Oracle
Monthly
Privilege escalation and full takeover of the Oracle Identity Manager Connector (Core component of Oracle Fusion Middleware) is possible for a low-privileged attacker with network access over TLS, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Because the flaw carries a scope change, a successful attack can pivot beyond the connector to significantly impact additional products, driving the CVSS 3.1 base score to 9.9. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently theoretical but the low attack complexity makes it a high patching priority.
Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 expose critical identity and access management data to local, low-privileged attackers who can engineer mandatory third-party user interaction, with successful exploitation crossing scope boundaries into additional Oracle Fusion Middleware components. The CVSS 3.1 base score of 7.2 reflects high confidentiality and integrity impacts under a scope-change scenario, though the local attack vector and high complexity substantially constrain real-world reach. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is possible by an unauthenticated attacker positioned on the same physical network segment as the connector host, resulting in complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's August 2026 Critical Patch Update, the vulnerability carries a CVSS 3.1 score of 7.5 but is significantly constrained by its adjacent-only attack vector and high attack complexity. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Full takeover of Oracle Identity Manager Connector is achievable by an unauthenticated remote attacker communicating over TLS, affecting the Core component of versions 12.2.1.4.0 and 14.1.2.1.0 under Oracle Fusion Middleware. The CVSS vector confirms network reachability with no privileges or user interaction required, though high attack complexity (AC:H) indicates that exploitation demands specific conditions beyond a simple point-and-shoot approach. No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete confidentiality, integrity, and availability impact makes successful exploitation a full system compromise.
Local privilege escalation in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows a low-privileged attacker with local logon access to the hosting infrastructure to achieve full takeover of the connector, impacting confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects straightforward exploitation once local access is obtained - no elevated privileges, no user interaction, and no complex attack conditions are required. No public exploit code or active exploitation has been identified at time of analysis; this is disclosed as part of Oracle's August 2026 Critical Patch Update. Note: The intelligence tag 'Information Disclosure' conflicts with the CVSS C:H/I:H/A:H impact profile and the 'takeover' language in the description - the actual scope of impact is broader than disclosure alone and should not be understated.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Oracle Fusion Middleware, Core component) lets a low-privileged, network-adjacent attacker fully compromise the Connector over TLS, with a scope change that can significantly impact other integrated products. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, carrying a CVSS 3.1 base score of 9.9 (C:H/I:H/A:H). No public exploit is identified at time of analysis, and the issue is addressed in Oracle's August 2026 Critical Patch Update.
Unauthorized data exposure in Oracle WebCenter Content's Content Server allows authenticated low-privileged users to access critical or complete enterprise content data over HTTP, with a CVSS 3.1 scope change (S:C) signaling collateral impact on additional Oracle Fusion Middleware components in the same environment. Affecting supported versions 14.1.2.0.0 and 12.2.1.4.0, the vulnerability is tagged as an authentication bypass and carries a CVSS 3.1 score of 7.7, reflecting low attack complexity and no user interaction once a valid account is held. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the straightforward exploitation conditions make patching urgent for environments with broadly distributed low-privileged accounts.
Oracle WebCenter Content's Content Server component, in versions 14.1.2.0.0 and 12.2.1.4.0, exposes an authentication bypass that allows a low-privileged remote attacker to achieve full confidentiality and integrity compromise of all accessible content data - and, due to a confirmed scope change, may significantly impact additional Oracle Fusion Middleware products integrated with the platform. Exploitation is network-accessible over HTTP with low complexity but requires a valid low-privileged account and human interaction from a separate victim, classifying this as a socially-engineered or CSRF-class attack surface. No public exploit code and no CISA KEV listing have been identified at time of analysis; the vulnerability was disclosed as part of Oracle's August 2026 Critical Security Patch Update.
Unauthorized data access and tampering in Oracle WebCenter Content's Content Server component allows unauthenticated remote attackers to fully read or manipulate all managed content via HTTP. Both supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and successful exploitation can cascade beyond the Content Server itself to impact additional Oracle Fusion Middleware products within the same deployment environment. No public exploit has been identified at time of analysis, but the unauthenticated network vector combined with a scope change rating makes this a high-priority item for any organization running this ECM platform.
Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware, WLS Core Components) allows a network attacker to fully take over the server via the RMI protocol. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, with a CVSS 3.1 base score of 9.8 reflecting full confidentiality, integrity, and availability loss. No public exploit was identified at time of analysis, but the 'easily exploitable' rating and unauthenticated RMI attack surface make this a top-priority patch.
Oracle Scripting versions 12.2.3 through 12.2.15, as part of Oracle E-Business Suite, exposes an easily exploitable flaw in its Internal Operations component that enables a low-privileged network attacker to achieve full system takeover over HTTP. The vulnerability scores CVSS 3.1 8.8, reflecting High impacts across all three pillars - Confidentiality, Integrity, and Availability - with low attack complexity and no user interaction required. No public exploit has been identified at time of analysis, but the minimal authentication barrier and network accessibility make this a high-urgency remediation target for organizations running Oracle EBS.
PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 contain an authentication bypass in the Security component, exploitable by a low-privileged attacker with local infrastructure access to achieve full confidentiality and integrity compromise of PeopleTools data, with scope change enabling lateral impact across additional integrated Oracle products. The local attack vector (AV:L) and high complexity (AC:H) constrain exploitation to insider threats or post-compromise scenarios, but the S:C scope change and H/H confidentiality-integrity impact make successful exploitation highly consequential in large Oracle ERP environments. No public exploit code or active exploitation has been identified at time of analysis.
Complete takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthenticated remote attacker over the T3 and IIOP protocols in the Client Bundle component. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects easy, network-based exploitation yielding full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
Full-system takeover of Oracle WebCenter Enterprise Capture (Oracle Fusion Middleware, Client Bundle component) is achievable by a remote, unauthenticated attacker reaching the server over the T3 or IIOP protocols. Oracle rates this CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable,' meaning a single crafted protocol interaction can yield complete compromise of the Capture instance. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of reliable Java-deserialization exploitation in the WebLogic/Fusion Middleware stack.
Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 expose a network-accessible LDAP authorization bypass that enables a low-privileged authenticated attacker to gain unauthorized access to critical or complete directory data. Intelligence sources tag this as an authentication bypass in the OUD Core component, with confirmed scope change impact on additional Oracle Fusion Middleware products consuming OUD identity data. No active exploitation confirmed at time of analysis and no public exploit code has been identified; however, the low attack complexity and network accessibility make this a credible priority for Oracle Fusion Middleware environments.
Full takeover of Oracle PeopleSoft Enterprise PeopleTools is achievable by an unauthenticated remote attacker targeting the nVision component via HTTP on versions 8.61 through 8.63. The attack requires that a victim user interact with attacker-controlled content - consistent with a client-side exploitation pattern such as XSS or CSRF - after which the attacker achieves complete compromise with high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and absence of any authentication requirement lower the bar for targeted exploitation against internet-accessible PeopleSoft deployments.
Authentication bypass in Oracle WebCenter Content's Content Server component allows unauthenticated attackers with adjacent network access to fully compromise data confidentiality and integrity across versions 12.2.1.4.0 and 14.1.2.0.0. The scope change designation confirms that successful exploitation can cascade beyond WebCenter Content itself to additional Oracle Fusion Middleware products. Disclosed via Oracle's August 2026 Critical Security Patch Update, with no public exploit identified at time of analysis.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the product. Oracle rates this CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning no credentials or user interaction are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-takeover profile makes it a top-priority patch in Oracle's August 2026 Critical Patch Update.
Full takeover of JD Edwards EnterpriseOne US Payroll version 9.2 is achievable by a low-privileged, network-adjacent attacker via the JDENET protocol, with successful exploitation yielding complete confidentiality, integrity, and availability compromise of the payroll system. Oracle rates this High severity (CVSS 7.5) under the August 2026 Critical Patch Update; the high attack complexity (AC:H) is the primary barrier to mass exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle WebCenter Content's Content Server component, within the Oracle Fusion Middleware stack, exposes a network-reachable integrity compromise affecting versions 12.2.1.4.0 and 14.1.2.0.0. High-privileged authenticated attackers can access the service via HTTP to arbitrarily create, delete, or modify critical repository data, read a subset of accessible content, and cause partial denial of service - with a confirmed scope change indicating potential cascading impact on additional Oracle Fusion Middleware products. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content's Content Server component, in versions 12.2.1.4.0 and 14.1.2.0.0, contains an authentication bypass vulnerability reachable over HTTP without credentials, carrying a CVSS 3.1 base score of 8.7. Successful exploitation enables an unauthenticated remote attacker to gain both full read access and full create/delete/modify access to critical content data, with a confirmed scope change meaning downstream Oracle Fusion Middleware components may also be impacted. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the Authentication Bypass tag and high attack complexity signal a non-trivial but realistic threat to unpatched deployments.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose a high-complexity, network-accessible flaw in the Content Server component that allows low-privileged authenticated attackers to gain unauthorized read access to critical content data and perform limited data manipulation. The vulnerability carries a scope-change designation, meaning successful exploitation can extend impact beyond WebCenter Content itself to adjacent Oracle Fusion Middleware products. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, though the 'Authentication Bypass' tag from ENISA EUVD introduces residual uncertainty about the true privilege prerequisite.
Complete takeover of Oracle WebCenter Enterprise Capture is possible via the Client Bundle component, where an unauthenticated network attacker leveraging the RMI protocol can fully compromise the affected server. Oracle's August 2026 Critical Patch Update rates this at CVSS 9.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis, though the trivial exploitability (AC:L, PR:N) and RMI attack surface make it a high-priority patch item.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by an unauthenticated attacker reaching the product over Java RMI, per Oracle's August 2026 Critical Patch Update. The flaw is rated CVSS 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable,' affecting versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach, no authentication, and complete compromise makes it a top-priority patch.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose a network-accessible, unauthenticated vulnerability in the Content Server component that can be triggered via HTTP with user interaction, resulting in a scope change affecting additional products. Successful exploitation grants attackers complete read access to all data accessible within Oracle WebCenter Content and limited write capabilities (insert/update/delete) against some accessible data. No public exploit or CISA KEV listing has been identified at time of analysis, though the Oracle-assigned tag of 'Authentication Bypass' and the high CVSS score of 8.2 warrant prompt patching within Oracle Critical Patch Update cycles.
Remote authentication bypass in Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to fully compromise confidentiality and integrity of managed content - including unauthorized creation, deletion, and modification of critical data - across both affected release lines 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope-change flag (S:C) indicates successful exploitation can cascade to affect additional Oracle Fusion Middleware products beyond WebCenter Content itself. Attack complexity is rated High (AC:H), meaning specific and difficult-to-reproduce conditions must be met, but no authentication or user interaction is required. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content's Content Server component harbors an authentication bypass exploitable by unauthenticated remote attackers over HTTP, affecting both actively supported versions (12.2.1.4.0 and 14.1.2.0.0) of this Oracle Fusion Middleware product. Successful exploitation grants complete unauthorized read and write access to all content managed by the system, with a confirmed scope change that can extend impact to additional Oracle Fusion Middleware products in the same deployment. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated network vector paired with high confidentiality and integrity impacts makes this a meaningful risk for organizations running exposed affected deployments.
Unauthorized read and write access to critical enterprise content data is achievable in Oracle WebCenter Content's Content Server component via an authentication bypass exploitable over HTTP. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, an unauthenticated remote attacker who overcomes the high attack complexity barrier can exfiltrate all accessible content or create, modify, and delete critical records. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local privilege exploitation in Oracle WebCenter Content 14.1.2.0.0 enables a low-privileged, authenticated user with system logon access to fully compromise the Content Server component. The attacker can read, create, delete, or modify all data accessible within Oracle WebCenter Content, and the confirmed scope change means attacks can cascade into additional co-hosted Oracle Fusion Middleware products. No public exploit has been identified at time of analysis, but the low attack complexity and wide data impact make this a high-priority patch target for any environment running this middleware version.
Remote takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated network attacker to fully compromise the product via the WebLogic T3 and IIOP protocols exposed by the Client Bundle component. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), reflecting easy, no-privilege exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the T3/IIOP attack class is historically a high-value target in Oracle Fusion Middleware.
Remote unauthenticated compromise of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) allows an attacker with only network/HTTP reach to create, delete, or modify critical data, read a subset of accessible data, and cause partial denial of service. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and Oracle explicitly flags a scope change meaning successful attacks may significantly impact other products beyond Capture itself. Rated CVSS 3.1 9.9; disclosed in the Oracle Critical Patch Update of August 2026 with no public exploit identified at time of analysis.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network-accessible attackers to fully compromise both the confidentiality and integrity of all data accessible to the service. The vulnerability carries a CVSS 3.1 score of 7.4, tempered by high attack complexity (AC:H), meaning specific, non-trivial conditions must be satisfied for exploitation. Disclosed via Oracle's Critical Patch Update for August 2026, no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote disclosure of all Oracle Unified Directory data is possible via the LDAP protocol in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Unified Directory (Oracle Fusion Middleware). The 'Authentication Bypass' tag and a CVSS vector of AV:N/AC:L/PR:N/UI:N confirm that a network-accessible attacker with no credentials can exploit the OUD Core component to read critical or complete directory data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a straightforward target for opportunistic scanning.
Oracle WebCenter Content's Content Server component in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is exploitable by a low-privileged authenticated attacker over HTTP who can lure a higher-privileged victim into interacting with malicious content, resulting in unauthorized access to critical data and partial data manipulation with confirmed scope impact beyond WebCenter Content itself. Tagged as an authentication bypass by Oracle, this vulnerability carries a CVSS 3.1 base score of 7.6 and is classified as easily exploitable in Oracle's August 2026 Critical Patch Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote access to all confidential data managed by Oracle WebCenter Content's Content Server component is achievable across two currently supported Fusion Middleware release lines. Tagged as an authentication bypass, this vulnerability allows a network-accessible attacker to read sensitive documents and managed content by sending HTTP requests without supplying any credentials, requiring no user interaction and no elevated privileges. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-authentication, low-complexity attack profile makes this a high-priority remediation item for any deployment reachable from untrusted network segments.
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to fully read, create, modify or delete all Content Server-accessible data and cause a partial denial of service. Oracle rates it CVSS 9.6, driven by a scope change (S:C) meaning successful attacks can significantly impact products beyond WebCenter Content itself. Exploitation requires tricking a legitimate user into an action (UI:R); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated network exploitation of Oracle WebCenter Content's Content Server component allows a remote attacker to achieve full confidentiality and integrity compromise of all accessible content data, with a scope change that can significantly impact additional Oracle Fusion Middleware products in the same environment. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's Critical Patch Update of August 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Authentication Bypass tag and PR:N vector confirm no credentials are required to initiate an attack. The AC:H rating indicates exploitation is non-trivial and requires meeting specific, undisclosed conditions.
Local privilege escalation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 enables a low-privileged attacker with infrastructure logon access to achieve full system takeover via the Tuxedo middleware component. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires physical or session-level access to the host and involves high attack complexity, materially limiting opportunistic exploitation despite the complete CIA impact. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via its August 2026 Critical Security Patch Update.
Unauthenticated remote data exposure in Oracle Unified Directory allows attackers with network access via LDAP to read all directory-accessible data without credentials. Affected versions 12.2.1.4.0 and 14.1.2.1.0 of this Fusion Middleware identity store component are vulnerable to what Oracle and ENISA tag as an authentication bypass. With a CVSS 3.1 score of 7.5 and an AV:N/AC:L/PR:N/UI:N vector, exploitation is considered trivial for any attacker with network reach to the LDAP service port. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack surface makes this a high-priority patch target for organizations running OUD as a directory backend.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61-8.63) is achievable by a network-accessible, highly privileged attacker via a flaw in the PeopleCode component over HTTP. Successful exploitation results in complete confidentiality, integrity, and availability impact - Oracle characterizes the outcome as a full 'takeover' of the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, and the PR:H requirement narrows the realistic attacker population to those already holding administrative-level credentials.
SQL-based exploitation in Oracle PeopleSoft Enterprise PeopleTools Configuration Manager (versions 8.61-8.63) enables a low-privileged authenticated attacker to achieve full system takeover over the network. The vulnerability is rated CVSS 8.8 High with complete Confidentiality, Integrity, and Availability impacts, and Oracle's own description characterizes it as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad enterprise deployment footprint make this a credible priority for organizations running affected PeopleTools versions.
Local code execution and data compromise in Oracle PeopleSoft Enterprise PeopleTools (Data Mover component) affects versions 8.61 through 8.63, requiring a highly privileged attacker with physical or logical infrastructure access and human interaction from a secondary party. Successful exploitation results in full confidentiality and integrity compromise of PeopleTools data, potential modification or deletion of critical records, and partial denial of service, with a confirmed scope change that can cascade impact to additional dependent PeopleSoft products. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Oracle CSPU August 2026 advisory confirms this as a patched, vendor-acknowledged vulnerability.
Privilege-abusing data compromise in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 14.1.2.0.0 and 12.2.1.4.0 lets a low-privileged attacker with Oracle Net network access read, alter, create, or delete all platform-accessible data, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 9.6 (Critical) with high confidentiality and integrity impact but no availability impact, this is remotely reachable and low-complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Oracle Service Delivery Platform's Messaging Enabler component (versions 14.1.2.0.0 and 12.2.1.4.0 within Oracle Fusion Middleware) can be compromised by unauthenticated remote attackers via TCP, enabling unauthorized creation, deletion, or modification of critical data and repeated complete denial of service. The CVSS S:C scope change signals that a successful attack can cascade to additional Fusion Middleware products sharing the same deployment, amplifying organizational impact beyond the directly targeted platform. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) requirement reduces the likelihood of opportunistic mass exploitation.
Full remote takeover of Oracle Hyperion Calculation Manager 11.2.25.0.000 is possible by an unauthenticated attacker over HTTP, per Oracle's Critical Patch Update advisory (CSPUAUG2026). The flaw sits in the product's Security component and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8). No public exploit code or CISA KEV listing is identified at time of analysis, but the trivial exploitability and network reach make it a high-priority patch item.
Authentication bypass in Oracle PeopleSoft Enterprise PeopleTools (Install and Packaging component) versions 8.61 through 8.63 exposes critical HR and ERP data to unauthenticated network attackers over HTTP. Successful exploitation grants complete confidentiality and integrity compromise of all PeopleSoft-accessible data, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and CVSS AC:H rating indicates meaningful exploitation complexity, but the absence of any authentication requirement elevates organizational urgency.
Unauthenticated confidentiality breach in Oracle Unified Directory (OUD Core) exposes all directory-accessible data via LDAP. Both supported releases - 12.2.1.4.0 and 14.1.2.1.0 - are affected, confirming this is not a legacy-only issue. The 'Authentication Bypass' tag combined with a PR:N/AV:N CVSS vector indicates attackers can read sensitive directory contents without credentials over the network; no public exploit or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle Unified Directory (OUD) 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged attacker with LDAP network access exploiting a flaw in the OUD Core component. The CVSS scope-change indicator (S:C) confirms that successful exploitation extends beyond the directory service itself, potentially compromising dependent Oracle Fusion Middleware applications that rely on OUD for identity and authentication services. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle has acknowledged and addressed the issue in its August 2026 Critical Security Update.
Full takeover of Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged network attacker via LDAP, resulting in complete compromise of confidentiality, integrity, and availability of the directory service. The CVSS Scope:Changed indicator confirms that successful exploitation can cascade into additional Oracle Fusion Middleware components that depend on OUD for authentication or directory services, amplifying the blast radius beyond the directory itself. No public exploit code or CISA KEV listing has been identified at time of analysis, but the catastrophic impact profile and identity-backbone role of LDAP directories make this a high-priority patching target under Oracle's August 2026 Critical Patch Update.
Full system takeover is achievable against Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 via an unauthenticated HTTP attack targeting the Integration Broker component. The vulnerability carries a CVSS 3.1 score of 8.1 with complete confidentiality, integrity, and availability impact, though the AC:H metric indicates exploitation is not trivial and requires meeting specific attack complexity conditions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack path and full-takeover impact class make this a high-priority patching candidate for organizations running affected PeopleTools versions.
Local privilege escalation in Oracle Enterprise Manager for Systems Infrastructure (versions 13.5 and 24.1) allows a low-privileged authenticated local user to fully compromise the Agent component, resulting in complete takeover of the system with high confidentiality, integrity, and availability impact. The vulnerability is easily exploitable per Oracle's advisory, requiring only a valid local logon - no additional complexity or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full-takeover impact makes this a high-priority patching target for any organization running the affected component.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 is possible via the Business Interlink component, where a remote unauthenticated attacker sending crafted HTTP requests can take over the product. Oracle rates this at CVSS 9.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch in the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Siebel CRM Integration's REST component across versions 17.0 through 26.6 can yield complete loss of data confidentiality and integrity. Tagged as an authentication bypass, the vulnerability permits network-accessible attackers to read all CRM data and perform unauthorized create, delete, or modify operations without credentials. No public exploit has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update addresses the issue.
Local privilege escalation with scope change in Oracle Siebel CRM's Email Marketing component affects versions 17.0 through 26.6, confirmed via the Oracle August 2026 Critical Security Update advisory (EUVD-2026-61438). Low-privileged attackers with existing logon access to the Siebel infrastructure can, under difficult-to-reproduce conditions, bypass access controls to read or modify critical marketing data and cascade impacts to other integrated Siebel products. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated network exploitation of the Oracle Siebel CRM Marketing component enables critical data theft and unauthorized modification across all Marketing-accessible records. Tagged explicitly as an Authentication Bypass, the flaw allows a remote attacker with no credentials to compromise the confidentiality and integrity of sensitive CRM marketing data via HTTP, affecting all supported versions from 17.0 through 26.6. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the PR:N/UI:N vector means no user interaction or account is required, making the authentication bypass self-sufficient once the high-complexity exploitation conditions are met.
Unauthorized access to critical CRM data and partial data manipulation in Oracle Siebel CRM Deployment (versions 17.0-26.6) is achievable via the Migration component by any low-privileged attacker with HTTP network access, with a documented scope change indicating that successful exploitation can cascade to affect additional Oracle products beyond the directly targeted component. The CVSS 3.1 base score of 8.5 reflects low attack complexity and no user interaction requirement, making exploitation straightforward for any holder of a valid low-privilege credential. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though the breadth of affected versions spanning nearly a decade of releases represents substantial organizational exposure.
Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) contains an authentication bypass flaw enabling unauthenticated network attackers to fully compromise data confidentiality and integrity over HTTPS. The 'Authentication Bypass' tag from the Oracle reporter confirms the vulnerability class: an attacker who satisfies the high-complexity exploitation condition can read all CRM data and perform unauthorized creation, modification, or deletion of records. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Unauthenticated remote access to Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) exposes all CRM integration data to unauthorized disclosure and enables partial denial of service via plain HTTP. The vulnerability requires no credentials, no user interaction, and no special configuration beyond the REST interface being reachable, making it exploitable by any network-adjacent or internet-facing attacker. No public exploit has been identified at time of analysis, but Oracle's Critical Patch Update for August 2026 confirms the issue and its severity classification of CVSS 8.2.
Oracle Siebel CRM Deployment's Server Infrastructure component exposes versions 17.0 through 26.6 to an unauthenticated, network-based authentication bypass over HTTP that can result in complete compromise of CRM data confidentiality and integrity. The high complexity rating (AC:H) tempers immediate mass-exploitation risk, but the Authentication Bypass tag combined with C:H and I:H impact means a successful attacker achieves full read and write access to all CRM-accessible data - including customer records, sales pipelines, and service data - without presenting valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's Critical Security Patch Update for August 2026 addresses this vulnerability.
Oracle Siebel CRM Deployment's Application Interface component (versions 17.0 through 26.6) exposes complete read and write access to all CRM data to unauthenticated attackers positioned on the adjacent network segment. The CVSS vector confirms zero authentication requirements and low attack complexity, meaning any actor with access to the physical communication segment hosting the Siebel server can silently exfiltrate or corrupt the entire CRM dataset. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, but the authentication bypass classification combined with high confidentiality and integrity impact makes this a credible priority for organizations with insufficiently segmented internal networks.
Full takeover of Oracle Payments (Oracle E-Business Suite, File Transmission component) is possible by remote unauthenticated attackers over HTTP, affecting supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing profile makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation is possible in Oracle Payments (E-Business Suite component: File Transmission) across versions 12.2.3 through 12.2.15 via an authentication bypass exploitable over HTTP. A low-privileged network attacker can obtain complete read access to all Oracle Payments data and perform unauthorized insert, update, or delete operations against a subset of that data. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'easily exploitable' vendor classification combined with low attack complexity elevates real-world risk for unpatched EBS environments.
Integrity and availability compromise in Oracle Siebel Apps - Marketing (versions 17.0 through 26.6) is reachable by any low-privileged, network-authenticated attacker over HTTP with no user interaction required. Successful exploitation allows unauthorized creation, deletion, or modification of critical Marketing data, and can cause a complete denial of service via persistent hang or crash of the Marketing component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible threat in environments running unpatched Siebel deployments.
Full takeover of Oracle General Ledger (versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker via HTTP, exploiting an undisclosed flaw in the Internal Operations component of Oracle E-Business Suite. The CVSS vector confirms complete confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with application-level takeover. Notably, the intelligence tags classify this as 'Information Disclosure,' which conflicts with the described takeover impact - this discrepancy warrants verification against the Oracle August 2026 CSPU advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full takeover of Oracle Siebel Apps - Marketing is achievable by any low-privileged attacker with network access via HTTP, affecting all supported versions from 17.0 through 26.6. The CVSS 3.1 score of 8.8 reflects complete compromise of confidentiality, integrity, and availability, meaning an attacker can read, modify, or destroy data and disrupt service entirely. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a realistic threat for any internet- or intranet-exposed Siebel Marketing deployment.
Remote authentication bypass in Oracle Siebel CRM Integration's REST component affects all supported versions from 17.0 through 26.6, enabling unauthenticated network attackers to achieve full read and write access to critical CRM data via crafted HTTPS requests. The vulnerability is tagged Authentication Bypass, indicating that REST API access controls can be circumvented without credentials despite a high attack complexity (AC:H) rating that suggests exploitation requires precise crafting or internal state knowledge. No public exploit identified at time of analysis, but the combination of unauthenticated access and high confidentiality and integrity impact warrants priority patching under Oracle's August 2026 Critical Patch Update.
Full takeover of Oracle Siebel CRM's Marketing component is achievable by a low-privileged, network-accessible attacker exploiting a difficult-to-trigger condition via HTTP, affecting all supported versions from 17.0 through 26.6. Successful exploitation results in complete confidentiality, integrity, and availability compromise of the Marketing module - effectively a full component takeover. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog; however, Oracle's August 2026 Critical Patch Update confirms the flaw and releases a remediation.
Authentication bypass in Oracle Internet Procurement Connector (Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows unauthenticated remote attackers to compromise the Internal Operations component via HTTP, resulting in unauthorized read access to or manipulation of critical procurement data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impacts moderated by high attack complexity (AC:H), meaning exploitation requires specific conditions to be met despite requiring no credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized data exfiltration and limited data manipulation in Oracle Siebel Artificial Intelligence (versions 25.12 through 26.6) is achievable by any low-privileged, network-adjacent attacker over HTTP, with no user interaction required. Oracle's own advisory classifies this as 'easily exploitable,' and the scope change metric confirms that successful exploitation can cascade beyond the AI component to impact additional Siebel CRM products. No public exploit or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and broad confidentiality impact (C:H) make this a high-priority patching target for Oracle Siebel deployments.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM's Search component allows complete read and write access to all CRM data across versions 17.0 through 26.6. Successful exploitation enables creation, deletion, and modification of critical data as well as full confidentiality compromise without any prior authentication or user interaction. No public exploit identified at time of analysis, and this vulnerability is not currently listed in CISA KEV, though its low-complexity, unauthenticated nature makes it a credible priority for organizations with exposed Siebel deployments.
Unauthenticated remote compromise of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.6) allows a network attacker over HTTP to read all Marketing-accessible data and to force a complete, repeatable denial of service. The flaw is rated CVSS 3.1 9.1 and is tagged as an authentication bypass, meaning no credentials are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of no authentication, low attack complexity, and high confidentiality/availability impact makes it a high-priority patch.
Local privilege escalation in Oracle Siebel CRM Deployment (versions 17.0 through 26.6) allows a low-privileged local attacker to achieve full takeover of the affected installation, impacting confidentiality, integrity, and availability. The attack targets the Installation component and requires only logon access to the host infrastructure - no remote vector or user interaction is involved. No public exploit code and no active exploitation have been identified at time of analysis; however, the low attack complexity (AC:L) makes post-access exploitation straightforward.
Unauthorized data disclosure and partial service disruption affect Oracle Siebel CRM's Marketing component across versions 17.0 through 26.6, exploitable by a low-privileged authenticated attacker via HTTP without requiring user interaction. The flaw enables complete read access to all data within the Siebel Apps - Marketing scope alongside degraded service availability, as confirmed by Oracle's August 2026 Critical Security Patch Update. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover in Oracle Siebel CRM's Marketing component is achievable by low-privileged authenticated attackers over HTTP across all versions 17.0 through 26.6. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no user interaction required, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the straightforward exploitation conditions and full-triad impact make this a high-priority patch target for any organization running exposed Siebel Marketing instances.
Oracle General Ledger within E-Business Suite versions 12.2.3 through 12.2.15 exposes critical financial data to high-privileged network attackers through a flaw in the Internal Operations component accessible over HTTP. Successful exploitation grants complete read access to all General Ledger data and partial write capability, with a confirmed scope change meaning compromise can cascade to additional Oracle EBS products. Disclosed through Oracle's August 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.
Complete system takeover of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 through 8.63) is achievable by unauthenticated network attackers via HTTP, specifically through the PIA Core Technology component. Despite the high attack complexity rating (AC:H), successful exploitation yields full confidentiality, integrity, and availability compromise - effectively handing an attacker control over the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the impact warrants prioritized remediation through Oracle's August 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Web Services Manager (OWSM), part of Oracle Fusion Middleware's Web Services Security component, lets a remote unauthenticated attacker read, create, delete, or modify all OWSM-accessible data over HTTP. Tagged as an authentication bypass, it affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Compromise of Oracle WebCenter Portal's Composer component - versions 12.2.1.4.0 and 14.1.2.0.0 - allows an authenticated low-privilege attacker over HTTP to achieve high-integrity impact, including unauthorized creation, deletion, and modification of critical portal data, limited confidentiality exposure, and partial denial of service. The CVSS scope change (S:C) indicates exploitation can cascade to additional Oracle Fusion Middleware products beyond WebCenter Portal itself. Disclosed in Oracle's August 2026 Critical Security Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle WebCenter Portal is achievable by a low-privileged network attacker targeting the Composer component via Java RMI in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle describes the vulnerability as 'easily exploitable,' with the CVSS 3.1 score of 8.8 reflecting complete Confidentiality, Integrity, and Availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and this CVE has not appeared in the CISA Known Exploited Vulnerabilities catalog, though it is disclosed as part of Oracle's Critical Patch Update for August 2026.
Privilege-escalating account/system takeover in Oracle WebCenter Portal (Fusion Middleware, Composer component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an authenticated low-privileged attacker reach full compromise over HTTP. Because the flaw carries a scope change (S:C), successful exploitation can pivot beyond WebCenter Portal to impact additional products, and Oracle rates it CVSS 9.9. No public exploit identified at time of analysis, but the near-maximum score, low attack complexity, and minimal privilege requirement make it a top-tier patch priority.
Full takeover of Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged, network-authenticated attacker targeting the Composer component over HTTP. Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' with high impact across confidentiality, integrity, and availability and no user interaction required. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, low privilege requirement, and complete portal compromise warrants urgent patching priority for all affected deployments.
Unauthenticated data compromise and denial of service in Oracle WebCenter Portal (Fusion Middleware, Portlet Services component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker with only HTTP network access and no credentials can read or fully access all portal-accessible data and can force a hang or repeatable crash (complete DoS) of the portal. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Identity Manager (Oracle Fusion Middleware) affects the OIM Legacy UI component in versions 12.2.1.4.0 and 14.1.2.1.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the identity-management platform. The maximum CVSS 3.1 base score of 9.8 reflects complete loss of confidentiality, integrity, and availability, and because OIM governs enterprise identity and access, compromise cascades to every system it provisions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile makes it a high priority for immediate patching.
Remote network compromise of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 enables a low-privileged authenticated attacker to achieve full system takeover via the Authentication Engine over HTTP, with no user interaction required. Oracle's August 2026 Critical Patch Update advisory rates this CVSS 8.8 (High) and explicitly describes it as 'easily exploitable,' with complete confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Identity Manager (OIM Legacy UI) in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware allows a low-privileged remote attacker to fully take over the identity management platform via the T3 and IIOP protocols. The attack requires no user interaction and low complexity, resulting in complete confidentiality, integrity, and availability compromise of the OIM system. No public exploit has been identified at time of analysis, but the low barrier to exploitation makes this a critical patching priority for any enterprise running the affected versions.
Full product takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Legacy UI component) allows a remote, unauthenticated attacker to compromise the identity-governance platform over HTTP. Rated CVSS 9.8 with high confidentiality, integrity, and availability impact, this issue is trivially exploitable and requires no user interaction; at time of analysis there is no public exploit identified and it is not listed in CISA KEV. Because OIM brokers provisioning and access to downstream enterprise systems, a takeover here has cascading blast radius across connected accounts and applications.
Full compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged attacker over HTTP, resulting in complete takeover of the OIM instance. Because the flaw carries a scope change, successful exploitation can significantly impact additional connected products beyond OIM itself, elevating this from a single-product compromise to a potential identity-fabric breach. Disclosed in Oracle's August 2026 Critical Patch Update with a CVSS 3.1 base score of 9.9; no public exploit identified at time of analysis.
Full system takeover of Oracle Identity Manager is achievable by low-privileged network attackers via the OIM Legacy UI component using the T3 or IIOP protocols. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's Identity Manager product. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, effectively handing an attacker full control over the identity management platform. No public exploit has been identified at the time of analysis, and this issue is disclosed as part of Oracle's Critical Patch Update for August 2026.
Full takeover of Oracle Identity Manager via its Legacy UI component is achievable by any low-privileged, network-authenticated attacker over HTTP. Affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, with complete confidentiality, integrity, and availability impact - Oracle's own advisory characterizes the outcome as system takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) and minimal privilege bar (PR:L) make this a realistic target once any authenticated foothold exists in an exposed OIM deployment.
Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 expose a high-severity Security component flaw enabling authenticated high-privileged attackers to compromise the system via HTTP, with confirmed scope change affecting additional downstream products. Exploitation allows complete unauthorized read and write access to all OIM-accessible data, including critical identity and access management records. No public exploit has been identified at time of analysis, and this vulnerability was disclosed as part of Oracle's Critical Patch Update for August 2026.
Privilege escalation and full takeover of the Oracle Identity Manager Connector (Core component of Oracle Fusion Middleware) is possible for a low-privileged attacker with network access over TLS, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Because the flaw carries a scope change, a successful attack can pivot beyond the connector to significantly impact additional products, driving the CVSS 3.1 base score to 9.9. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently theoretical but the low attack complexity makes it a high patching priority.
Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 expose critical identity and access management data to local, low-privileged attackers who can engineer mandatory third-party user interaction, with successful exploitation crossing scope boundaries into additional Oracle Fusion Middleware components. The CVSS 3.1 base score of 7.2 reflects high confidentiality and integrity impacts under a scope-change scenario, though the local attack vector and high complexity substantially constrain real-world reach. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 is possible by an unauthenticated attacker positioned on the same physical network segment as the connector host, resulting in complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's August 2026 Critical Patch Update, the vulnerability carries a CVSS 3.1 score of 7.5 but is significantly constrained by its adjacent-only attack vector and high attack complexity. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Full takeover of Oracle Identity Manager Connector is achievable by an unauthenticated remote attacker communicating over TLS, affecting the Core component of versions 12.2.1.4.0 and 14.1.2.1.0 under Oracle Fusion Middleware. The CVSS vector confirms network reachability with no privileges or user interaction required, though high attack complexity (AC:H) indicates that exploitation demands specific conditions beyond a simple point-and-shoot approach. No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete confidentiality, integrity, and availability impact makes successful exploitation a full system compromise.
Local privilege escalation in Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows a low-privileged attacker with local logon access to the hosting infrastructure to achieve full takeover of the connector, impacting confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects straightforward exploitation once local access is obtained - no elevated privileges, no user interaction, and no complex attack conditions are required. No public exploit code or active exploitation has been identified at time of analysis; this is disclosed as part of Oracle's August 2026 Critical Patch Update. Note: The intelligence tag 'Information Disclosure' conflicts with the CVSS C:H/I:H/A:H impact profile and the 'takeover' language in the description - the actual scope of impact is broader than disclosure alone and should not be understated.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Oracle Fusion Middleware, Core component) lets a low-privileged, network-adjacent attacker fully compromise the Connector over TLS, with a scope change that can significantly impact other integrated products. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, carrying a CVSS 3.1 base score of 9.9 (C:H/I:H/A:H). No public exploit is identified at time of analysis, and the issue is addressed in Oracle's August 2026 Critical Patch Update.
Unauthorized data exposure in Oracle WebCenter Content's Content Server allows authenticated low-privileged users to access critical or complete enterprise content data over HTTP, with a CVSS 3.1 scope change (S:C) signaling collateral impact on additional Oracle Fusion Middleware components in the same environment. Affecting supported versions 14.1.2.0.0 and 12.2.1.4.0, the vulnerability is tagged as an authentication bypass and carries a CVSS 3.1 score of 7.7, reflecting low attack complexity and no user interaction once a valid account is held. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the straightforward exploitation conditions make patching urgent for environments with broadly distributed low-privileged accounts.
Oracle WebCenter Content's Content Server component, in versions 14.1.2.0.0 and 12.2.1.4.0, exposes an authentication bypass that allows a low-privileged remote attacker to achieve full confidentiality and integrity compromise of all accessible content data - and, due to a confirmed scope change, may significantly impact additional Oracle Fusion Middleware products integrated with the platform. Exploitation is network-accessible over HTTP with low complexity but requires a valid low-privileged account and human interaction from a separate victim, classifying this as a socially-engineered or CSRF-class attack surface. No public exploit code and no CISA KEV listing have been identified at time of analysis; the vulnerability was disclosed as part of Oracle's August 2026 Critical Security Patch Update.
Unauthorized data access and tampering in Oracle WebCenter Content's Content Server component allows unauthenticated remote attackers to fully read or manipulate all managed content via HTTP. Both supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and successful exploitation can cascade beyond the Content Server itself to impact additional Oracle Fusion Middleware products within the same deployment environment. No public exploit has been identified at time of analysis, but the unauthenticated network vector combined with a scope change rating makes this a high-priority item for any organization running this ECM platform.
Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware, WLS Core Components) allows a network attacker to fully take over the server via the RMI protocol. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, with a CVSS 3.1 base score of 9.8 reflecting full confidentiality, integrity, and availability loss. No public exploit was identified at time of analysis, but the 'easily exploitable' rating and unauthenticated RMI attack surface make this a top-priority patch.
Oracle Scripting versions 12.2.3 through 12.2.15, as part of Oracle E-Business Suite, exposes an easily exploitable flaw in its Internal Operations component that enables a low-privileged network attacker to achieve full system takeover over HTTP. The vulnerability scores CVSS 3.1 8.8, reflecting High impacts across all three pillars - Confidentiality, Integrity, and Availability - with low attack complexity and no user interaction required. No public exploit has been identified at time of analysis, but the minimal authentication barrier and network accessibility make this a high-urgency remediation target for organizations running Oracle EBS.
PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 contain an authentication bypass in the Security component, exploitable by a low-privileged attacker with local infrastructure access to achieve full confidentiality and integrity compromise of PeopleTools data, with scope change enabling lateral impact across additional integrated Oracle products. The local attack vector (AV:L) and high complexity (AC:H) constrain exploitation to insider threats or post-compromise scenarios, but the S:C scope change and H/H confidentiality-integrity impact make successful exploitation highly consequential in large Oracle ERP environments. No public exploit code or active exploitation has been identified at time of analysis.
Complete takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthenticated remote attacker over the T3 and IIOP protocols in the Client Bundle component. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects easy, network-based exploitation yielding full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
Full-system takeover of Oracle WebCenter Enterprise Capture (Oracle Fusion Middleware, Client Bundle component) is achievable by a remote, unauthenticated attacker reaching the server over the T3 or IIOP protocols. Oracle rates this CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable,' meaning a single crafted protocol interaction can yield complete compromise of the Capture instance. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of reliable Java-deserialization exploitation in the WebLogic/Fusion Middleware stack.
Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 expose a network-accessible LDAP authorization bypass that enables a low-privileged authenticated attacker to gain unauthorized access to critical or complete directory data. Intelligence sources tag this as an authentication bypass in the OUD Core component, with confirmed scope change impact on additional Oracle Fusion Middleware products consuming OUD identity data. No active exploitation confirmed at time of analysis and no public exploit code has been identified; however, the low attack complexity and network accessibility make this a credible priority for Oracle Fusion Middleware environments.
Full takeover of Oracle PeopleSoft Enterprise PeopleTools is achievable by an unauthenticated remote attacker targeting the nVision component via HTTP on versions 8.61 through 8.63. The attack requires that a victim user interact with attacker-controlled content - consistent with a client-side exploitation pattern such as XSS or CSRF - after which the attacker achieves complete compromise with high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and absence of any authentication requirement lower the bar for targeted exploitation against internet-accessible PeopleSoft deployments.
Authentication bypass in Oracle WebCenter Content's Content Server component allows unauthenticated attackers with adjacent network access to fully compromise data confidentiality and integrity across versions 12.2.1.4.0 and 14.1.2.0.0. The scope change designation confirms that successful exploitation can cascade beyond WebCenter Content itself to additional Oracle Fusion Middleware products. Disclosed via Oracle's August 2026 Critical Security Patch Update, with no public exploit identified at time of analysis.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the product. Oracle rates this CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning no credentials or user interaction are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-takeover profile makes it a top-priority patch in Oracle's August 2026 Critical Patch Update.
Full takeover of JD Edwards EnterpriseOne US Payroll version 9.2 is achievable by a low-privileged, network-adjacent attacker via the JDENET protocol, with successful exploitation yielding complete confidentiality, integrity, and availability compromise of the payroll system. Oracle rates this High severity (CVSS 7.5) under the August 2026 Critical Patch Update; the high attack complexity (AC:H) is the primary barrier to mass exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle WebCenter Content's Content Server component, within the Oracle Fusion Middleware stack, exposes a network-reachable integrity compromise affecting versions 12.2.1.4.0 and 14.1.2.0.0. High-privileged authenticated attackers can access the service via HTTP to arbitrarily create, delete, or modify critical repository data, read a subset of accessible content, and cause partial denial of service - with a confirmed scope change indicating potential cascading impact on additional Oracle Fusion Middleware products. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content's Content Server component, in versions 12.2.1.4.0 and 14.1.2.0.0, contains an authentication bypass vulnerability reachable over HTTP without credentials, carrying a CVSS 3.1 base score of 8.7. Successful exploitation enables an unauthenticated remote attacker to gain both full read access and full create/delete/modify access to critical content data, with a confirmed scope change meaning downstream Oracle Fusion Middleware components may also be impacted. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the Authentication Bypass tag and high attack complexity signal a non-trivial but realistic threat to unpatched deployments.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose a high-complexity, network-accessible flaw in the Content Server component that allows low-privileged authenticated attackers to gain unauthorized read access to critical content data and perform limited data manipulation. The vulnerability carries a scope-change designation, meaning successful exploitation can extend impact beyond WebCenter Content itself to adjacent Oracle Fusion Middleware products. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, though the 'Authentication Bypass' tag from ENISA EUVD introduces residual uncertainty about the true privilege prerequisite.
Complete takeover of Oracle WebCenter Enterprise Capture is possible via the Client Bundle component, where an unauthenticated network attacker leveraging the RMI protocol can fully compromise the affected server. Oracle's August 2026 Critical Patch Update rates this at CVSS 9.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis, though the trivial exploitability (AC:L, PR:N) and RMI attack surface make it a high-priority patch item.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by an unauthenticated attacker reaching the product over Java RMI, per Oracle's August 2026 Critical Patch Update. The flaw is rated CVSS 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable,' affecting versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach, no authentication, and complete compromise makes it a top-priority patch.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose a network-accessible, unauthenticated vulnerability in the Content Server component that can be triggered via HTTP with user interaction, resulting in a scope change affecting additional products. Successful exploitation grants attackers complete read access to all data accessible within Oracle WebCenter Content and limited write capabilities (insert/update/delete) against some accessible data. No public exploit or CISA KEV listing has been identified at time of analysis, though the Oracle-assigned tag of 'Authentication Bypass' and the high CVSS score of 8.2 warrant prompt patching within Oracle Critical Patch Update cycles.
Remote authentication bypass in Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to fully compromise confidentiality and integrity of managed content - including unauthorized creation, deletion, and modification of critical data - across both affected release lines 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope-change flag (S:C) indicates successful exploitation can cascade to affect additional Oracle Fusion Middleware products beyond WebCenter Content itself. Attack complexity is rated High (AC:H), meaning specific and difficult-to-reproduce conditions must be met, but no authentication or user interaction is required. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content's Content Server component harbors an authentication bypass exploitable by unauthenticated remote attackers over HTTP, affecting both actively supported versions (12.2.1.4.0 and 14.1.2.0.0) of this Oracle Fusion Middleware product. Successful exploitation grants complete unauthorized read and write access to all content managed by the system, with a confirmed scope change that can extend impact to additional Oracle Fusion Middleware products in the same deployment. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated network vector paired with high confidentiality and integrity impacts makes this a meaningful risk for organizations running exposed affected deployments.
Unauthorized read and write access to critical enterprise content data is achievable in Oracle WebCenter Content's Content Server component via an authentication bypass exploitable over HTTP. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, an unauthenticated remote attacker who overcomes the high attack complexity barrier can exfiltrate all accessible content or create, modify, and delete critical records. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local privilege exploitation in Oracle WebCenter Content 14.1.2.0.0 enables a low-privileged, authenticated user with system logon access to fully compromise the Content Server component. The attacker can read, create, delete, or modify all data accessible within Oracle WebCenter Content, and the confirmed scope change means attacks can cascade into additional co-hosted Oracle Fusion Middleware products. No public exploit has been identified at time of analysis, but the low attack complexity and wide data impact make this a high-priority patch target for any environment running this middleware version.
Remote takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated network attacker to fully compromise the product via the WebLogic T3 and IIOP protocols exposed by the Client Bundle component. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), reflecting easy, no-privilege exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the T3/IIOP attack class is historically a high-value target in Oracle Fusion Middleware.
Remote unauthenticated compromise of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) allows an attacker with only network/HTTP reach to create, delete, or modify critical data, read a subset of accessible data, and cause partial denial of service. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and Oracle explicitly flags a scope change meaning successful attacks may significantly impact other products beyond Capture itself. Rated CVSS 3.1 9.9; disclosed in the Oracle Critical Patch Update of August 2026 with no public exploit identified at time of analysis.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network-accessible attackers to fully compromise both the confidentiality and integrity of all data accessible to the service. The vulnerability carries a CVSS 3.1 score of 7.4, tempered by high attack complexity (AC:H), meaning specific, non-trivial conditions must be satisfied for exploitation. Disclosed via Oracle's Critical Patch Update for August 2026, no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote disclosure of all Oracle Unified Directory data is possible via the LDAP protocol in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Unified Directory (Oracle Fusion Middleware). The 'Authentication Bypass' tag and a CVSS vector of AV:N/AC:L/PR:N/UI:N confirm that a network-accessible attacker with no credentials can exploit the OUD Core component to read critical or complete directory data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a straightforward target for opportunistic scanning.
Oracle WebCenter Content's Content Server component in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is exploitable by a low-privileged authenticated attacker over HTTP who can lure a higher-privileged victim into interacting with malicious content, resulting in unauthorized access to critical data and partial data manipulation with confirmed scope impact beyond WebCenter Content itself. Tagged as an authentication bypass by Oracle, this vulnerability carries a CVSS 3.1 base score of 7.6 and is classified as easily exploitable in Oracle's August 2026 Critical Patch Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote access to all confidential data managed by Oracle WebCenter Content's Content Server component is achievable across two currently supported Fusion Middleware release lines. Tagged as an authentication bypass, this vulnerability allows a network-accessible attacker to read sensitive documents and managed content by sending HTTP requests without supplying any credentials, requiring no user interaction and no elevated privileges. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-authentication, low-complexity attack profile makes this a high-priority remediation item for any deployment reachable from untrusted network segments.
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to fully read, create, modify or delete all Content Server-accessible data and cause a partial denial of service. Oracle rates it CVSS 9.6, driven by a scope change (S:C) meaning successful attacks can significantly impact products beyond WebCenter Content itself. Exploitation requires tricking a legitimate user into an action (UI:R); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated network exploitation of Oracle WebCenter Content's Content Server component allows a remote attacker to achieve full confidentiality and integrity compromise of all accessible content data, with a scope change that can significantly impact additional Oracle Fusion Middleware products in the same environment. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's Critical Patch Update of August 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Authentication Bypass tag and PR:N vector confirm no credentials are required to initiate an attack. The AC:H rating indicates exploitation is non-trivial and requires meeting specific, undisclosed conditions.
Local privilege escalation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 enables a low-privileged attacker with infrastructure logon access to achieve full system takeover via the Tuxedo middleware component. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires physical or session-level access to the host and involves high attack complexity, materially limiting opportunistic exploitation despite the complete CIA impact. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via its August 2026 Critical Security Patch Update.
Unauthenticated remote data exposure in Oracle Unified Directory allows attackers with network access via LDAP to read all directory-accessible data without credentials. Affected versions 12.2.1.4.0 and 14.1.2.1.0 of this Fusion Middleware identity store component are vulnerable to what Oracle and ENISA tag as an authentication bypass. With a CVSS 3.1 score of 7.5 and an AV:N/AC:L/PR:N/UI:N vector, exploitation is considered trivial for any attacker with network reach to the LDAP service port. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack surface makes this a high-priority patch target for organizations running OUD as a directory backend.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61-8.63) is achievable by a network-accessible, highly privileged attacker via a flaw in the PeopleCode component over HTTP. Successful exploitation results in complete confidentiality, integrity, and availability impact - Oracle characterizes the outcome as a full 'takeover' of the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, and the PR:H requirement narrows the realistic attacker population to those already holding administrative-level credentials.
SQL-based exploitation in Oracle PeopleSoft Enterprise PeopleTools Configuration Manager (versions 8.61-8.63) enables a low-privileged authenticated attacker to achieve full system takeover over the network. The vulnerability is rated CVSS 8.8 High with complete Confidentiality, Integrity, and Availability impacts, and Oracle's own description characterizes it as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad enterprise deployment footprint make this a credible priority for organizations running affected PeopleTools versions.
Local code execution and data compromise in Oracle PeopleSoft Enterprise PeopleTools (Data Mover component) affects versions 8.61 through 8.63, requiring a highly privileged attacker with physical or logical infrastructure access and human interaction from a secondary party. Successful exploitation results in full confidentiality and integrity compromise of PeopleTools data, potential modification or deletion of critical records, and partial denial of service, with a confirmed scope change that can cascade impact to additional dependent PeopleSoft products. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Oracle CSPU August 2026 advisory confirms this as a patched, vendor-acknowledged vulnerability.
Privilege-abusing data compromise in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 14.1.2.0.0 and 12.2.1.4.0 lets a low-privileged attacker with Oracle Net network access read, alter, create, or delete all platform-accessible data, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 9.6 (Critical) with high confidentiality and integrity impact but no availability impact, this is remotely reachable and low-complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Oracle Service Delivery Platform's Messaging Enabler component (versions 14.1.2.0.0 and 12.2.1.4.0 within Oracle Fusion Middleware) can be compromised by unauthenticated remote attackers via TCP, enabling unauthorized creation, deletion, or modification of critical data and repeated complete denial of service. The CVSS S:C scope change signals that a successful attack can cascade to additional Fusion Middleware products sharing the same deployment, amplifying organizational impact beyond the directly targeted platform. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) requirement reduces the likelihood of opportunistic mass exploitation.
Full remote takeover of Oracle Hyperion Calculation Manager 11.2.25.0.000 is possible by an unauthenticated attacker over HTTP, per Oracle's Critical Patch Update advisory (CSPUAUG2026). The flaw sits in the product's Security component and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8). No public exploit code or CISA KEV listing is identified at time of analysis, but the trivial exploitability and network reach make it a high-priority patch item.
Authentication bypass in Oracle PeopleSoft Enterprise PeopleTools (Install and Packaging component) versions 8.61 through 8.63 exposes critical HR and ERP data to unauthenticated network attackers over HTTP. Successful exploitation grants complete confidentiality and integrity compromise of all PeopleSoft-accessible data, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and CVSS AC:H rating indicates meaningful exploitation complexity, but the absence of any authentication requirement elevates organizational urgency.
Unauthenticated confidentiality breach in Oracle Unified Directory (OUD Core) exposes all directory-accessible data via LDAP. Both supported releases - 12.2.1.4.0 and 14.1.2.1.0 - are affected, confirming this is not a legacy-only issue. The 'Authentication Bypass' tag combined with a PR:N/AV:N CVSS vector indicates attackers can read sensitive directory contents without credentials over the network; no public exploit or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle Unified Directory (OUD) 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged attacker with LDAP network access exploiting a flaw in the OUD Core component. The CVSS scope-change indicator (S:C) confirms that successful exploitation extends beyond the directory service itself, potentially compromising dependent Oracle Fusion Middleware applications that rely on OUD for identity and authentication services. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle has acknowledged and addressed the issue in its August 2026 Critical Security Update.
Full takeover of Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged network attacker via LDAP, resulting in complete compromise of confidentiality, integrity, and availability of the directory service. The CVSS Scope:Changed indicator confirms that successful exploitation can cascade into additional Oracle Fusion Middleware components that depend on OUD for authentication or directory services, amplifying the blast radius beyond the directory itself. No public exploit code or CISA KEV listing has been identified at time of analysis, but the catastrophic impact profile and identity-backbone role of LDAP directories make this a high-priority patching target under Oracle's August 2026 Critical Patch Update.
Full system takeover is achievable against Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 via an unauthenticated HTTP attack targeting the Integration Broker component. The vulnerability carries a CVSS 3.1 score of 8.1 with complete confidentiality, integrity, and availability impact, though the AC:H metric indicates exploitation is not trivial and requires meeting specific attack complexity conditions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack path and full-takeover impact class make this a high-priority patching candidate for organizations running affected PeopleTools versions.
Local privilege escalation in Oracle Enterprise Manager for Systems Infrastructure (versions 13.5 and 24.1) allows a low-privileged authenticated local user to fully compromise the Agent component, resulting in complete takeover of the system with high confidentiality, integrity, and availability impact. The vulnerability is easily exploitable per Oracle's advisory, requiring only a valid local logon - no additional complexity or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full-takeover impact makes this a high-priority patching target for any organization running the affected component.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 is possible via the Business Interlink component, where a remote unauthenticated attacker sending crafted HTTP requests can take over the product. Oracle rates this at CVSS 9.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch in the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Siebel CRM Integration's REST component across versions 17.0 through 26.6 can yield complete loss of data confidentiality and integrity. Tagged as an authentication bypass, the vulnerability permits network-accessible attackers to read all CRM data and perform unauthorized create, delete, or modify operations without credentials. No public exploit has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update addresses the issue.
Local privilege escalation with scope change in Oracle Siebel CRM's Email Marketing component affects versions 17.0 through 26.6, confirmed via the Oracle August 2026 Critical Security Update advisory (EUVD-2026-61438). Low-privileged attackers with existing logon access to the Siebel infrastructure can, under difficult-to-reproduce conditions, bypass access controls to read or modify critical marketing data and cascade impacts to other integrated Siebel products. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated network exploitation of the Oracle Siebel CRM Marketing component enables critical data theft and unauthorized modification across all Marketing-accessible records. Tagged explicitly as an Authentication Bypass, the flaw allows a remote attacker with no credentials to compromise the confidentiality and integrity of sensitive CRM marketing data via HTTP, affecting all supported versions from 17.0 through 26.6. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the PR:N/UI:N vector means no user interaction or account is required, making the authentication bypass self-sufficient once the high-complexity exploitation conditions are met.
Unauthorized access to critical CRM data and partial data manipulation in Oracle Siebel CRM Deployment (versions 17.0-26.6) is achievable via the Migration component by any low-privileged attacker with HTTP network access, with a documented scope change indicating that successful exploitation can cascade to affect additional Oracle products beyond the directly targeted component. The CVSS 3.1 base score of 8.5 reflects low attack complexity and no user interaction requirement, making exploitation straightforward for any holder of a valid low-privilege credential. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though the breadth of affected versions spanning nearly a decade of releases represents substantial organizational exposure.
Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) contains an authentication bypass flaw enabling unauthenticated network attackers to fully compromise data confidentiality and integrity over HTTPS. The 'Authentication Bypass' tag from the Oracle reporter confirms the vulnerability class: an attacker who satisfies the high-complexity exploitation condition can read all CRM data and perform unauthorized creation, modification, or deletion of records. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Unauthenticated remote access to Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) exposes all CRM integration data to unauthorized disclosure and enables partial denial of service via plain HTTP. The vulnerability requires no credentials, no user interaction, and no special configuration beyond the REST interface being reachable, making it exploitable by any network-adjacent or internet-facing attacker. No public exploit has been identified at time of analysis, but Oracle's Critical Patch Update for August 2026 confirms the issue and its severity classification of CVSS 8.2.
Oracle Siebel CRM Deployment's Server Infrastructure component exposes versions 17.0 through 26.6 to an unauthenticated, network-based authentication bypass over HTTP that can result in complete compromise of CRM data confidentiality and integrity. The high complexity rating (AC:H) tempers immediate mass-exploitation risk, but the Authentication Bypass tag combined with C:H and I:H impact means a successful attacker achieves full read and write access to all CRM-accessible data - including customer records, sales pipelines, and service data - without presenting valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's Critical Security Patch Update for August 2026 addresses this vulnerability.
Oracle Siebel CRM Deployment's Application Interface component (versions 17.0 through 26.6) exposes complete read and write access to all CRM data to unauthenticated attackers positioned on the adjacent network segment. The CVSS vector confirms zero authentication requirements and low attack complexity, meaning any actor with access to the physical communication segment hosting the Siebel server can silently exfiltrate or corrupt the entire CRM dataset. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, but the authentication bypass classification combined with high confidentiality and integrity impact makes this a credible priority for organizations with insufficiently segmented internal networks.
Full takeover of Oracle Payments (Oracle E-Business Suite, File Transmission component) is possible by remote unauthenticated attackers over HTTP, affecting supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing profile makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation is possible in Oracle Payments (E-Business Suite component: File Transmission) across versions 12.2.3 through 12.2.15 via an authentication bypass exploitable over HTTP. A low-privileged network attacker can obtain complete read access to all Oracle Payments data and perform unauthorized insert, update, or delete operations against a subset of that data. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'easily exploitable' vendor classification combined with low attack complexity elevates real-world risk for unpatched EBS environments.
Integrity and availability compromise in Oracle Siebel Apps - Marketing (versions 17.0 through 26.6) is reachable by any low-privileged, network-authenticated attacker over HTTP with no user interaction required. Successful exploitation allows unauthorized creation, deletion, or modification of critical Marketing data, and can cause a complete denial of service via persistent hang or crash of the Marketing component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible threat in environments running unpatched Siebel deployments.
Full takeover of Oracle General Ledger (versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker via HTTP, exploiting an undisclosed flaw in the Internal Operations component of Oracle E-Business Suite. The CVSS vector confirms complete confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with application-level takeover. Notably, the intelligence tags classify this as 'Information Disclosure,' which conflicts with the described takeover impact - this discrepancy warrants verification against the Oracle August 2026 CSPU advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full takeover of Oracle Siebel Apps - Marketing is achievable by any low-privileged attacker with network access via HTTP, affecting all supported versions from 17.0 through 26.6. The CVSS 3.1 score of 8.8 reflects complete compromise of confidentiality, integrity, and availability, meaning an attacker can read, modify, or destroy data and disrupt service entirely. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a realistic threat for any internet- or intranet-exposed Siebel Marketing deployment.
Remote authentication bypass in Oracle Siebel CRM Integration's REST component affects all supported versions from 17.0 through 26.6, enabling unauthenticated network attackers to achieve full read and write access to critical CRM data via crafted HTTPS requests. The vulnerability is tagged Authentication Bypass, indicating that REST API access controls can be circumvented without credentials despite a high attack complexity (AC:H) rating that suggests exploitation requires precise crafting or internal state knowledge. No public exploit identified at time of analysis, but the combination of unauthenticated access and high confidentiality and integrity impact warrants priority patching under Oracle's August 2026 Critical Patch Update.
Full takeover of Oracle Siebel CRM's Marketing component is achievable by a low-privileged, network-accessible attacker exploiting a difficult-to-trigger condition via HTTP, affecting all supported versions from 17.0 through 26.6. Successful exploitation results in complete confidentiality, integrity, and availability compromise of the Marketing module - effectively a full component takeover. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog; however, Oracle's August 2026 Critical Patch Update confirms the flaw and releases a remediation.
Authentication bypass in Oracle Internet Procurement Connector (Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows unauthenticated remote attackers to compromise the Internal Operations component via HTTP, resulting in unauthorized read access to or manipulation of critical procurement data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impacts moderated by high attack complexity (AC:H), meaning exploitation requires specific conditions to be met despite requiring no credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized data exfiltration and limited data manipulation in Oracle Siebel Artificial Intelligence (versions 25.12 through 26.6) is achievable by any low-privileged, network-adjacent attacker over HTTP, with no user interaction required. Oracle's own advisory classifies this as 'easily exploitable,' and the scope change metric confirms that successful exploitation can cascade beyond the AI component to impact additional Siebel CRM products. No public exploit or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and broad confidentiality impact (C:H) make this a high-priority patching target for Oracle Siebel deployments.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM's Search component allows complete read and write access to all CRM data across versions 17.0 through 26.6. Successful exploitation enables creation, deletion, and modification of critical data as well as full confidentiality compromise without any prior authentication or user interaction. No public exploit identified at time of analysis, and this vulnerability is not currently listed in CISA KEV, though its low-complexity, unauthenticated nature makes it a credible priority for organizations with exposed Siebel deployments.
Unauthenticated remote compromise of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.6) allows a network attacker over HTTP to read all Marketing-accessible data and to force a complete, repeatable denial of service. The flaw is rated CVSS 3.1 9.1 and is tagged as an authentication bypass, meaning no credentials are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of no authentication, low attack complexity, and high confidentiality/availability impact makes it a high-priority patch.
Local privilege escalation in Oracle Siebel CRM Deployment (versions 17.0 through 26.6) allows a low-privileged local attacker to achieve full takeover of the affected installation, impacting confidentiality, integrity, and availability. The attack targets the Installation component and requires only logon access to the host infrastructure - no remote vector or user interaction is involved. No public exploit code and no active exploitation have been identified at time of analysis; however, the low attack complexity (AC:L) makes post-access exploitation straightforward.
Unauthorized data disclosure and partial service disruption affect Oracle Siebel CRM's Marketing component across versions 17.0 through 26.6, exploitable by a low-privileged authenticated attacker via HTTP without requiring user interaction. The flaw enables complete read access to all data within the Siebel Apps - Marketing scope alongside degraded service availability, as confirmed by Oracle's August 2026 Critical Security Patch Update. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover in Oracle Siebel CRM's Marketing component is achievable by low-privileged authenticated attackers over HTTP across all versions 17.0 through 26.6. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no user interaction required, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the straightforward exploitation conditions and full-triad impact make this a high-priority patch target for any organization running exposed Siebel Marketing instances.
Oracle General Ledger within E-Business Suite versions 12.2.3 through 12.2.15 exposes critical financial data to high-privileged network attackers through a flaw in the Internal Operations component accessible over HTTP. Successful exploitation grants complete read access to all General Ledger data and partial write capability, with a confirmed scope change meaning compromise can cascade to additional Oracle EBS products. Disclosed through Oracle's August 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.
Complete system takeover of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 through 8.63) is achievable by unauthenticated network attackers via HTTP, specifically through the PIA Core Technology component. Despite the high attack complexity rating (AC:H), successful exploitation yields full confidentiality, integrity, and availability compromise - effectively handing an attacker control over the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the impact warrants prioritized remediation through Oracle's August 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Web Services Manager (OWSM), part of Oracle Fusion Middleware's Web Services Security component, lets a remote unauthenticated attacker read, create, delete, or modify all OWSM-accessible data over HTTP. Tagged as an authentication bypass, it affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Compromise of Oracle WebCenter Portal's Composer component - versions 12.2.1.4.0 and 14.1.2.0.0 - allows an authenticated low-privilege attacker over HTTP to achieve high-integrity impact, including unauthorized creation, deletion, and modification of critical portal data, limited confidentiality exposure, and partial denial of service. The CVSS scope change (S:C) indicates exploitation can cascade to additional Oracle Fusion Middleware products beyond WebCenter Portal itself. Disclosed in Oracle's August 2026 Critical Security Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle WebCenter Portal is achievable by a low-privileged network attacker targeting the Composer component via Java RMI in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle describes the vulnerability as 'easily exploitable,' with the CVSS 3.1 score of 8.8 reflecting complete Confidentiality, Integrity, and Availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and this CVE has not appeared in the CISA Known Exploited Vulnerabilities catalog, though it is disclosed as part of Oracle's Critical Patch Update for August 2026.
Privilege-escalating account/system takeover in Oracle WebCenter Portal (Fusion Middleware, Composer component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an authenticated low-privileged attacker reach full compromise over HTTP. Because the flaw carries a scope change (S:C), successful exploitation can pivot beyond WebCenter Portal to impact additional products, and Oracle rates it CVSS 9.9. No public exploit identified at time of analysis, but the near-maximum score, low attack complexity, and minimal privilege requirement make it a top-tier patch priority.
Full takeover of Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged, network-authenticated attacker targeting the Composer component over HTTP. Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' with high impact across confidentiality, integrity, and availability and no user interaction required. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, low privilege requirement, and complete portal compromise warrants urgent patching priority for all affected deployments.
Unauthenticated data compromise and denial of service in Oracle WebCenter Portal (Fusion Middleware, Portlet Services component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker with only HTTP network access and no credentials can read or fully access all portal-accessible data and can force a hang or repeatable crash (complete DoS) of the portal. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Identity Manager (Oracle Fusion Middleware) affects the OIM Legacy UI component in versions 12.2.1.4.0 and 14.1.2.1.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the identity-management platform. The maximum CVSS 3.1 base score of 9.8 reflects complete loss of confidentiality, integrity, and availability, and because OIM governs enterprise identity and access, compromise cascades to every system it provisions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile makes it a high priority for immediate patching.
Remote network compromise of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 enables a low-privileged authenticated attacker to achieve full system takeover via the Authentication Engine over HTTP, with no user interaction required. Oracle's August 2026 Critical Patch Update advisory rates this CVSS 8.8 (High) and explicitly describes it as 'easily exploitable,' with complete confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Identity Manager (OIM Legacy UI) in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware allows a low-privileged remote attacker to fully take over the identity management platform via the T3 and IIOP protocols. The attack requires no user interaction and low complexity, resulting in complete confidentiality, integrity, and availability compromise of the OIM system. No public exploit has been identified at time of analysis, but the low barrier to exploitation makes this a critical patching priority for any enterprise running the affected versions.
Full product takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Legacy UI component) allows a remote, unauthenticated attacker to compromise the identity-governance platform over HTTP. Rated CVSS 9.8 with high confidentiality, integrity, and availability impact, this issue is trivially exploitable and requires no user interaction; at time of analysis there is no public exploit identified and it is not listed in CISA KEV. Because OIM brokers provisioning and access to downstream enterprise systems, a takeover here has cascading blast radius across connected accounts and applications.
Full compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged attacker over HTTP, resulting in complete takeover of the OIM instance. Because the flaw carries a scope change, successful exploitation can significantly impact additional connected products beyond OIM itself, elevating this from a single-product compromise to a potential identity-fabric breach. Disclosed in Oracle's August 2026 Critical Patch Update with a CVSS 3.1 base score of 9.9; no public exploit identified at time of analysis.
Full system takeover of Oracle Identity Manager is achievable by low-privileged network attackers via the OIM Legacy UI component using the T3 or IIOP protocols. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's Identity Manager product. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, effectively handing an attacker full control over the identity management platform. No public exploit has been identified at the time of analysis, and this issue is disclosed as part of Oracle's Critical Patch Update for August 2026.
Full takeover of Oracle Identity Manager via its Legacy UI component is achievable by any low-privileged, network-authenticated attacker over HTTP. Affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, with complete confidentiality, integrity, and availability impact - Oracle's own advisory characterizes the outcome as system takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) and minimal privilege bar (PR:L) make this a realistic target once any authenticated foothold exists in an exposed OIM deployment.
Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 expose a high-severity Security component flaw enabling authenticated high-privileged attackers to compromise the system via HTTP, with confirmed scope change affecting additional downstream products. Exploitation allows complete unauthorized read and write access to all OIM-accessible data, including critical identity and access management records. No public exploit has been identified at time of analysis, and this vulnerability was disclosed as part of Oracle's Critical Patch Update for August 2026.