Oracle
Monthly
Full compromise of the Oracle Applications DBA component (Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible for an authenticated, high-privileged attacker with HTTP network access, resulting in complete takeover with high confidentiality, integrity, and availability impact. Rated CVSS 3.1 7.2 (High) by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Full compromise of Oracle GoldenGate 23.4 through 23.26.2 is possible via the Config Service Executable, where an unauthenticated remote attacker sending crafted HTTP traffic can achieve complete takeover with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 8.1 but explicitly flags it as difficult to exploit (AC:H), and there is no public exploit identified at time of analysis and no CISA KEV listing. Despite Oracle's own tag of 'Information Disclosure,' the described outcome is a broader system takeover, not merely data leakage.
Data compromise in Oracle Banking Trade Finance 14.6.0 through 14.8.0 (Infrastructure component) allows a low-privileged, network-authenticated attacker to read, create, modify, or delete all data accessible to the application over HTTP. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), this is an easily exploitable flaw requiring no user interaction, disclosed in the Oracle July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Banking Trade Finance versions 14.6.0 through 14.8.0 (Infrastructure component) allows a low-privileged, network-based attacker to read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates this 8.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and no user interaction required. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the vendor's own 'Authentication Bypass' tag suggests weak access-control enforcement despite a nominal low-privilege requirement.
Cross-site-scripting-style compromise in Oracle MES for Process Manufacturing (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a remote unauthenticated attacker steal or fully read Oracle MES-accessible data and make limited unauthorized changes by luring a legitimate user into interacting with a crafted HTTP request. The scope-changing nature (S:C) means a successful attack can significantly impact products beyond MES itself, typically the victim's authenticated session context. No public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 8.2.
Complete takeover of Oracle WebCenter Enterprise Capture is possible by remote unauthenticated attackers reaching the Client Bundle component over HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the trivial exploitability and network-facing nature make it a high-priority patch.
Full compromise of Oracle WebCenter Enterprise Capture is possible when a low-privileged, network-authenticated attacker abuses a flaw in the Client Bundle component reachable over HTTP, resulting in complete takeover with high confidentiality, integrity, and availability impact. It affects Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 and was disclosed in Oracle's July 2026 Critical Patch Update. Oracle rates it easily exploitable (CVSS 8.8), with no public exploit identified at time of analysis and no CISA KEV listing.
Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privileged attacker with network access over HTTP targets the Client Bundle component. Per Oracle's July 2026 Critical Patch Update, successful attacks result in complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.8). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-context web attack against Oracle Banking Trade Finance Process Management (OBTFPM) 14.6.0 through 14.8.0 lets an unauthenticated network attacker who lures an authenticated user into interacting with crafted content act in the victim's session, reading, creating, deleting or modifying all OBTFPM-accessible data and causing a partial denial of service. Oracle rates it CVSS 3.1 9.6 with a scope change (S:C), meaning impact can spill into other connected products beyond OBTFPM itself. No public exploit is identified at time of analysis and it is not in CISA KEV; the Critical rating is driven by the scope change plus full confidentiality/integrity impact rather than by observed exploitation.
Unauthorized data access in Oracle Communications Unified Inventory Management (versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1) allows a low-privileged attacker with HTTP network access to compromise the Security component, gaining read access to all UIM-accessible data plus limited update, insert, or delete capability. Rated CVSS 3.1 7.1 (C:H/I:L) and flagged by Oracle as easily exploitable, though no public exploit has been identified and it is not listed in CISA KEV. The vendor 'Authentication Bypass' tag suggests the flaw undermines authorization controls despite requiring only low privileges to begin.
Takeover of MySQL Server and MySQL Cluster is possible through the Server: Replication component, where a high-privileged attacker with network access can fully compromise affected instances. This authenticated flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1, and is fixed in Oracle's July 2026 Critical Patch Update. Oracle rates it CVSS 7.2 with full confidentiality, integrity and availability impact; no public exploit identified at time of analysis.
Full takeover of Oracle WebCenter Enterprise Capture is possible via HTTP against the Client Bundle component in supported versions 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's July 2026 Critical Patch Update. An unauthenticated remote attacker who can reach the service over the network can compromise confidentiality, integrity, and availability, though the CVSS vector rates the attack as high-complexity (AC:H), meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so risk is currently theoretical but high-impact.
Local privilege escalation leading to full product takeover affects the BRM Server component of Oracle Communications Billing and Revenue Management versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. A low-privileged attacker who already has a logon on the host where BRM executes can leverage this easily-exploitable flaw to fully compromise the product, gaining high impact to confidentiality, integrity and availability. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild; Oracle addressed it in the July 2026 Critical Patch Update.
Local privilege-based takeover of Oracle Project Foundation (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with logon access to the host infrastructure to fully compromise the component. Successful exploitation yields high confidentiality, integrity, and availability impact - effectively a complete takeover of Project Foundation. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise SCM Inventory 9.2 (Security component) lets a remote attacker reach the application over HTTP and read all data the module can access, plus perform limited unauthorized updates, inserts or deletes. Oracle rates it CVSS 3.1 8.2 and the intelligence tags it as an authentication-bypass class issue, meaning no valid credentials or user interaction are needed. No public exploit identified at time of analysis and it is not on CISA KEV, but the low-complexity, network-facing, no-privilege profile makes it a high-priority patch for Oracle ERP operators.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 (Security component) allows a remote, unauthenticated attacker with HTTP network access to read critical manufacturing and supply-chain data. Oracle rates the flaw as easily exploitable with a CVSS 3.1 base score of 7.5 (confidentiality-only impact), and vendor tagging associates it with an authentication-bypass class of issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data disclosure in Oracle PeopleSoft Enterprise FIN Payables 9.2 (Security component) lets a remote attacker reach financial data over HTTP without credentials, yielding read access to critical or all data the Payables module can reach. The Oracle-supplied tag of 'Authentication Bypass' aligns with the CVSS PR:N vector, indicating the flaw circumvents access controls. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but its low complexity and network reach make it a credible target once details from the July 2026 CPU are studied.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) allows a remote, unauthenticated attacker with HTTPS network access to read critical or all data accessible to the application. Rated CVSS 3.1 7.5 (confidentiality-only), the flaw is described by Oracle as easily exploitable and is tagged as an authentication bypass. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise SCM Inventory 9.2 (Security component) allows a remote, unauthenticated attacker to reach sensitive data over HTTPS without any user interaction. Oracle rates the flaw easily exploitable and it is tagged as an authentication bypass, meaning an attacker can obtain read access to all data accessible to the SCM Inventory application. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a priority patch in the July 2026 Oracle Critical Patch Update.
Cross-context data compromise in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 (Common Application Objects component) allows a low-privileged, network-based attacker to gain unauthorized read and write access to critical data after tricking a legitimate user into interacting with malicious content. The scope-changing nature (S:C) combined with the Authentication Bypass tag and required user interaction is consistent with a stored cross-site scripting or session-riding style flaw whose impact spills over into additional PeopleSoft products. No public exploit identified at time of analysis and the flaw is not on CISA KEV.
Privilege-scoped data compromise in Oracle PeopleSoft Enterprise SCM Mobile Inventory Management 9.2 (Security component) allows a low-privileged, authenticated attacker with local logon to the hosting infrastructure to read, create, delete, or modify all data accessible to the application, with a scope change that can significantly impact additional connected PeopleSoft products. Oracle rates this CVSS 3.1 7.5, but exploitation is explicitly rated difficult (AC:H), and there is no public exploit identified at time of analysis nor CISA KEV listing. The Oracle-supplied 'Authentication Bypass' tag suggests the flaw may let an attacker escalate beyond their assigned authorization boundary, though Oracle's terse advisory does not detail the mechanism.
Full takeover of Oracle PeopleSoft Enterprise HCM Talent Acquisition Manager 9.2 is achievable by a low-privileged, network-based attacker abusing the Job Opening component over HTTP. Because the flaw carries a scope change (S:C), successful attacks reach beyond the Talent Acquisition module and can significantly impact additional connected PeopleSoft products. No public exploit identified at time of analysis, but the 9.9 CVSS and trivial exploitability make this a top-priority patch from Oracle's July 2026 Critical Patch Update.
Full compromise of the Oracle PeopleSoft Enterprise FIN Common Objects Brazil module (version 9.1, eProcurement component) is possible by a remote unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the affected component, though Oracle rates the attack as difficult to execute (high attack complexity). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated information disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Purchasing component) lets a remote attacker read critical data over HTTP without any credentials, as disclosed in Oracle's Critical Patch Update of July 2026. Oracle rates it CVSS 7.5 with confidentiality-only impact (C:H/I:N/A:N) and characterizes it as easily exploitable. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege-to-takeover in Oracle PeopleSoft Enterprise FIN Staffing Front Office Brazil 9.1 (Staffing component) lets a low-privileged attacker with HTTP access fully compromise the module, and because of a scope change (CVSS S:C) the attack can significantly impact additional PeopleSoft products beyond the vulnerable component. Oracle rates this 9.9 (Critical) with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; disclosed via the Oracle Critical Patch Update of July 2026.
Full compromise (takeover) of Oracle PeopleSoft Enterprise FIN Billing Argentina 9.1 is possible by a high-privileged attacker with network access over HTTP, per Oracle's July 2026 Critical Patch Update. Successful attacks yield complete confidentiality, integrity, and availability loss of the Billing component. No public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle rates the attack complexity as low (easily exploitable) once the required privileges are held.
Full takeover of Oracle Access Manager is possible via its Authentication Engine component, letting a low-privileged attacker on the same physical/adjacent network segment as the server completely compromise the identity platform. Affected releases are Oracle Fusion Middleware OAM 12.2.1.4.0 and 14.1.2.1.0, carrying a CVSS 3.1 base score of 8.0 with high confidentiality, integrity, and availability impact. Oracle rates it 'easily exploitable' but no public exploit identified at time of analysis, and it is not on CISA KEV.
Full compromise of Oracle Access Manager is possible when an unauthenticated attacker sends crafted HTTP requests to the Authentication Engine component of affected Oracle Fusion Middleware deployments (12.2.1.4.0 and 14.1.2.1.0). The flaw is rated CVSS 9.8 and, per Oracle, is 'easily exploitable,' resulting in complete takeover of the identity/access layer. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-authentication profile makes it a high-priority patch for any Oracle SSO estate.
Privilege escalation to full application takeover in Oracle PeopleSoft Enterprise SCM Supplier Contract Management 9.2 (Security component) lets a low-privileged attacker with logon access to the hosting infrastructure compromise the module, with a scope change that can significantly impact additional connected products. The flaw carries an Oracle-assigned CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not in CISA KEV, though it is remediated in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle PeopleSoft Enterprise FIN Cash Management 9.2 is possible by a low-privileged user who already has logon access to the infrastructure hosting the application. Because the flaw carries a scope change, a successful attack can pivot beyond the Cash Management module to significantly impact additional Oracle products, resulting in complete takeover of the affected component. Fixed in the Oracle July 2026 Critical Patch Update; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local privilege-based compromise in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 (Security Framework component of Oracle Fusion Middleware) allows a low-privileged attacker with an interactive logon to the host to fully take over the JDeveloper installation, impacting confidentiality, integrity, and availability. Fixed in the Oracle July 2026 Critical Patch Update, the flaw is rated CVSS 7.0 but is explicitly high-complexity (AC:H) and requires local access, so no public exploit identified at time of analysis and no active exploitation is confirmed. It is tagged as an Information Disclosure issue by Oracle, though the vector shows full C/I/A impact consistent with a complete component takeover.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) lets remote attackers read, create, modify, or delete all data accessible to the application over HTTP. Tagged as an authentication bypass, the flaw carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact but no availability impact, and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle PeopleSoft Enterprise SCM Order Management 9.2 is possible for any low-privileged user who can log on to the infrastructure where the application runs, via a flaw in its Security component. A successful attack yields complete compromise of confidentiality, integrity, and availability of the Order Management module. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update.
Local privilege escalation to full product takeover in Oracle Communications BRM - Elastic Charging Engine (versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0) lets a low-privileged attacker with logon access to the host running the ECE infrastructure compromise the Diameter Gateway and SDK component. Per Oracle's CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N), exploitation is authenticated and local but easily performed, yielding high confidentiality, integrity, and availability impact (base 7.8). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Full takeover of Oracle Production Scheduling (part of Oracle E-Business Suite, Internal Operations component) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host, provided a legitimate user is tricked into interacting. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation compromises the confidentiality, integrity, and availability of the Production Scheduling engine. There is no public exploit identified at time of analysis, and the high attack complexity combined with adjacent-network and user-interaction requirements substantially constrains real-world exploitability.
Privilege escalation to full application takeover in Oracle Demantra Demand Management (versions 12.2.3 through 12.2.15) lets a low-privileged, authenticated attacker with HTTP network access compromise the Product Security component and, because of a scope change, significantly impact additional connected products. Rated CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a top-tier patch priority.
Full product takeover in Oracle Advanced Supply Chain Planning (Core component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an already high-privileged attacker with HTTP network access to fully compromise the module's confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.2 and describes it as easily exploitable once the required elevated privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle has addressed it in the July 2026 Critical Patch Update.
Data compromise in Oracle Loans (Internal Operations component of Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged attacker with network HTTP access to read, create, delete, or modify all Loans-accessible data. The flaw yields high confidentiality and integrity impact without affecting availability, and carries a CVSS 3.1 base score of 8.1. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of the Oracle Financials for the Americas module within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) is possible via HTTP by an attacker who already holds high application privileges, leading to complete takeover of the module's confidentiality, integrity, and availability. Oracle rates it CVSS 7.2 and describes it as 'easily exploitable' once the privilege prerequisite is met. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the sole reference is the Oracle July 2026 Critical Patch Update advisory.
Data compromise in Oracle Financials Common Country (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1, the flaw affects EBS versions 12.2.3 through 12.2.15 and impacts confidentiality and integrity but not availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it appears in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle E-Business Suite's Oracle Process Manufacturing Product Development component (versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the module. Rated CVSS 8.1 with high confidentiality and integrity impact but no availability impact, it is addressed in Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, though the 'easily exploitable' characterization by Oracle and low attack complexity raise concern for internet-exposed EBS instances.
Full takeover of Oracle Cost Management (Inventory Costing component) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by an authenticated high-privileged attacker sending crafted HTTP requests over the network. Successful exploitation compromises confidentiality, integrity, and availability of the module, carrying a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, though it was reported and fixed by Oracle in the July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote, unauthenticated attacker to reach all data accessible to the iRecruitment application over HTTP. The CVSS 3.1 base score is 7.5 with confidentiality-only impact (C:H, I:N, A:N), and the intelligence tag characterizes it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network, no-auth, low-complexity vector makes it attractive for opportunistic scanning of internet-facing EBS deployments.
Full compromise of Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) is possible in versions 12.2.3 through 12.2.15, where a high-privileged attacker with network HTTP access can achieve complete takeover of the module with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and addressed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-priority issue driven by the total-takeover impact rather than by confirmed in-the-wild activity.
Unauthorized data access and manipulation in Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-adjacent attacker read, create, delete, or modify all iRecruitment-accessible data over HTTP. The high CVSS 3.1 score of 8.1 reflects complete confidentiality and integrity compromise of the module with only a low-privilege account required and no user interaction. No public exploit identified at time of analysis, and it is not on CISA KEV; the vendor-supplied fix ships in the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle Customers Online (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all data accessible to the application. Oracle rates this CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and the intelligence tag 'Authentication Bypass' suggests horizontal privilege escalation past intended access boundaries. No public exploit identified at time of analysis, and the flaw is fixed in the Oracle Critical Patch Update of July 2026.
Broad data compromise in Oracle Customers Online (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, allows a low-privileged attacker with network HTTP access to read, create, modify, and delete all data accessible to the application. The CVSS 3.1 base score is 8.1 (C:H/I:H) reflecting high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Inventory Management (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read all data accessible to the application, with a scope change that can significantly impact other Oracle EBS products. Rated CVSS 3.1 7.7 (confidentiality-only), the flaw is easily exploitable over HTTP and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; fixes ship in Oracle's July 2026 Critical Patch Update.
Data tampering and partial denial of service in Oracle Time and Labor (Oracle E-Business Suite 12.2.3-12.2.15, Internal Operations component) allows a low-privileged, network-authenticated attacker to create, delete, or modify all Time and Labor accessible data and partially disrupt the service over HTTP. The CVSS 3.1 base score is 7.1 (I:H/A:L, no confidentiality impact), reflecting an integrity-focused flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Account/instance takeover in Oracle Process Manufacturing Systems (Internal Operations component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access fully compromise the module, achieving high confidentiality, integrity, and availability impact. Oracle rates it CVSS 8.8 and calls it 'easily exploitable'; no public exploit is identified at time of analysis, and it is not listed in CISA KEV. The fix ships in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle Process Manufacturing Logistics (a module of Oracle E-Business Suite) is possible for a high-privileged attacker who reaches the application over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 score of 8.0 elevated by a scope change (S:C), meaning successful attacks may significantly impact additional Oracle products beyond the vulnerable module. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, though exploitation is rated difficult (AC:H) and requires existing high privileges (PR:H).
Full compromise of Oracle Process Manufacturing Logistics (Internal Operations component of Oracle E-Business Suite) is possible for a high-privileged, authenticated attacker sending crafted HTTP requests, per Oracle's July 2026 Critical Patch Update. Successful attacks yield complete takeover of the module with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Process Manufacturing (OPM) Logistics, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged authenticated attacker with network access over HTTP to read, create, delete, or modify all data accessible to the OPM Logistics component. The flaw is rated CVSS 3.1 8.1 (high) with confidentiality and integrity impact but no availability impact, and was disclosed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Landed Cost Management (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module across supported releases 12.2.3 through 12.2.15. The flaw carries CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and is remediated in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Process Manufacturing Systems (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 with High confidentiality and integrity impact but no availability impact, it is disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the low attack complexity and network vector make it a high patch priority for EBS operators.
Remote takeover of Oracle Data Integrator 14.1.2.0.0 (Oracle Fusion Middleware) is possible via the REST Service component, allowing an unauthenticated attacker with network access over HTTPS to fully compromise the product. Oracle rates this CVSS 9.8 with full confidentiality, integrity and availability impact and characterizes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Universal Work Queue (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker read and modify all data the application can access via crafted HTTP requests. The flaw carries a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though its inclusion in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.
Full compromise of Oracle Advanced Collections (Internal Operations component of Oracle E-Business Suite) is achievable by a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.8, successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single-privilege prerequisite make it a strong patching priority.
Full compromise of the Oracle Project Portfolio Analysis module (Internal Operations component) in Oracle E-Business Suite releases 12.2.3 through 12.2.15 is achievable by a low-privileged, network-based attacker over HTTP, resulting in complete takeover of the affected product with high confidentiality, integrity, and availability impact. The CVSS 3.1 base score is 7.5, and the vector's AC:H rating means exploitation is difficult and likely requires specific timing or preconditions. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Data tampering in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite, component Internal Operations), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with network HTTP access create, delete, or modify critical application data and read a subset of accessible data. Oracle rates it CVSS 3.1 7.1 with high integrity impact, and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite, Internal Operations component) allows a low-privileged remote attacker over HTTP to read, create, delete, or modify all data accessible to the application. Affected releases span EBS 12.2.3 through 12.2.15, and the CVSS 3.1 base score is 8.1 (C:H/I:H). This is a July 2026 Oracle Critical Patch Update issue with no public exploit identified at time of analysis and no CISA KEV listing, though the 'Authentication Bypass' tag and low attack complexity make it an attractive target once patch details are reversed.
Data tampering and partial denial of service in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker over HTTP create, delete, or modify all data accessible to the application via its Internal Operations component. Oracle rates it CVSS 3.1 7.1 with high integrity and low availability impact and no confidentiality impact. No public exploit identified at time of analysis and it is not in CISA KEV; it was disclosed and fixed in Oracle's July 2026 Critical Patch Update.
Data tampering in the Oracle Project Portfolio Analysis module of Oracle E-Business Suite (Internal Operations component, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker create, delete, or modify critical application data and read a subset of accessible data over HTTP. Oracle rates it 7.1 (CVSS 3.1) and describes it as easily exploitable, though impact is confined to data integrity and limited confidentiality with no availability effect. No public exploit identified at time of analysis; it was disclosed in the Oracle Critical Patch Update of July 2026.
Unauthorized read and write access to Oracle US Federal Human Resources (the Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-based attacker over HTTP, with no user interaction. Successful exploitation lets the attacker view, create, delete, or modify all data accessible to the module, carrying a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact). Fixed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and no CISA KEV listing.
Full takeover of Oracle Scripting, the scripted-interaction module of Oracle E-Business Suite (Internal Operations component), is possible by a remote unauthenticated attacker over HTTP in supported releases 12.2.3 through 12.2.15. Because the CVSS vector carries high confidentiality, integrity, and availability impact (8.1), a successful attack yields complete compromise of the module rather than mere data exposure, though the high attack complexity (AC:H) means exploitation is not trivial. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list.
Sensitive data compromise in Oracle E-Business Tax (component: Internal Operations), part of Oracle E-Business Suite releases 12.2.3 through 12.2.15, allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the E-Business Tax module. Oracle rates it CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and it is remediated in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Local privilege-driven takeover in Oracle E-Business Tax (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker who can log on to the host infrastructure fully compromise the E-Business Tax module. Oracle rates it CVSS 3.1 7.8 with complete confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit was identified at time of analysis, and it is not listed in CISA KEV.
Remote data compromise in Oracle E-Business Tax (Oracle E-Business Suite, Internal Operations component) allows a low-privileged authenticated attacker with HTTP network access to read, create, delete, or modify all E-Business Tax accessible data. Affecting supported versions 12.2.3 through 12.2.15, the flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it was reported by Oracle's own security team and addressed in the July 2026 Critical Patch Update.
Data compromise in the Oracle Public Sector Human Resources module of Oracle E-Business Suite (Regression Testing component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify any data accessible to the application. The flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an internet-facing Oracle EBS component it is a plausible target once the July 2026 CPU details are studied.
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the module. The flaw is tagged as an authentication bypass and carries CVSS 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Treasury (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all Treasury-accessible data over HTTP. Oracle rates it CVSS 3.1 8.1 (high confidentiality and integrity impact, no availability impact), and it is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle SDP Number Portability (a Service Delivery Platform component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker who already holds a logon on the host where the product runs; because the CVSS scope is changed, a successful attack can pivot to significantly impact other products beyond the vulnerable component. The flaw yields high confidentiality, integrity and availability impact and results in product takeover. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized read and write access to Oracle SDP Number Portability (Oracle E-Business Suite, Internal Operations component) is achievable by a low-privileged, network-based attacker over HTTP in versions 12.2.3 through 12.2.15. Oracle rates this 8.1 (High) with high confidentiality and integrity impact, allowing an authenticated user to create, delete, or modify all data accessible to the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network reach make it a notable patching priority in the July 2026 Critical Patch Update.
Data compromise in Oracle Telecommunications Billing Integrator (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read and modify all data accessible to the application. Rated CVSS 3.1 8.1 for high confidentiality and integrity impact with no availability effect, and disclosed in Oracle's July 2026 Critical Patch Update. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Transportation Execution (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged attacker with only network HTTP access to the application. Any authenticated user account can be leveraged to fully compromise confidentiality, integrity, and availability of the module, per the CVSS 3.1 8.8 vector. No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Time and Labor module. Scored CVSS 3.1 8.1 (C:H/I:H, no availability impact), it is easily exploitable per Oracle but requires an existing low-privilege account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; fixes ship in the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read and modify all data accessible to the application. The flaw is rated CVSS 8.1 and tagged as an authentication bypass, meaning a limited account can escalate to full read/write over critical Learning Management data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the application after luring a victim into interacting. Rated CVSS 3.1 7.3 (High) with full confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the required user interaction moderates raw exploitability.
Full compromise of Oracle Service Fulfillment Manager (a Fulfillment Engine component of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible where an authenticated, low-privileged attacker with network HTTP access can escalate to complete takeover of the module. Although rated CVSS 3.1 7.5 with confidentiality, integrity and availability impact, the attack complexity is high, meaning exploitation is non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle labels it easily exploitable. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and Oracle's 'easily exploitable' wording make it a strong patch priority for EBS operators.
Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite) allows a high-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application, with a scope change that may significantly impact additional Oracle products. Affected releases span 12.2.3 through 12.2.15, and Oracle rates it CVSS 8.7 (confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is addressed in the Oracle July 2026 Critical Patch Update.
Full account takeover of Oracle Labor Distribution (part of Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to affected servers running versions 12.2.3 through 12.2.15. The flaw compromises confidentiality, integrity, and availability of the module and, per Oracle, results in complete takeover of Labor Distribution. No public exploit identified at time of analysis, though the CVSS 8.8 rating and network-reachable, low-complexity nature make it a high-priority patch in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) is possible over HTTP by a low-privileged authenticated attacker, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, a successful attack results in complete takeover of the product with full confidentiality, integrity, and availability impact. The CVSS 3.1 score is 7.5 and Oracle rates the flaw difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise (takeover) of the Oracle Public Sector Financials module in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. The flaw carries a CVSS 3.1 base score of 7.5 and impacts confidentiality, integrity, and availability, but is rated hard to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Full compromise of the Oracle Public Sector Payroll module (Internal Operations component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible for a high-privileged attacker with network HTTP access, yielding complete takeover of the payroll application per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 7.2 with high confidentiality, integrity, and availability impact, but exploitation requires existing high-level privileges (PR:H). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Full compromise of the Oracle Public Sector Payroll module within Oracle E-Business Suite (Internal Operations component) is possible for an already-privileged attacker who can reach the application over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw affects supported EBS releases 12.2.4 through 12.2.15 and, though rated CVSS 7.2, requires high existing privileges (PR:H), which narrows the realistic attacker set to trusted or authenticated users. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in the Public Sector Payroll module (Internal Operations component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with network HTTP access fully compromise the payroll application. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and calls it 'easily exploitable,' meaning a single low-tier authenticated account is enough to seize the module. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and network reach make it a prompt-patch item from the July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle E-Business Suite's Oracle Capacity module (Internal Operations component), versions 12.2.3 through 12.2.15, allows a low-privileged attacker with HTTP network access to read all Oracle Capacity-accessible data and, due to a scope change, impact additional connected products. The flaw is easily exploitable and requires only a low-privilege account, no user interaction. It is addressed in Oracle's July 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Account/component takeover in the Oracle Customer Care module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the Customer Care component. The flaw carries a CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, and low attack complexity. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Full compromise of the Oracle Shipping Execution module of Oracle E-Business Suite (Internal Operations component) is possible for a high-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Affecting supported EBS releases 12.2.12 through 12.2.15, successful exploitation results in complete takeover of the Shipping Execution product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, so real-world urgency is tempered by the requirement for pre-existing high privileges.
Full compromise of the Oracle Applications DBA component (Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible for an authenticated, high-privileged attacker with HTTP network access, resulting in complete takeover with high confidentiality, integrity, and availability impact. Rated CVSS 3.1 7.2 (High) by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Full compromise of Oracle GoldenGate 23.4 through 23.26.2 is possible via the Config Service Executable, where an unauthenticated remote attacker sending crafted HTTP traffic can achieve complete takeover with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 8.1 but explicitly flags it as difficult to exploit (AC:H), and there is no public exploit identified at time of analysis and no CISA KEV listing. Despite Oracle's own tag of 'Information Disclosure,' the described outcome is a broader system takeover, not merely data leakage.
Data compromise in Oracle Banking Trade Finance 14.6.0 through 14.8.0 (Infrastructure component) allows a low-privileged, network-authenticated attacker to read, create, modify, or delete all data accessible to the application over HTTP. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), this is an easily exploitable flaw requiring no user interaction, disclosed in the Oracle July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Banking Trade Finance versions 14.6.0 through 14.8.0 (Infrastructure component) allows a low-privileged, network-based attacker to read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates this 8.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and no user interaction required. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the vendor's own 'Authentication Bypass' tag suggests weak access-control enforcement despite a nominal low-privilege requirement.
Cross-site-scripting-style compromise in Oracle MES for Process Manufacturing (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a remote unauthenticated attacker steal or fully read Oracle MES-accessible data and make limited unauthorized changes by luring a legitimate user into interacting with a crafted HTTP request. The scope-changing nature (S:C) means a successful attack can significantly impact products beyond MES itself, typically the victim's authenticated session context. No public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 8.2.
Complete takeover of Oracle WebCenter Enterprise Capture is possible by remote unauthenticated attackers reaching the Client Bundle component over HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the trivial exploitability and network-facing nature make it a high-priority patch.
Full compromise of Oracle WebCenter Enterprise Capture is possible when a low-privileged, network-authenticated attacker abuses a flaw in the Client Bundle component reachable over HTTP, resulting in complete takeover with high confidentiality, integrity, and availability impact. It affects Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 and was disclosed in Oracle's July 2026 Critical Patch Update. Oracle rates it easily exploitable (CVSS 8.8), with no public exploit identified at time of analysis and no CISA KEV listing.
Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privileged attacker with network access over HTTP targets the Client Bundle component. Per Oracle's July 2026 Critical Patch Update, successful attacks result in complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.8). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-context web attack against Oracle Banking Trade Finance Process Management (OBTFPM) 14.6.0 through 14.8.0 lets an unauthenticated network attacker who lures an authenticated user into interacting with crafted content act in the victim's session, reading, creating, deleting or modifying all OBTFPM-accessible data and causing a partial denial of service. Oracle rates it CVSS 3.1 9.6 with a scope change (S:C), meaning impact can spill into other connected products beyond OBTFPM itself. No public exploit is identified at time of analysis and it is not in CISA KEV; the Critical rating is driven by the scope change plus full confidentiality/integrity impact rather than by observed exploitation.
Unauthorized data access in Oracle Communications Unified Inventory Management (versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1) allows a low-privileged attacker with HTTP network access to compromise the Security component, gaining read access to all UIM-accessible data plus limited update, insert, or delete capability. Rated CVSS 3.1 7.1 (C:H/I:L) and flagged by Oracle as easily exploitable, though no public exploit has been identified and it is not listed in CISA KEV. The vendor 'Authentication Bypass' tag suggests the flaw undermines authorization controls despite requiring only low privileges to begin.
Takeover of MySQL Server and MySQL Cluster is possible through the Server: Replication component, where a high-privileged attacker with network access can fully compromise affected instances. This authenticated flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1, and is fixed in Oracle's July 2026 Critical Patch Update. Oracle rates it CVSS 7.2 with full confidentiality, integrity and availability impact; no public exploit identified at time of analysis.
Full takeover of Oracle WebCenter Enterprise Capture is possible via HTTP against the Client Bundle component in supported versions 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's July 2026 Critical Patch Update. An unauthenticated remote attacker who can reach the service over the network can compromise confidentiality, integrity, and availability, though the CVSS vector rates the attack as high-complexity (AC:H), meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so risk is currently theoretical but high-impact.
Local privilege escalation leading to full product takeover affects the BRM Server component of Oracle Communications Billing and Revenue Management versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. A low-privileged attacker who already has a logon on the host where BRM executes can leverage this easily-exploitable flaw to fully compromise the product, gaining high impact to confidentiality, integrity and availability. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild; Oracle addressed it in the July 2026 Critical Patch Update.
Local privilege-based takeover of Oracle Project Foundation (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with logon access to the host infrastructure to fully compromise the component. Successful exploitation yields high confidentiality, integrity, and availability impact - effectively a complete takeover of Project Foundation. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise SCM Inventory 9.2 (Security component) lets a remote attacker reach the application over HTTP and read all data the module can access, plus perform limited unauthorized updates, inserts or deletes. Oracle rates it CVSS 3.1 8.2 and the intelligence tags it as an authentication-bypass class issue, meaning no valid credentials or user interaction are needed. No public exploit identified at time of analysis and it is not on CISA KEV, but the low-complexity, network-facing, no-privilege profile makes it a high-priority patch for Oracle ERP operators.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 (Security component) allows a remote, unauthenticated attacker with HTTP network access to read critical manufacturing and supply-chain data. Oracle rates the flaw as easily exploitable with a CVSS 3.1 base score of 7.5 (confidentiality-only impact), and vendor tagging associates it with an authentication-bypass class of issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data disclosure in Oracle PeopleSoft Enterprise FIN Payables 9.2 (Security component) lets a remote attacker reach financial data over HTTP without credentials, yielding read access to critical or all data the Payables module can reach. The Oracle-supplied tag of 'Authentication Bypass' aligns with the CVSS PR:N vector, indicating the flaw circumvents access controls. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but its low complexity and network reach make it a credible target once details from the July 2026 CPU are studied.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) allows a remote, unauthenticated attacker with HTTPS network access to read critical or all data accessible to the application. Rated CVSS 3.1 7.5 (confidentiality-only), the flaw is described by Oracle as easily exploitable and is tagged as an authentication bypass. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise SCM Inventory 9.2 (Security component) allows a remote, unauthenticated attacker to reach sensitive data over HTTPS without any user interaction. Oracle rates the flaw easily exploitable and it is tagged as an authentication bypass, meaning an attacker can obtain read access to all data accessible to the SCM Inventory application. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a priority patch in the July 2026 Oracle Critical Patch Update.
Cross-context data compromise in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 (Common Application Objects component) allows a low-privileged, network-based attacker to gain unauthorized read and write access to critical data after tricking a legitimate user into interacting with malicious content. The scope-changing nature (S:C) combined with the Authentication Bypass tag and required user interaction is consistent with a stored cross-site scripting or session-riding style flaw whose impact spills over into additional PeopleSoft products. No public exploit identified at time of analysis and the flaw is not on CISA KEV.
Privilege-scoped data compromise in Oracle PeopleSoft Enterprise SCM Mobile Inventory Management 9.2 (Security component) allows a low-privileged, authenticated attacker with local logon to the hosting infrastructure to read, create, delete, or modify all data accessible to the application, with a scope change that can significantly impact additional connected PeopleSoft products. Oracle rates this CVSS 3.1 7.5, but exploitation is explicitly rated difficult (AC:H), and there is no public exploit identified at time of analysis nor CISA KEV listing. The Oracle-supplied 'Authentication Bypass' tag suggests the flaw may let an attacker escalate beyond their assigned authorization boundary, though Oracle's terse advisory does not detail the mechanism.
Full takeover of Oracle PeopleSoft Enterprise HCM Talent Acquisition Manager 9.2 is achievable by a low-privileged, network-based attacker abusing the Job Opening component over HTTP. Because the flaw carries a scope change (S:C), successful attacks reach beyond the Talent Acquisition module and can significantly impact additional connected PeopleSoft products. No public exploit identified at time of analysis, but the 9.9 CVSS and trivial exploitability make this a top-priority patch from Oracle's July 2026 Critical Patch Update.
Full compromise of the Oracle PeopleSoft Enterprise FIN Common Objects Brazil module (version 9.1, eProcurement component) is possible by a remote unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the affected component, though Oracle rates the attack as difficult to execute (high attack complexity). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated information disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Purchasing component) lets a remote attacker read critical data over HTTP without any credentials, as disclosed in Oracle's Critical Patch Update of July 2026. Oracle rates it CVSS 7.5 with confidentiality-only impact (C:H/I:N/A:N) and characterizes it as easily exploitable. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege-to-takeover in Oracle PeopleSoft Enterprise FIN Staffing Front Office Brazil 9.1 (Staffing component) lets a low-privileged attacker with HTTP access fully compromise the module, and because of a scope change (CVSS S:C) the attack can significantly impact additional PeopleSoft products beyond the vulnerable component. Oracle rates this 9.9 (Critical) with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; disclosed via the Oracle Critical Patch Update of July 2026.
Full compromise (takeover) of Oracle PeopleSoft Enterprise FIN Billing Argentina 9.1 is possible by a high-privileged attacker with network access over HTTP, per Oracle's July 2026 Critical Patch Update. Successful attacks yield complete confidentiality, integrity, and availability loss of the Billing component. No public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle rates the attack complexity as low (easily exploitable) once the required privileges are held.
Full takeover of Oracle Access Manager is possible via its Authentication Engine component, letting a low-privileged attacker on the same physical/adjacent network segment as the server completely compromise the identity platform. Affected releases are Oracle Fusion Middleware OAM 12.2.1.4.0 and 14.1.2.1.0, carrying a CVSS 3.1 base score of 8.0 with high confidentiality, integrity, and availability impact. Oracle rates it 'easily exploitable' but no public exploit identified at time of analysis, and it is not on CISA KEV.
Full compromise of Oracle Access Manager is possible when an unauthenticated attacker sends crafted HTTP requests to the Authentication Engine component of affected Oracle Fusion Middleware deployments (12.2.1.4.0 and 14.1.2.1.0). The flaw is rated CVSS 9.8 and, per Oracle, is 'easily exploitable,' resulting in complete takeover of the identity/access layer. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-authentication profile makes it a high-priority patch for any Oracle SSO estate.
Privilege escalation to full application takeover in Oracle PeopleSoft Enterprise SCM Supplier Contract Management 9.2 (Security component) lets a low-privileged attacker with logon access to the hosting infrastructure compromise the module, with a scope change that can significantly impact additional connected products. The flaw carries an Oracle-assigned CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not in CISA KEV, though it is remediated in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle PeopleSoft Enterprise FIN Cash Management 9.2 is possible by a low-privileged user who already has logon access to the infrastructure hosting the application. Because the flaw carries a scope change, a successful attack can pivot beyond the Cash Management module to significantly impact additional Oracle products, resulting in complete takeover of the affected component. Fixed in the Oracle July 2026 Critical Patch Update; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local privilege-based compromise in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 (Security Framework component of Oracle Fusion Middleware) allows a low-privileged attacker with an interactive logon to the host to fully take over the JDeveloper installation, impacting confidentiality, integrity, and availability. Fixed in the Oracle July 2026 Critical Patch Update, the flaw is rated CVSS 7.0 but is explicitly high-complexity (AC:H) and requires local access, so no public exploit identified at time of analysis and no active exploitation is confirmed. It is tagged as an Information Disclosure issue by Oracle, though the vector shows full C/I/A impact consistent with a complete component takeover.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) lets remote attackers read, create, modify, or delete all data accessible to the application over HTTP. Tagged as an authentication bypass, the flaw carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact but no availability impact, and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle PeopleSoft Enterprise SCM Order Management 9.2 is possible for any low-privileged user who can log on to the infrastructure where the application runs, via a flaw in its Security component. A successful attack yields complete compromise of confidentiality, integrity, and availability of the Order Management module. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update.
Local privilege escalation to full product takeover in Oracle Communications BRM - Elastic Charging Engine (versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0) lets a low-privileged attacker with logon access to the host running the ECE infrastructure compromise the Diameter Gateway and SDK component. Per Oracle's CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N), exploitation is authenticated and local but easily performed, yielding high confidentiality, integrity, and availability impact (base 7.8). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Full takeover of Oracle Production Scheduling (part of Oracle E-Business Suite, Internal Operations component) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host, provided a legitimate user is tricked into interacting. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation compromises the confidentiality, integrity, and availability of the Production Scheduling engine. There is no public exploit identified at time of analysis, and the high attack complexity combined with adjacent-network and user-interaction requirements substantially constrains real-world exploitability.
Privilege escalation to full application takeover in Oracle Demantra Demand Management (versions 12.2.3 through 12.2.15) lets a low-privileged, authenticated attacker with HTTP network access compromise the Product Security component and, because of a scope change, significantly impact additional connected products. Rated CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a top-tier patch priority.
Full product takeover in Oracle Advanced Supply Chain Planning (Core component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an already high-privileged attacker with HTTP network access to fully compromise the module's confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.2 and describes it as easily exploitable once the required elevated privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle has addressed it in the July 2026 Critical Patch Update.
Data compromise in Oracle Loans (Internal Operations component of Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged attacker with network HTTP access to read, create, delete, or modify all Loans-accessible data. The flaw yields high confidentiality and integrity impact without affecting availability, and carries a CVSS 3.1 base score of 8.1. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of the Oracle Financials for the Americas module within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) is possible via HTTP by an attacker who already holds high application privileges, leading to complete takeover of the module's confidentiality, integrity, and availability. Oracle rates it CVSS 7.2 and describes it as 'easily exploitable' once the privilege prerequisite is met. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the sole reference is the Oracle July 2026 Critical Patch Update advisory.
Data compromise in Oracle Financials Common Country (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1, the flaw affects EBS versions 12.2.3 through 12.2.15 and impacts confidentiality and integrity but not availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it appears in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle E-Business Suite's Oracle Process Manufacturing Product Development component (versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the module. Rated CVSS 8.1 with high confidentiality and integrity impact but no availability impact, it is addressed in Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, though the 'easily exploitable' characterization by Oracle and low attack complexity raise concern for internet-exposed EBS instances.
Full takeover of Oracle Cost Management (Inventory Costing component) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by an authenticated high-privileged attacker sending crafted HTTP requests over the network. Successful exploitation compromises confidentiality, integrity, and availability of the module, carrying a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, though it was reported and fixed by Oracle in the July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote, unauthenticated attacker to reach all data accessible to the iRecruitment application over HTTP. The CVSS 3.1 base score is 7.5 with confidentiality-only impact (C:H, I:N, A:N), and the intelligence tag characterizes it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network, no-auth, low-complexity vector makes it attractive for opportunistic scanning of internet-facing EBS deployments.
Full compromise of Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) is possible in versions 12.2.3 through 12.2.15, where a high-privileged attacker with network HTTP access can achieve complete takeover of the module with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and addressed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-priority issue driven by the total-takeover impact rather than by confirmed in-the-wild activity.
Unauthorized data access and manipulation in Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-adjacent attacker read, create, delete, or modify all iRecruitment-accessible data over HTTP. The high CVSS 3.1 score of 8.1 reflects complete confidentiality and integrity compromise of the module with only a low-privilege account required and no user interaction. No public exploit identified at time of analysis, and it is not on CISA KEV; the vendor-supplied fix ships in the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle Customers Online (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all data accessible to the application. Oracle rates this CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and the intelligence tag 'Authentication Bypass' suggests horizontal privilege escalation past intended access boundaries. No public exploit identified at time of analysis, and the flaw is fixed in the Oracle Critical Patch Update of July 2026.
Broad data compromise in Oracle Customers Online (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, allows a low-privileged attacker with network HTTP access to read, create, modify, and delete all data accessible to the application. The CVSS 3.1 base score is 8.1 (C:H/I:H) reflecting high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Inventory Management (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read all data accessible to the application, with a scope change that can significantly impact other Oracle EBS products. Rated CVSS 3.1 7.7 (confidentiality-only), the flaw is easily exploitable over HTTP and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; fixes ship in Oracle's July 2026 Critical Patch Update.
Data tampering and partial denial of service in Oracle Time and Labor (Oracle E-Business Suite 12.2.3-12.2.15, Internal Operations component) allows a low-privileged, network-authenticated attacker to create, delete, or modify all Time and Labor accessible data and partially disrupt the service over HTTP. The CVSS 3.1 base score is 7.1 (I:H/A:L, no confidentiality impact), reflecting an integrity-focused flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Account/instance takeover in Oracle Process Manufacturing Systems (Internal Operations component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access fully compromise the module, achieving high confidentiality, integrity, and availability impact. Oracle rates it CVSS 8.8 and calls it 'easily exploitable'; no public exploit is identified at time of analysis, and it is not listed in CISA KEV. The fix ships in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle Process Manufacturing Logistics (a module of Oracle E-Business Suite) is possible for a high-privileged attacker who reaches the application over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 score of 8.0 elevated by a scope change (S:C), meaning successful attacks may significantly impact additional Oracle products beyond the vulnerable module. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, though exploitation is rated difficult (AC:H) and requires existing high privileges (PR:H).
Full compromise of Oracle Process Manufacturing Logistics (Internal Operations component of Oracle E-Business Suite) is possible for a high-privileged, authenticated attacker sending crafted HTTP requests, per Oracle's July 2026 Critical Patch Update. Successful attacks yield complete takeover of the module with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Process Manufacturing (OPM) Logistics, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged authenticated attacker with network access over HTTP to read, create, delete, or modify all data accessible to the OPM Logistics component. The flaw is rated CVSS 3.1 8.1 (high) with confidentiality and integrity impact but no availability impact, and was disclosed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Landed Cost Management (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module across supported releases 12.2.3 through 12.2.15. The flaw carries CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and is remediated in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Process Manufacturing Systems (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 with High confidentiality and integrity impact but no availability impact, it is disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the low attack complexity and network vector make it a high patch priority for EBS operators.
Remote takeover of Oracle Data Integrator 14.1.2.0.0 (Oracle Fusion Middleware) is possible via the REST Service component, allowing an unauthenticated attacker with network access over HTTPS to fully compromise the product. Oracle rates this CVSS 9.8 with full confidentiality, integrity and availability impact and characterizes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Universal Work Queue (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker read and modify all data the application can access via crafted HTTP requests. The flaw carries a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though its inclusion in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.
Full compromise of Oracle Advanced Collections (Internal Operations component of Oracle E-Business Suite) is achievable by a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.8, successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single-privilege prerequisite make it a strong patching priority.
Full compromise of the Oracle Project Portfolio Analysis module (Internal Operations component) in Oracle E-Business Suite releases 12.2.3 through 12.2.15 is achievable by a low-privileged, network-based attacker over HTTP, resulting in complete takeover of the affected product with high confidentiality, integrity, and availability impact. The CVSS 3.1 base score is 7.5, and the vector's AC:H rating means exploitation is difficult and likely requires specific timing or preconditions. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Data tampering in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite, component Internal Operations), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with network HTTP access create, delete, or modify critical application data and read a subset of accessible data. Oracle rates it CVSS 3.1 7.1 with high integrity impact, and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite, Internal Operations component) allows a low-privileged remote attacker over HTTP to read, create, delete, or modify all data accessible to the application. Affected releases span EBS 12.2.3 through 12.2.15, and the CVSS 3.1 base score is 8.1 (C:H/I:H). This is a July 2026 Oracle Critical Patch Update issue with no public exploit identified at time of analysis and no CISA KEV listing, though the 'Authentication Bypass' tag and low attack complexity make it an attractive target once patch details are reversed.
Data tampering and partial denial of service in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker over HTTP create, delete, or modify all data accessible to the application via its Internal Operations component. Oracle rates it CVSS 3.1 7.1 with high integrity and low availability impact and no confidentiality impact. No public exploit identified at time of analysis and it is not in CISA KEV; it was disclosed and fixed in Oracle's July 2026 Critical Patch Update.
Data tampering in the Oracle Project Portfolio Analysis module of Oracle E-Business Suite (Internal Operations component, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker create, delete, or modify critical application data and read a subset of accessible data over HTTP. Oracle rates it 7.1 (CVSS 3.1) and describes it as easily exploitable, though impact is confined to data integrity and limited confidentiality with no availability effect. No public exploit identified at time of analysis; it was disclosed in the Oracle Critical Patch Update of July 2026.
Unauthorized read and write access to Oracle US Federal Human Resources (the Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-based attacker over HTTP, with no user interaction. Successful exploitation lets the attacker view, create, delete, or modify all data accessible to the module, carrying a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact). Fixed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and no CISA KEV listing.
Full takeover of Oracle Scripting, the scripted-interaction module of Oracle E-Business Suite (Internal Operations component), is possible by a remote unauthenticated attacker over HTTP in supported releases 12.2.3 through 12.2.15. Because the CVSS vector carries high confidentiality, integrity, and availability impact (8.1), a successful attack yields complete compromise of the module rather than mere data exposure, though the high attack complexity (AC:H) means exploitation is not trivial. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list.
Sensitive data compromise in Oracle E-Business Tax (component: Internal Operations), part of Oracle E-Business Suite releases 12.2.3 through 12.2.15, allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the E-Business Tax module. Oracle rates it CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and it is remediated in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Local privilege-driven takeover in Oracle E-Business Tax (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker who can log on to the host infrastructure fully compromise the E-Business Tax module. Oracle rates it CVSS 3.1 7.8 with complete confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit was identified at time of analysis, and it is not listed in CISA KEV.
Remote data compromise in Oracle E-Business Tax (Oracle E-Business Suite, Internal Operations component) allows a low-privileged authenticated attacker with HTTP network access to read, create, delete, or modify all E-Business Tax accessible data. Affecting supported versions 12.2.3 through 12.2.15, the flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it was reported by Oracle's own security team and addressed in the July 2026 Critical Patch Update.
Data compromise in the Oracle Public Sector Human Resources module of Oracle E-Business Suite (Regression Testing component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify any data accessible to the application. The flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an internet-facing Oracle EBS component it is a plausible target once the July 2026 CPU details are studied.
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the module. The flaw is tagged as an authentication bypass and carries CVSS 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Treasury (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all Treasury-accessible data over HTTP. Oracle rates it CVSS 3.1 8.1 (high confidentiality and integrity impact, no availability impact), and it is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle SDP Number Portability (a Service Delivery Platform component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker who already holds a logon on the host where the product runs; because the CVSS scope is changed, a successful attack can pivot to significantly impact other products beyond the vulnerable component. The flaw yields high confidentiality, integrity and availability impact and results in product takeover. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized read and write access to Oracle SDP Number Portability (Oracle E-Business Suite, Internal Operations component) is achievable by a low-privileged, network-based attacker over HTTP in versions 12.2.3 through 12.2.15. Oracle rates this 8.1 (High) with high confidentiality and integrity impact, allowing an authenticated user to create, delete, or modify all data accessible to the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network reach make it a notable patching priority in the July 2026 Critical Patch Update.
Data compromise in Oracle Telecommunications Billing Integrator (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read and modify all data accessible to the application. Rated CVSS 3.1 8.1 for high confidentiality and integrity impact with no availability effect, and disclosed in Oracle's July 2026 Critical Patch Update. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Transportation Execution (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged attacker with only network HTTP access to the application. Any authenticated user account can be leveraged to fully compromise confidentiality, integrity, and availability of the module, per the CVSS 3.1 8.8 vector. No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Time and Labor module. Scored CVSS 3.1 8.1 (C:H/I:H, no availability impact), it is easily exploitable per Oracle but requires an existing low-privilege account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; fixes ship in the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read and modify all data accessible to the application. The flaw is rated CVSS 8.1 and tagged as an authentication bypass, meaning a limited account can escalate to full read/write over critical Learning Management data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the application after luring a victim into interacting. Rated CVSS 3.1 7.3 (High) with full confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the required user interaction moderates raw exploitability.
Full compromise of Oracle Service Fulfillment Manager (a Fulfillment Engine component of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible where an authenticated, low-privileged attacker with network HTTP access can escalate to complete takeover of the module. Although rated CVSS 3.1 7.5 with confidentiality, integrity and availability impact, the attack complexity is high, meaning exploitation is non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle labels it easily exploitable. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and Oracle's 'easily exploitable' wording make it a strong patch priority for EBS operators.
Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite) allows a high-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application, with a scope change that may significantly impact additional Oracle products. Affected releases span 12.2.3 through 12.2.15, and Oracle rates it CVSS 8.7 (confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is addressed in the Oracle July 2026 Critical Patch Update.
Full account takeover of Oracle Labor Distribution (part of Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to affected servers running versions 12.2.3 through 12.2.15. The flaw compromises confidentiality, integrity, and availability of the module and, per Oracle, results in complete takeover of Labor Distribution. No public exploit identified at time of analysis, though the CVSS 8.8 rating and network-reachable, low-complexity nature make it a high-priority patch in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) is possible over HTTP by a low-privileged authenticated attacker, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, a successful attack results in complete takeover of the product with full confidentiality, integrity, and availability impact. The CVSS 3.1 score is 7.5 and Oracle rates the flaw difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise (takeover) of the Oracle Public Sector Financials module in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. The flaw carries a CVSS 3.1 base score of 7.5 and impacts confidentiality, integrity, and availability, but is rated hard to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Full compromise of the Oracle Public Sector Payroll module (Internal Operations component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible for a high-privileged attacker with network HTTP access, yielding complete takeover of the payroll application per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 7.2 with high confidentiality, integrity, and availability impact, but exploitation requires existing high-level privileges (PR:H). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Full compromise of the Oracle Public Sector Payroll module within Oracle E-Business Suite (Internal Operations component) is possible for an already-privileged attacker who can reach the application over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw affects supported EBS releases 12.2.4 through 12.2.15 and, though rated CVSS 7.2, requires high existing privileges (PR:H), which narrows the realistic attacker set to trusted or authenticated users. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in the Public Sector Payroll module (Internal Operations component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with network HTTP access fully compromise the payroll application. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and calls it 'easily exploitable,' meaning a single low-tier authenticated account is enough to seize the module. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and network reach make it a prompt-patch item from the July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle E-Business Suite's Oracle Capacity module (Internal Operations component), versions 12.2.3 through 12.2.15, allows a low-privileged attacker with HTTP network access to read all Oracle Capacity-accessible data and, due to a scope change, impact additional connected products. The flaw is easily exploitable and requires only a low-privilege account, no user interaction. It is addressed in Oracle's July 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Account/component takeover in the Oracle Customer Care module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the Customer Care component. The flaw carries a CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, and low attack complexity. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Full compromise of the Oracle Shipping Execution module of Oracle E-Business Suite (Internal Operations component) is possible for a high-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Affecting supported EBS releases 12.2.12 through 12.2.15, successful exploitation results in complete takeover of the Shipping Execution product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, so real-world urgency is tempered by the requirement for pre-existing high privileges.