Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a remote, unauthenticated attacker to read and modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact) and is easily exploitable per Oracle. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-privileges vector makes it a high-priority patch.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a low-privileged, network-based attacker over HTTP to gain complete read access to all accessible data plus limited update, insert, and delete capability. Rated CVSS 7.1 and tagged as an authentication bypass, it was disclosed by Oracle in the July 2026 Critical Patch Update and requires only low-level credentials with no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all data accessible to the application. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact) and tagged as an authentication-bypass-class issue by the reporter. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.
Takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible for an authenticated low-privileged attacker reaching the Experience Manager component over HTTP. Rated CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact, this flaw was disclosed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation to full takeover in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a low-privileged attacker with HTTP network access compromise the Experience Manager component, yielding high confidentiality, integrity, and availability impact. Rated CVSS 3.1 8.8 and reported through Oracle's coordinated disclosure (July 2026 CPU), with no public exploit identified at time of analysis and no CISA KEV listing. Any authenticated user of the affected component can potentially seize control of the entire product instance.
Full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is possible when a low-privileged attacker reaches the Content Acquisition System component over HTTP. Oracle rates this 9.9 with a scope change (S:C), meaning a successful compromise of the Guided Search product can significantly impact additional downstream products beyond the vulnerable component itself. There is no public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority patch item.
Remote takeover in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System component) allows an unauthenticated attacker with HTTP network access to fully compromise the product. Oracle rates it CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning no authentication or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, unauthenticated 'takeover' profile makes it a top-tier patching priority.
Unauthorized disclosure of critical data in Oracle Payroll (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all Payroll-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact additional Oracle products beyond Payroll itself, raising the effective blast radius. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact.
Full compromise of the Oracle Advanced Benefits module (Affordable Care Act component) within Oracle E-Business Suite 12.2.7 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests over the network. Successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact. This is a July 2026 Oracle Critical Patch Update issue with no public exploit identified at time of analysis and no CISA KEV listing.
Remote takeover in Oracle WebCenter Sites 14.1.2.0.0 allows an unauthenticated attacker with only HTTP network access to fully compromise the product, yielding complete confidentiality, integrity, and availability loss (CVSS 3.1 9.8). Disclosed in the Oracle Critical Patch Update of July 2026 and reported by Oracle's own security alert team, it is rated easily exploitable but has no public exploit identified at time of analysis. WebCenter Sites is Oracle's enterprise web experience/content management platform, so a compromise means attacker control over the delivery of managed web content.
Unauthorized data disclosure in Oracle Complex Maintenance, Repair and Overhaul (CMRO), a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a remote unauthenticated attacker abuse the Internal Operations component over HTTP to read critical CMRO data and make limited unauthorized modifications. Because the flaw carries a scope change, a successful attack can significantly impact products beyond CMRO itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity, so exploitation is rated difficult.
Full takeover of Oracle Commerce Platform 11.4.0 is possible by a remote unauthenticated attacker who reaches the Dynamo Application Framework component over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation compromises confidentiality, integrity, and availability of the platform (CVSS 3.1 8.1), though Oracle rates it difficult to exploit (AC:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data tampering and partial denial of service in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework) allows a remote attacker to reach the platform over HTTP and, without any credentials, perform unauthorized insert/update/delete on some accessible data, read a subset of accessible data, and partially disrupt availability. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Data compromise in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a remote, unauthenticated attacker read, create, modify, or delete all data accessible to the platform over HTTP. The flaw carries a CVSS 3.1 score of 7.4 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as difficult to exploit (AC:H). Disclosed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Commerce Platform 11.4.0 lets a remote, unauthenticated attacker reaching the Dynamo Application Framework's LDAP integration read critical application data, potentially all data accessible to the platform. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score in the provided data, so this is a serious-but-not-yet-weaponized disclosure flaw disclosed in the July 2026 Oracle Critical Patch Update.
Cross-context data compromise in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework/ATG) lets a low-privileged, authenticated network attacker who lures a victim into interacting with crafted HTTP content read all platform-accessible data and make limited unauthorized modifications, with impact crossing into additional products via a scope change. The CVSS:3.1 score is 7.6 (C:H/I:L, scope-changed), and the UI:R plus scope-change profile is characteristic of a stored/reflected web-injection class flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with HTTP network access to fully compromise the product, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 9.8 (Critical) rating. Oracle describes the flaw as easily exploitable, though it publishes no technical root-cause detail beyond the CPU advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated network reach and complete system takeover makes this a top-tier patch priority.
Remote unauthenticated compromise of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a network attacker reach sensitive data and knock the service offline over HTTP. With no authentication or user interaction required and a CVSS 3.1 base of 9.1, a successful attack yields access to all Commerce Platform-accessible data plus a complete, repeatable denial of service. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full system takeover of Oracle Commerce Platform 11.4.0 is possible when a remote, unauthenticated attacker reaches the ATG Portals component over HTTP. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and yields complete compromise of the platform. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Account/system takeover in Oracle Communications Service Catalog and Design (versions 8.0.0.7.0 through 8.3.0.2.0), Solution Designer component, lets a low-privileged attacker with network HTTP access fully compromise the product. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, Oracle describes it as 'easily exploitable,' meaning any authenticated user can escalate to complete control. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local privilege-escalation to full takeover in Oracle Communications Billing and Revenue Management (BRM) 15.0.0.0.0-15.0.1.0.0 and 15.1.0.0.0-15.2.0.0.0 allows a low-privileged attacker with logon access to the underlying infrastructure to fully compromise the BRM Platform component, with high confidentiality, integrity, and availability impact. The flaw is rated CVSS 3.1 7.8 and was disclosed by Oracle in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because BRM is a back-office telecom billing platform, exploitation requires an existing foothold on the host rather than remote unauthenticated access.
Unauthorized data disclosure in Oracle Configure to Order (Supply to Order Workbench component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read all data accessible to the application and, because of a scope change, to impact additional Oracle products beyond Configure to Order. Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it was reported through Oracle's own security alert channel for the July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, delete, or modify all HRMS (UK)-accessible data over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impacts and no availability impact, Oracle describes it as easily exploitable and tags it as an authentication-bypass class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a low-privileged, network-based attacker fully compromise the module over HTTP with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Oracle classifies it as easily exploitable and rates the outcome as complete takeover of Oracle HRMS (UK). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as a networked, low-complexity flaw requiring only minimal privileges it warrants prompt patching in the July 2026 Critical Patch Update.
Full compromise of Oracle HRMS (US) within Oracle E-Business Suite is possible via the Internal Operations component, letting a low-privileged user with local logon access escalate to complete takeover of the HRMS application, with confidentiality, integrity and availability all fully impacted. Rated CVSS 3.1 7.0 but explicitly high-complexity (AC:H), so exploitation is non-trivial and requires an existing account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering and partial denial of service in Oracle HRMS (UK) - the UK Payroll component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 - lets a low-privileged, authenticated attacker with HTTP network access create, modify or delete critical HRMS data and partially degrade the service. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable' (AC:L), meaning any account holder on the EBS instance can abuse it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.
Unauthorized data disclosure in Oracle Application Object Library (a core component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, resulting in unauthorized access to critical data or complete access to all data accessible to Oracle Application Object Library. Fixed in Oracle's July 2026 Critical Patch Update, the flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 7.5 driven entirely by confidentiality impact (C:H, I:N, A:N). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Order Management (part of Oracle E-Business Suite) is possible via the Product Diagnostic Tools component in supported releases 12.2.3 through 12.2.15, where an authenticated high-privileged user with HTTP network access can achieve a complete takeover of the module with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix is delivered in the Oracle Critical Patch Update of July 2026.
Full compromise of Oracle Application Object Library (the core security and application framework within Oracle E-Business Suite, DB Privileges component) is possible by a low-privileged, authenticated attacker sending crafted HTTP requests. Successful attacks yield complete takeover of the Application Object Library across supported EBS releases 12.2.3 through 12.2.15, impacting confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the flaw is rated difficult to exploit (AC:H), but the CVSS 3.1 base score of 7.5 and the takeover impact make it a notable item in the Oracle July 2026 Critical Patch Update.
Remote data compromise in Oracle Application Object Library (the shared framework layer of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows an unauthenticated network attacker to read, create, delete, or modify all data accessible to the component over HTTP. The high attack complexity (AC:H) makes reliable exploitation non-trivial, but success yields full confidentiality and integrity impact against a core ERP platform. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor tags associate it with an authentication bypass pattern.
Privilege escalation to full component takeover in Oracle E-Business Suite (Oracle Applications DBA, ADPatch component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the Oracle Applications DBA subsystem, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Disclosed in Oracle's July 2026 Critical Patch Update, this is easily exploitable per Oracle's own rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a strong patching priority.
Full takeover of Oracle PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 is possible when an unauthenticated remote attacker reaches the vulnerable Integration component over HTTPS. Oracle rates this 9.8 (CVSS 3.1) with high confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning no authentication, privileges, or user interaction are required. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low-complexity unauthenticated profile makes it a priority patch in the Oracle July 2026 Critical Patch Update.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise FIN Manufacturing Argentina 9.1 (Manufacturing component) lets a remote attacker read, create, modify, or delete all data accessible to the module over HTTP with no credentials. Oracle rates it CVSS 3.1 9.1 (Confidentiality and Integrity High, Availability None); it was disclosed in the Oracle Critical Patch Update of July 2026 and carries an 'Authentication Bypass' tag. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, network-based attacker fully compromise the module over HTTP. Oracle rates the flaw CVSS 8.8 with high confidentiality, integrity, and availability impact and classifies it as "easily exploitable," meaning an authenticated user with minimal privileges can escalate to full control of the affected product. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but Oracle's own "easily exploitable" language signals a low barrier once credentials are held.
Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, authenticated attacker send crafted HTTP requests to fully compromise the module and, due to a scope change, impact adjacent PeopleSoft products and data. Rated CVSS 9.9 with full confidentiality, integrity, and availability loss, this is disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eSettlements component) lets an unauthenticated attacker on the adjacent network segment read confidential PeopleSoft data and make limited unauthorized modifications. The flaw carries a scope change, so a successful attack can significantly impact products beyond the vulnerable module. No public exploit identified at time of analysis, and no EPSS or KEV signal is provided; the 8.2 CVSS score is driven by high confidentiality impact plus scope change rather than remote internet exploitability.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker to reach the module over HTTP and achieve high-impact modification of critical data, limited data disclosure, and a partial denial of service. Because Oracle assigns a scope change (S:C), a successful attack can reach beyond the vulnerable module and significantly impact additional PeopleSoft products, which drives the 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. The CVSS 3.1 base score is 9.1 (C:H/I:H, no availability impact) and the flaw is described by Oracle as easily exploitable, with an "Authentication Bypass" tag reinforcing the PR:N vector. No public exploit is identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.
Unauthenticated remote compromise of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Integration component) allows a network attacker to reach critical data and, because of a scope change, to impact additional PeopleSoft products beyond the vulnerable module. The flaw is rated CVSS 3.1 9.9 and is trivially exploitable over HTTP with no authentication or user interaction, yielding full read of accessible data plus partial write and partial denial-of-service. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the near-maximal score and unauthenticated network vector make it a high-priority patching candidate.
Unauthenticated information disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Staffing component) lets a remote attacker send crafted HTTP requests to read critical data, potentially achieving complete access to all data accessible to the affected module. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.5, but the impact is confined to confidentiality (no integrity or availability effect). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle PeopleSoft Enterprise HCM Global Payroll Switzerland 9.2 is possible via network-facing HTTP by an attacker who already holds high application privileges, per Oracle's July 2026 Critical Patch Update. Because the flaw carries a scope change, successful attacks can reach beyond the Global Payroll Switzerland component into additional PeopleSoft products, yielding full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the low attack complexity (CVSS 9.1) makes it a priority patch for organizations running this payroll module.
Data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (eProcurement component) lets a remote unauthenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. The flaw is rated CVSS 3.1 7.4 with high confidentiality and integrity impact but no availability impact, and is difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor advisory ties the fix to the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Integration component) is possible by an unauthenticated remote attacker over HTTP, with Oracle rating the flaw CVSS 9.8 and describing 'takeover' of the affected module. Disclosed in Oracle's July 2026 Critical Patch Update (CPUJUL2026), the issue affects the Brazilian financial-localization objects of the PeopleSoft Financials suite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Common Objects component) allows a remote unauthenticated attacker to reach and read critical financial data over HTTP. Oracle rates it easily exploitable with a CVSS 3.1 base of 7.5 and confidentiality-only impact (C:H/I:N/A:N), and it is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Takeover of Oracle Communications Converged Application Server 8.3 is possible via a flaw in its RTP Proxy component, exploitable only by a high-privileged attacker with local logon to the host where the server runs. The CVSS 3.1 vector (AV:L/AC:H/PR:H/S:C) reflects difficult exploitation requiring existing elevated access, but a scope change means a successful attack can impact additional products beyond the server itself, with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Full server takeover in Oracle Communications Converged Application Server 8.2 and 8.3 (Core component) is possible for an unauthenticated remote attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Successful attacks yield high confidentiality, integrity, and availability impact (CVSS 3.1 8.1), but the attack is rated high-complexity (AC:H), meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, indicating no confirmed active exploitation.
Full compromise (takeover) of Oracle Communications Converged Application Server 8.3 is possible via its Security component, where a high-privileged attacker with TLS network access can achieve confidentiality, integrity, and availability loss that also crosses a trust boundary to affect additional products (scope change). CVSS 3.1 scores this 8.0 despite high attack complexity and a high-privilege prerequisite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS value was supplied.
Full takeover of Oracle Communications Converged Application Server 8.2 and 8.3 is possible for a remote, unauthenticated attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 9.0 with a scope change (S:C), a successful attack can compromise confidentiality, integrity, and availability of the server and significantly impact additional connected products, though high attack complexity (AC:H) makes exploitation non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broad data compromise in Oracle E-Business Suite Secure Enterprise Search (Search Integration Engine) affects EBS versions 12.2.3 through 12.2.15, where a network attacker with only low-level authenticated access over HTTP can read, create, modify, or delete all data accessible to the Secure Enterprise Search component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N) rates it 8.1 High, reflecting low attack complexity and full confidentiality and integrity impact without availability loss. No public exploit identified at time of analysis, though the vendor's 'Authentication Bypass' tagging suggests weak access-control enforcement in the affected component.
Full takeover of the Oracle Database RDBMS component is possible for a low-privileged attacker who holds the Execute DBMS_CLOUD privilege and can reach the server over Oracle Net, affecting Database 19.3-19.31 and 23.4.0-23.26.2. Because the CVSS vector carries a scope change (S:C), a successful attack can pivot beyond the database to significantly impact additional products, yielding full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; the 9.9 base score is driven by low attack complexity and the scope change rather than by unauthenticated access.
Unauthorized data compromise in Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 (Security component) lets a remote, unauthenticated attacker read, create, modify, or delete all data accessible to the application over HTTPS. Rated CVSS 3.1 7.4 with high confidentiality and integrity impact but no availability impact, and flagged by Oracle with an Authentication Bypass characteristic. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation is rated high-complexity by Oracle.
Full takeover of Oracle PeopleSoft In-Memory Project Discovery 9.2 is possible when a low-privileged attacker with network access over HTTP exploits the Project Discovery component, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change (S:C), meaning successful attacks can significantly impact additional products beyond the vulnerable component itself, with complete loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low exploitation barrier make it a high remediation priority.
Unauthorized data compromise in Oracle PeopleSoft Enterprise SCM eProcurement 9.2 (Manage Requisition Status component) lets a remote, unauthenticated attacker read all module-accessible data and perform limited updates over HTTP, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 9.3 (Critical) and tagged as an authentication bypass, the flaw is easily exploitable without user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data modification in Oracle PeopleSoft Enterprise SCM Purchasing 9.2 (Purchasing component) allows a remote, unauthenticated attacker with HTTP network access to create, delete, or modify critical Purchasing data and read a subset of accessible data. Oracle rates it CVSS 3.1 8.2 and describes it as easily exploitable with no privileges or user interaction, and its own tagging characterizes the flaw as an authentication bypass. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, so risk is currently driven by exposure rather than confirmed active exploitation.
Account takeover in Oracle PeopleSoft Enterprise FIN Program Management 9.2 (Primavera Integration component) lets a low-privileged, authenticated remote attacker fully compromise the module by luring a separate legitimate user into interacting with malicious HTTP content, with a scope change that spills the impact into other integrated Oracle products. Oracle rates it CVSS 3.1 9.0 with full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis; it is disclosed only via the Oracle July 2026 Critical Patch Update.
Remote unauthenticated compromise of Oracle PeopleSoft Enterprise FIN Expenses 9.2 (Expenses component) allows attackers with only HTTP network access to read, create, delete or modify all Expenses-accessible data and to cause a partial denial of service. Rated CVSS 3.1 9.4 and flagged by Oracle as easily exploitable, meaning no authentication or user interaction is required. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low-complexity unauthenticated profile makes it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Local privilege-boundary compromise in Oracle Solaris 11.3 and 11.4 (Utility component) allows a low-privileged attacker with a local logon to gain unauthorized read and write access to critical Solaris data, with a scope change that can significantly impact additional products beyond Solaris itself. The flaw carries a CVSS 3.1 base score of 7.5 despite requiring high attack complexity, reflecting the high confidentiality and integrity impact combined with scope change. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle PeopleSoft Enterprise CRM Common Objects 9.2.23 is possible by a remote, unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Although the flaw resides in the CRM Common Objects component, a scope change means a successful attack can cascade into other PeopleSoft products and result in complete takeover of the affected component. Oracle rates it CVSS 9.0 but flags it as difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 allows attackers with only network/HTTP access to read, create, delete, or modify any data the identity platform can reach. Tagged by the reporter as an authentication bypass, this flaw carries a CVSS 9.1 rating driven by high confidentiality and integrity impact, and because OIM governs enterprise identity and account provisioning, a successful attack effectively hands over control of user identity data. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Complete takeover of Oracle Identity Manager is possible through its OIM Legacy UI component, allowing a remote unauthenticated attacker with only HTTP network access to fully compromise the confidentiality, integrity, and availability of the identity governance platform. Affected releases are the Fusion Middleware bundles 12.2.1.4.0 and 14.1.2.1.0. Oracle rates this CVSS 9.8 and addressed it in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows a low-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity, and availability impact. The Oracle July 2026 Critical Patch Update rates this CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H). No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Agile Engineering Data Management 6.2.1 (Install component) lets attackers with only HTTP network access modify or destroy critical PLM data, read a subset of accessible data, and trigger a complete denial of service. Oracle rates it CVSS 9.4 and describes it as easily exploitable, but it is not in CISA KEV and no public exploit has been identified. The combination of no authentication requirement with high integrity and availability impact makes it a serious exposure for any network-reachable deployment.
Unauthorized data disclosure in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows an unauthenticated attacker on the adjacent network segment to compromise confidentiality and, due to a scope change, impact additional connected products. The flaw is rated CVSS 3.1 7.4 with confidentiality-only impact and no integrity or availability effect. There is no public exploit identified at time of analysis, and it was disclosed by Oracle in the July 2026 Critical Patch Update.
Unauthenticated remote compromise of Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) lets network attackers read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 9.1 driven by full confidentiality and integrity impact, and community tagging labels it an authentication bypass. No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided.
Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible when a remote, unauthenticated attacker reaches the Reporting component over HTTP, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (C:H/I:H/A:H) reflects that a successful attack yields full confidentiality, integrity, and availability compromise of the product. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication, low-complexity profile makes it a high patch priority.
Sensitive data compromise in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) lets a low-privileged, network-authenticated attacker read all application-accessible data and make limited unauthorized modifications, with a scope change that can significantly impact additional products. Oracle rates it easily exploitable but it requires tricking a separate user into interaction (UI:R), yielding a CVSS 3.1 base score of 7.6. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) allows a low-privileged, network-authenticated attacker to compromise confidentiality, integrity, and availability over HTTP. Oracle rates this 8.8 and describes it as 'easily exploitable,' meaning any user holding a valid low-level account can escalate to full application control. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and high impact make it a strong patch priority.
Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) allows a low-privileged, network-authenticated attacker to compromise the entire application over HTTP. Oracle rates the flaw as easily exploitable with high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and it is not on CISA KEV; the only source is Oracle's July 2026 Critical Patch Update.
Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the product's Installation component and yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthorized critical-data access and partial denial of service in Oracle Product Lifecycle Analytics 3.6.1 (Supply Chain suite, Installation Issues component) allows a remote, unauthenticated attacker over HTTP to fully read all data the application can access and partially disrupt service. The flaw carries a scope change, so successful attacks may significantly impact adjacent Oracle products beyond the analytics component itself. Rated CVSS 3.1 9.3 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege-to-scope-change compromise in Oracle Product Lifecycle Analytics 3.6.1 (Oracle Supply Chain, Installation Issues component) lets an attacker with logon access to the host where the software runs take over the application without application-level credentials. Successful exploitation yields full read and write access to all data accessible to Oracle Product Lifecycle Analytics and, because of a CVSS scope change, may significantly impact other products on the same infrastructure. No public exploit identified at time of analysis; the flaw was reported by Oracle and fixed in the July 2026 Critical Patch Update.
Unauthorized data access and manipulation in Oracle Agile PLM 9.3.6 (Security component) allows a remote unauthenticated attacker with HTTP access to read, create, delete, or modify all Agile PLM-accessible data. The high attack complexity (AC:H) means exploitation requires specific conditions the attacker cannot fully control, which lowers real-world exploitability despite the network-facing, no-authentication vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'Authentication Bypass' tag and full confidentiality/integrity impact make this a meaningful patch priority for exposed deployments.
Unauthorized data disclosure in Oracle Agile PLM 9.3.6 (Security component) lets a remote, unauthenticated attacker reach critical business data over HTTP without any user interaction. The Oracle CPU (July 2026) and EUVD tagging characterize this as an authentication-bypass-class weakness yielding full read access to all Agile PLM-accessible data. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Agile PLM 9.3.6 (Security component) allows a remote attacker with only HTTP network access to read, create, delete, or modify all data accessible to the application. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 9.1; no public exploit identified at time of analysis, and it is not listed in CISA KEV. It was reported by Oracle's own security team and addressed in the Oracle July 2026 Critical Patch Update.
Full product takeover of Oracle Agile PLM 9.3.6 (Product Lifecycle Management) is possible by an unauthenticated remote attacker over HTTP against the Security component, per Oracle Critical Patch Update July 2026. The CVSS 3.1 base score is 8.1 with high attack complexity, meaning exploitation is difficult and likely requires specific conditions or timing to succeed, but a successful attack yields complete compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied.
Account takeover in Oracle Agile PLM 9.3.6 (Security component) lets a low-privileged, remotely authenticated attacker fully compromise the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated easily exploitable with high confidentiality, integrity, and availability impact (CVSS 8.8) and results in complete takeover of the Agile PLM instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full compromise of Oracle Agile PLM 9.3.6 (Security component) allows an unauthenticated remote attacker to take over the application over HTTP with no user interaction. Rated CVSS 9.8 with high impact to confidentiality, integrity, and availability, this flaw is disclosed via Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch for internet- or intranet-exposed instances.
Full application takeover in Oracle Agile PLM 9.3.6 (Product Lifecycle Management) is possible via the User and User Group component, where a low-privileged authenticated user with HTTP network access can escalate to complete compromise of confidentiality, integrity, and availability. Rated CVSS 3.1 8.8 (High) and disclosed in Oracle's Critical Patch Update of July 2026, exploitation requires only valid low-level credentials and low attack complexity, making it attractive for insider or credential-theft abuse. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service and information disclosure in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a low-privileged, network-adjacent attacker send crafted HTTP requests to hang or repeatedly crash the service (complete DoS) and read a subset of accessible data. The flaw is rated CVSS 3.1 7.1 and was disclosed by Oracle in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle characterizes it as easily exploitable.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach the Content Acquisition System over HTTPS and read, create, modify, or delete all data accessible to the product. The 'Authentication Bypass' tagging combined with PR:N in the CVSS vector indicates the flaw defeats access controls without credentials, though the high attack complexity (AC:H) means exploitation is non-trivial. No public exploit identified at time of analysis and the issue is not in CISA KEV; it was disclosed by Oracle in the July 2026 Critical Patch Update.
Full product takeover in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Forge component) lets an unauthenticated remote attacker compromise confidentiality, integrity and availability over HTTP, per Oracle's CVSS 3.1 8.1 rating. Exploitation is rated high-complexity (AC:H), so it requires specific conditions or timing rather than a trivial single request. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller) allows a low-privileged local attacker with logon access to read, create, modify, or delete all data accessible to the product. The flaw carries a CVSS 3.1 base score of 7.1 (C:H/I:H, no availability impact) and is described by Oracle as 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it was disclosed in the Oracle Critical Patch Update of July 2026.
Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Controller, which an unauthenticated attacker can reach over HTTP to fully compromise the product. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its network-facing, no-authentication profile makes it a high-priority patch item.
Sensitive data disclosure and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) let a low-privileged, network-based attacker read all data accessible to the application and hang or repeatedly crash the service over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and availability impact but no integrity impact. Disclosed in the Oracle July 2026 Critical Patch Update; no public exploit identified at time of analysis and not listed in CISA KEV.
Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 lets a remote, unauthenticated attacker read all data accessible to the Experience Manager component over HTTP. Oracle rates it CVSS 7.5 with high confidentiality impact and no integrity or availability effect, and the reporter tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, no-privilege profile makes it a straightforward information-disclosure risk.
Unauthorized data disclosure in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker abuse the exposed RMI interface of the Experience Manager component to read critical or all Guided Search accessible data. Scored CVSS 3.1 7.5 with confidentiality-only impact and rated 'easily exploitable' by Oracle, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Disclosed in Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach sensitive data over HTTP, with Oracle and the EUVD entry tagging the flaw as an authentication bypass. The CVSS 3.1 base score of 7.5 reflects a high-confidentiality, no-integrity, no-availability impact, and Oracle labels it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a credible target once patch details are reverse-engineered.
Unauthenticated data compromise in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) allows remote attackers over HTTPS to read, create, modify, or delete all data accessible to the service without any credentials. Oracle rates this CVSS 9.1 with high confidentiality and integrity impact and characterizes it as 'easily exploitable,' and the intelligence tags flag an authentication-bypass class issue. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis.
Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a remote attacker send crafted HTTP requests to read all data accessible to the service and to crash or hang it completely. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and availability impact and no integrity impact; disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the combination of network reachability, no authentication, and low complexity makes it an urgent patch priority.
Complete takeover of Oracle Commerce Guided Search Platform Services 11.4.0 (formerly Endeca) is possible by an unauthenticated remote attacker sending crafted HTTP requests to the Forge component. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and lack of authentication make it a high-priority patch target.
Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a remote, unauthenticated attacker to read and modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact) and is easily exploitable per Oracle. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-privileges vector makes it a high-priority patch.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a low-privileged, network-based attacker over HTTP to gain complete read access to all accessible data plus limited update, insert, and delete capability. Rated CVSS 7.1 and tagged as an authentication bypass, it was disclosed by Oracle in the July 2026 Critical Patch Update and requires only low-level credentials with no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all data accessible to the application. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact) and tagged as an authentication-bypass-class issue by the reporter. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.
Takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible for an authenticated low-privileged attacker reaching the Experience Manager component over HTTP. Rated CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact, this flaw was disclosed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation to full takeover in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a low-privileged attacker with HTTP network access compromise the Experience Manager component, yielding high confidentiality, integrity, and availability impact. Rated CVSS 3.1 8.8 and reported through Oracle's coordinated disclosure (July 2026 CPU), with no public exploit identified at time of analysis and no CISA KEV listing. Any authenticated user of the affected component can potentially seize control of the entire product instance.
Full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is possible when a low-privileged attacker reaches the Content Acquisition System component over HTTP. Oracle rates this 9.9 with a scope change (S:C), meaning a successful compromise of the Guided Search product can significantly impact additional downstream products beyond the vulnerable component itself. There is no public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority patch item.
Remote takeover in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System component) allows an unauthenticated attacker with HTTP network access to fully compromise the product. Oracle rates it CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning no authentication or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, unauthenticated 'takeover' profile makes it a top-tier patching priority.
Unauthorized disclosure of critical data in Oracle Payroll (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all Payroll-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact additional Oracle products beyond Payroll itself, raising the effective blast radius. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact.
Full compromise of the Oracle Advanced Benefits module (Affordable Care Act component) within Oracle E-Business Suite 12.2.7 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests over the network. Successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact. This is a July 2026 Oracle Critical Patch Update issue with no public exploit identified at time of analysis and no CISA KEV listing.
Remote takeover in Oracle WebCenter Sites 14.1.2.0.0 allows an unauthenticated attacker with only HTTP network access to fully compromise the product, yielding complete confidentiality, integrity, and availability loss (CVSS 3.1 9.8). Disclosed in the Oracle Critical Patch Update of July 2026 and reported by Oracle's own security alert team, it is rated easily exploitable but has no public exploit identified at time of analysis. WebCenter Sites is Oracle's enterprise web experience/content management platform, so a compromise means attacker control over the delivery of managed web content.
Unauthorized data disclosure in Oracle Complex Maintenance, Repair and Overhaul (CMRO), a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a remote unauthenticated attacker abuse the Internal Operations component over HTTP to read critical CMRO data and make limited unauthorized modifications. Because the flaw carries a scope change, a successful attack can significantly impact products beyond CMRO itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity, so exploitation is rated difficult.
Full takeover of Oracle Commerce Platform 11.4.0 is possible by a remote unauthenticated attacker who reaches the Dynamo Application Framework component over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation compromises confidentiality, integrity, and availability of the platform (CVSS 3.1 8.1), though Oracle rates it difficult to exploit (AC:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data tampering and partial denial of service in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework) allows a remote attacker to reach the platform over HTTP and, without any credentials, perform unauthorized insert/update/delete on some accessible data, read a subset of accessible data, and partially disrupt availability. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Data compromise in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a remote, unauthenticated attacker read, create, modify, or delete all data accessible to the platform over HTTP. The flaw carries a CVSS 3.1 score of 7.4 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as difficult to exploit (AC:H). Disclosed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Commerce Platform 11.4.0 lets a remote, unauthenticated attacker reaching the Dynamo Application Framework's LDAP integration read critical application data, potentially all data accessible to the platform. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score in the provided data, so this is a serious-but-not-yet-weaponized disclosure flaw disclosed in the July 2026 Oracle Critical Patch Update.
Cross-context data compromise in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework/ATG) lets a low-privileged, authenticated network attacker who lures a victim into interacting with crafted HTTP content read all platform-accessible data and make limited unauthorized modifications, with impact crossing into additional products via a scope change. The CVSS:3.1 score is 7.6 (C:H/I:L, scope-changed), and the UI:R plus scope-change profile is characteristic of a stored/reflected web-injection class flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with HTTP network access to fully compromise the product, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 9.8 (Critical) rating. Oracle describes the flaw as easily exploitable, though it publishes no technical root-cause detail beyond the CPU advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated network reach and complete system takeover makes this a top-tier patch priority.
Remote unauthenticated compromise of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a network attacker reach sensitive data and knock the service offline over HTTP. With no authentication or user interaction required and a CVSS 3.1 base of 9.1, a successful attack yields access to all Commerce Platform-accessible data plus a complete, repeatable denial of service. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full system takeover of Oracle Commerce Platform 11.4.0 is possible when a remote, unauthenticated attacker reaches the ATG Portals component over HTTP. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and yields complete compromise of the platform. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Account/system takeover in Oracle Communications Service Catalog and Design (versions 8.0.0.7.0 through 8.3.0.2.0), Solution Designer component, lets a low-privileged attacker with network HTTP access fully compromise the product. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, Oracle describes it as 'easily exploitable,' meaning any authenticated user can escalate to complete control. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local privilege-escalation to full takeover in Oracle Communications Billing and Revenue Management (BRM) 15.0.0.0.0-15.0.1.0.0 and 15.1.0.0.0-15.2.0.0.0 allows a low-privileged attacker with logon access to the underlying infrastructure to fully compromise the BRM Platform component, with high confidentiality, integrity, and availability impact. The flaw is rated CVSS 3.1 7.8 and was disclosed by Oracle in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because BRM is a back-office telecom billing platform, exploitation requires an existing foothold on the host rather than remote unauthenticated access.
Unauthorized data disclosure in Oracle Configure to Order (Supply to Order Workbench component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read all data accessible to the application and, because of a scope change, to impact additional Oracle products beyond Configure to Order. Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it was reported through Oracle's own security alert channel for the July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, delete, or modify all HRMS (UK)-accessible data over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impacts and no availability impact, Oracle describes it as easily exploitable and tags it as an authentication-bypass class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a low-privileged, network-based attacker fully compromise the module over HTTP with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Oracle classifies it as easily exploitable and rates the outcome as complete takeover of Oracle HRMS (UK). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as a networked, low-complexity flaw requiring only minimal privileges it warrants prompt patching in the July 2026 Critical Patch Update.
Full compromise of Oracle HRMS (US) within Oracle E-Business Suite is possible via the Internal Operations component, letting a low-privileged user with local logon access escalate to complete takeover of the HRMS application, with confidentiality, integrity and availability all fully impacted. Rated CVSS 3.1 7.0 but explicitly high-complexity (AC:H), so exploitation is non-trivial and requires an existing account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering and partial denial of service in Oracle HRMS (UK) - the UK Payroll component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 - lets a low-privileged, authenticated attacker with HTTP network access create, modify or delete critical HRMS data and partially degrade the service. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable' (AC:L), meaning any account holder on the EBS instance can abuse it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.
Unauthorized data disclosure in Oracle Application Object Library (a core component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, resulting in unauthorized access to critical data or complete access to all data accessible to Oracle Application Object Library. Fixed in Oracle's July 2026 Critical Patch Update, the flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 7.5 driven entirely by confidentiality impact (C:H, I:N, A:N). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Order Management (part of Oracle E-Business Suite) is possible via the Product Diagnostic Tools component in supported releases 12.2.3 through 12.2.15, where an authenticated high-privileged user with HTTP network access can achieve a complete takeover of the module with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix is delivered in the Oracle Critical Patch Update of July 2026.
Full compromise of Oracle Application Object Library (the core security and application framework within Oracle E-Business Suite, DB Privileges component) is possible by a low-privileged, authenticated attacker sending crafted HTTP requests. Successful attacks yield complete takeover of the Application Object Library across supported EBS releases 12.2.3 through 12.2.15, impacting confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the flaw is rated difficult to exploit (AC:H), but the CVSS 3.1 base score of 7.5 and the takeover impact make it a notable item in the Oracle July 2026 Critical Patch Update.
Remote data compromise in Oracle Application Object Library (the shared framework layer of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows an unauthenticated network attacker to read, create, delete, or modify all data accessible to the component over HTTP. The high attack complexity (AC:H) makes reliable exploitation non-trivial, but success yields full confidentiality and integrity impact against a core ERP platform. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor tags associate it with an authentication bypass pattern.
Privilege escalation to full component takeover in Oracle E-Business Suite (Oracle Applications DBA, ADPatch component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the Oracle Applications DBA subsystem, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Disclosed in Oracle's July 2026 Critical Patch Update, this is easily exploitable per Oracle's own rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a strong patching priority.