Oracle
Monthly
Local low-privilege users with a logon to the infrastructure hosting Oracle HTTP Server 12.2.1.4.0 can exploit the OSSL module to take full control of the HTTP Server, with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) confirms the attack is local, requires an authenticated low-privileged account, needs no user interaction, and has low complexity once that access exists. No public exploit identified at time of analysis, and no confirmed active exploitation was provided in the intelligence.
Oracle Java SE (8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27), GraalVM for JDK 17.0.20.1/21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1 contain a moderate-priority, difficult-to-exploit flaw in the 2D component that unauthenticated remote attackers can reach through APIs processing attacker-supplied data. Successful exploitation can repeatedly hang or crash the JVM (complete denial of service) and may allow limited unauthorized reads and updates of accessible data. No public exploit code or CISA KEV entry was identified at time of analysis; Oracle addresses the issue in its October 2026 Critical Patch Update.
Remote, unauthenticated takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 is possible when attackers can reach the T3 or IIOP listener used by the End User Self Service component. Oracle rates this 9.8 with no credentials, no user interaction, and no non-default configuration required, so default deployments are exposed if those protocols are network-reachable. No public exploit was identified at time of analysis, but risk is highest where T3/IIOP are internet-facing or broadly reachable from untrusted segments.
Privilege escalation through the REST WebServices component of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged authenticated attacker with HTTP network access to take over the OIM deployment, with high confidentiality, integrity and availability impact (CVSS 8.8). Exploitation requires a valid low-privilege account on the target instance (PR:L) but no user interaction and only low attack complexity, so exposure hinges on whether the REST interface is reachable by untrusted networks. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied with the source data.
Oracle Outside In PDF Export SDK 8.5.8 (part of Oracle Fusion Middleware) can be fully compromised - confidentiality, integrity, and availability all high - when a third-party application that embeds the SDK processes a maliciously crafted document. The vulnerability is unauthenticated and network-reachable over HTTP, but Oracle rates it difficult to exploit and it requires a human other than the attacker to trigger parsing of the malicious file, so practical exposure depends entirely on whether a reachable service feeds untrusted documents into the PDF Export component. No public exploit code or confirmed active exploitation was identified at time of analysis; the 7.5 score reflects the high impact and the AC:H/UI:R preconditions rather than demonstrated weaponization.
Takeover of Oracle Outside In Technology 8.5.8 can occur when a victim-side application processes a crafted document through the Outside In PDF Export SDK. The flaw is network-reachable but requires human interaction and high attack complexity, and no public exploit has been identified at time of analysis. This is a moderate-priority issue concentrated in deployments that feed untrusted files into Outside In.
Unauthenticated network attackers can read critical data from Oracle Siebel CRM Integration's Open Integration component in versions 25.12 through 26.9 over HTTP, with CVSS 3.1 base score 7.5 reflecting high confidentiality impact and no integrity or availability impact. Exploitation requires only that the integration HTTP endpoint be reachable, since the assessed vector is PR:N/UI:N with low attack complexity. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Oracle BPM Suite 12.2.1.4.0 and 14.1.2.0.0 expose the Case Management Service (11g+) to unauthenticated, low-complexity HTTP attacks that can read critical data and make limited unauthorized changes. Oracle rates the issue 8.2 (High) with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, meaning no credentials or user interaction are required against a reachable instance. No public exploit was identified at time of analysis, so exposure is primarily a function of whether the BPM Suite HTTP interface is reachable from untrusted networks.
Takeover of Oracle Outside In Technology 8.5.8 is possible for an attacker who already has a local logon on the host running the Outside In Clean Content SDK, with high confidentiality, integrity, and availability impact and no additional authentication or user interaction required. The flaw is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis; risk is concentrated where untrusted documents reach the Clean Content SDK on multi-user or otherwise locally exposed hosts.
Oracle Outside In Technology 8.5.8 contains a high-severity flaw in the Outside In Clean Content SDK that becomes exploitable when the SDK is embedded in an HTTP-facing service accepting attacker-supplied files for parsing or conversion. A low-privileged authenticated network attacker can exploit it without user interaction to achieve high confidentiality, integrity, and availability impact, with scope change extending the impact to the host product. No public exploit code or CISA KEV entry was identified at time of analysis.
Oracle Outside In Technology 8.5.8 can expose sensitive data to unauthenticated remote attackers when a host application embedding the Outside In Clean Content SDK parses an attacker-supplied document, producing high confidentiality impact and a scope change into the hosting product. The vendor CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), and no public exploit code or CISA KEV entry was identified at time of analysis.
Oracle Outside In Technology 8.5.8 (Outside In Clean Content SDK) can be driven into a hang or repeatable crash by a crafted document delivered over HTTP, giving remote unauthenticated attackers a complete denial of service against the affected parsing engine. The CVSS 3.1 score is 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so no credentials or user interaction are required, but the impact is confined to availability - no data disclosure or code execution results. Exploitation depends on a host application actually routing attacker-supplied files into the SDK's parsing path, so exposure is limited to deployments with document upload, conversion, content-cleaning, or inspection features; there is no CISA KEV listing, no public exploit code noted in the available data, and no EPSS score was supplied, so no active exploitation is confirmed at time of analysis.
Crashing or hanging Oracle Outside In Technology 8.5.8's Clean Content SDK is possible for unauthenticated remote attackers who can get a crafted document into an application that embeds the library, yielding availability-only impact at CVSS 7.5. Because the flaw lives in a document-parsing SDK rather than a standalone network service, real exposure depends entirely on whether a document-upload, conversion, or content-extraction feature is reachable over HTTP. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a bounded denial-of-service risk rather than a compromise or escalation threat.
Oracle Solaris 11.3 and 11.4 can be fully taken over by an attacker who can already log on to the host, through a flaw in the operating system's 'Utility' component. Exploitation yields high confidentiality, integrity and availability impact - effectively a complete loss of control of the Solaris system - but it requires a local foothold: the CVSS vector is AV:L, and our assessed vector (PR:L) indicates at least a low-privileged local account is needed, contrary to Oracle's PR:N labelling. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; with low attack complexity and no user interaction, however, the step from local access to full compromise is short.
Authenticated low-privileged attackers with HTTP access can exploit Oracle iSupport in E-Business Suite 12.2.3 through 12.2.15 to create, delete, or modify critical Service Request data and cause partial denial of service, with scope change potentially affecting other EBS products. The flaw is easily exploitable (CVSS 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L), and because iSupport is a customer-facing self-service portal, the required credentials may be broadly available. No public exploit was identified at the time of analysis.
Crafted-document processing in Oracle Outside In Technology 8.5.8 can let a remote unauthenticated attacker access or alter sensitive data when a victim opens or processes a malicious file in an application that embeds the Outside In Clean Content SDK. The CVSS 8.2 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, so HTTP delivery needs no credentials but exploitation depends on victim-side parsing, and the scope change means the real impact tracks the privileges of the host product. No public exploit was identified at time of analysis, and no KEV entry is indicated.
Denial of service in Oracle Outside In Technology 8.5.8 allows unauthenticated remote attackers to hang or repeatedly crash the Outside In Clean Content SDK by supplying crafted documents over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity network attack with availability-only impact, although real exposure depends on whether a host application exposes document ingestion to untrusted senders. No public exploit code or CISA KEV entry was provided at time of analysis.
A denial-of-service flaw in Oracle Outside In Clean Content SDK 8.5.8 (part of Oracle Fusion Middleware) lets remote attackers crash or hang the parsing engine by submitting a malformed document. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H), no authentication or user interaction is required once a crafted file reaches the parser, but the real gate is deployment exposure: the SDK is a library, so only services that ingest and convert untrusted documents are meaningfully reachable. Impact is availability-only - complete denial of service with no confidentiality or integrity loss; no public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Outside In Clean Content SDK 8.5.8, as embedded in Oracle Fusion Middleware and integrating products, can be made to create, modify, or delete critical data by unauthenticated remote attackers who can supply documents over HTTP to an application that parses them with the SDK. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) indicates no authentication or user interaction, with scope change extending impact to the integrating product, although confidentiality and availability are unaffected. No public exploit identified at time of analysis, and no CISA KEV listing is provided.
Oracle Outside In Technology 8.5.8, specifically the Outside In Clean Content SDK, can be compromised by a crafted document delivered over HTTP, enabling an unauthenticated remote attacker to create, delete, or modify critical data and read a limited subset of accessible data when a victim opens, uploads, or triggers conversion of the malicious file. The scope-change rating means exploitation can affect host applications and other products that embed the SDK, not just Outside In itself, although mandatory user interaction prevents unattended mass exploitation. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a credible mid-to-high priority issue rather than an emergency.
Unauthenticated network attackers can corrupt or destroy data and trigger a hang or repeated crash in Oracle Outside In Technology 8.5.8 through the Outside In Clean Content SDK when an embedding application parses attacker-supplied documents. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), with high integrity and availability impact but no confidentiality impact; no public exploit code was identified at time of analysis. Real-world exposure depends on whether a product embedding the SDK accepts untrusted files for ingestion, conversion, indexing, or preview.
Low-privileged authenticated remote attackers can achieve full takeover of applications that embed Oracle Outside In Clean Content SDK 8.5.8 by sending crafted content over HTTP, with high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw affects Oracle Fusion Middleware's Outside In Technology component, and real exposure depends on whether an integrating product accepts attacker-supplied files and passes them to the SDK. All available intelligence is vendor-sourced from Oracle's October 2026 Critical Patch Update; no public exploit code or confirmed active exploitation was identified at time of analysis.
Improper authorization in Oracle E-Business Suite iSupport (12.2.3 through 12.2.15) allows a low-privileged, authenticated user with HTTP network access to create, delete, or modify critical iSupport data and to read a limited subset of that data, yielding a CVSS 3.1 base score of 7.1 (C:L/I:H/A:N). Exploitation is considered easy (AC:L, UI:N) but is not pre-authentication: the attacker must already hold a valid low-privilege account, such as a registered self-service/customer user, despite the 'Authentication Bypass' tagging seen in intelligence feeds. No public exploit code or CISA KEV listing was identified at time of analysis, so this is a mid-to-high priority patching item rather than an emergency.
Unauthenticated network attackers can create, delete, modify, or read critical data in Oracle E-Business Suite iProcurement versions 12.2.3 through 12.2.15 by reaching the Internal Operations component over HTTPS. Oracle rates the issue difficult to exploit because of high attack complexity, meaning successful exploitation likely requires a specific server-side condition rather than a single deterministic request. No public exploit code or confirmed active exploitation was identified at time of analysis.
Local attackers who can log on to the infrastructure hosting JD Edwards EnterpriseOne Tools can exploit a flaw in the Deployment SEC component to achieve full takeover of the product, but only if they can persuade another user to perform an action on attacker-controlled input. The vulnerability affects versions 9.2.0.0 through 9.2.26.5 and carries a CVSS 3.1 base score of 7.8 with high impacts to confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, and the required host access plus user interaction make this a high-severity but not opportunistic remote threat, favoring insider or post-compromise scenarios.
Unauthenticated attackers positioned on the same physical network segment as a JD Edwards EnterpriseOne Tools host can potentially achieve full takeover of the product (confidentiality, integrity and availability all High) by exploiting a flaw in the Installation Security component of supported releases 9.2.0.0 through 9.2.26.5. The vendor-supplied CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N) means exploitation is not possible from the internet and is further gated by high attack complexity, so real-world priority is materially lower than the 7.5 base score suggests. No public exploit code, CISA KEV entry, or EPSS score was present in the available intelligence at time of analysis, and Oracle addresses the issue through its October 2026 Critical Patch Update advisory.
Adjacent-network attackers can exploit an installation-security weakness in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.4 to take over the product, provided a person other than the attacker performs a required interaction; no authentication is needed and the scope change means connected products may also be affected. The CVSS 3.1 score is 8.8, but exploitation is constrained by the AV:A adjacency requirement and UI:R human interaction. No public exploit identified at time of analysis and no CISA KEV entry is present in the available data.
Unauthenticated information disclosure in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 allows a network attacker to read critical data through the Installation Security component, with a CVSS 3.1 base score of 7.5. The flaw is low complexity and requires no credentials or user interaction, but impact is limited to confidentiality, with no integrity or availability effect. No public exploit was identified at time of analysis, and practical risk is concentrated on instances reachable over HTTP from an attacker's network position because JD Edwards EnterpriseOne is typically an internally deployed ERP.
Unauthenticated remote takeover of Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 is possible through the Core component, with a CVSS 9.8 vector requiring only HTTP network access and no credentials or user interaction. Successful exploitation yields high confidentiality, integrity, and availability impact, effectively handing the attacker control of the server. No public exploit identified at time of analysis, and no EPSS score was provided; Oracle's October 2026 Critical Patch Update advisory is the authoritative remediation source.
Low-privileged authenticated attackers can achieve full takeover of the Oracle iProcurement application (E-Business Suite 12.2.3 through 12.2.15) by reaching the Requisition Management component over HTTP, with high impact to confidentiality, integrity, and availability. The flaw is rated high complexity (AC:H) - Oracle describes it as 'difficult to exploit', meaning success depends on conditions such as specific configuration, timing, or data state rather than a single deterministic request - and requires a valid low-privileged session, so anonymous users cannot trigger it. No public exploit code has been identified and there is no CISA KEV listing at time of analysis, but because a compromised account yields application-level takeover, any provisioned iProcurement user should be treated as a potential launch point.
Oracle iProcurement's E-Content Manager Catalog component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes a high-privilege attack path: an authenticated attacker who already holds an elevated account can use HTTPS network access to take over the iProcurement application, with high confidentiality, integrity, and availability impact. CVSS 3.1 scores this 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting reliable exploitation once privileged credentials are obtained, with no user interaction required. No public exploit code or CISA KEV entry was identified in the provided intelligence, so the practical threat is a malicious or compromised privileged insider rather than an anonymous remote attacker.
Full compromise of JD Edwards EnterpriseOne Tools can be achieved by an attacker who can log on locally to the host running the Tools installation, provided a separate user or administrator performs a required action. This affects Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 and is scored CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis, and no CISA KEV entry was supplied; the local-access plus human-interaction prerequisites substantially narrow practical risk compared with a network-reachable flaw.
Takeover of JD Edwards EnterpriseOne Tools (Installation Security component, supported versions 9.2.0.0 through 9.2.26.5) is achievable by an attacker who already holds a logon on the host where the tooling executes, provided a second person - an operator or administrator - is tricked into a user-interaction step such as opening or processing attacker-supplied content. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but the combination of a local attack vector plus a mandatory human victim makes this a high-severity rather than high-urgency issue at this moment. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied with the source data.
Unauthenticated network attackers can achieve takeover of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.4 by exploiting a high-complexity flaw in the Installation Security component exposed over HTTP. Oracle rates the issue 8.1 with full confidentiality, integrity, and availability impact, but characterizes exploitation as difficult because additional conditions beyond the attacker's control must be met; no public exploit identified at time of analysis, and no CISA KEV entry was provided. Exposure is greatest where the Tools HTTP interface is broadly reachable.
Local privilege escalation in Oracle JD Edwards EnterpriseOne Tools (Installation Security component, versions 9.2.0.0 through 9.2.26.5) allows an attacker holding low-privileged logon access on the application host to take over the product, with high confidentiality, integrity, and availability impact (CVSS 7.8). Exploitation is not remote: it requires a local foothold and valid low-privileged credentials on the infrastructure where EnterpriseOne Tools runs, so the practical exposure is insider threat and post-exploitation escalation rather than an internet-facing emergency. No public exploit code has been identified at time of analysis.
An authenticated, low-privileged attacker with network access to the JDENET service can fully compromise JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5, gaining high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The defect sits in the Installation SEC component, and successful exploitation is described by Oracle as enabling takeover of the EnterpriseOne Tools instance. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low attack complexity and the fact that JDENET is frequently reachable across enterprise networks make this a credible operational priority rather than an inflated high-CVSS score.
Unauthenticated network attackers can read critical data from Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 via the Oracle Net communication layer (CVE-2026-91308), which Oracle rates as easily exploitable and assigns CVSS 3.1 7.5 HIGH. The flaw is a confidentiality-only authentication bypass in the Installation Security component: PR:N/UI:N with C:H, while integrity and availability are unaffected. No CISA KEV entry or public exploit code was identified in the supplied intelligence at time of analysis, so risk is highest where the Oracle Net listener is reachable from untrusted networks.
Unauthenticated network attackers can access critical data in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 by exploiting an Installation Security flaw reachable over Oracle Net. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) describes a low-complexity confidentiality-only issue with no integrity or availability impact. No public exploit code was identified at time of analysis, and the primary exposure constraint is whether Oracle Net/listener access is reachable from untrusted networks.
A high-severity local privilege escalation and takeover flaw exists in the Installation Security component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5). An attacker who already holds interactive logon access to the host running EnterpriseOne Tools and low-level credentials can exploit the component to gain full control of the application, with complete confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, AV:L/PR:L/AC:L/UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the requirement for pre-existing local access plus valid credentials is the primary limiting factor on real-world risk.
Unauthenticated attackers with HTTPS reachability to the Installation Security component in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can read and modify critical EnterpriseOne Tools data; availability is not impacted. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N), and Oracle's October 2026 Critical Patch Update is the cited advisory. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is highest for internet-exposed instances.
Local attackers who already hold logon access to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can achieve full takeover of the application through its Installation Security component, provided a legitimate operator is induced to perform an interactive step such as running an installer or configuration action. The 7.8 High CVSS 3.1 score (AV:L/AC:L/PR:N/UI:R) reflects high confidentiality, integrity and availability impact with no application-level credentials required, but the local-access and victim-interaction prerequisites confine realistic exploitation to insider or post-foothold scenarios rather than remote mass exploitation. No public exploit code and no CISA KEV entry were identified at time of analysis, so this sits well below network-facing criticals in prioritization.
Oracle JD Edwards EnterpriseOne Tools (Installation Security component) versions 9.2.0.0 through 9.2.26.5 can be taken over by a remote, unauthenticated attacker who convinces another user to interact with attacker-supplied content delivered over HTTP, yielding high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). The mandatory victim interaction (UI:R) means delivery depends on social engineering rather than a direct server-side hit, which limits automated mass exploitation. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible high-priority item rather than a drop-everything emergency; the fix ships in Oracle's October 2026 Critical Patch Update.
Unauthenticated remote takeover of JD Edwards EnterpriseOne Orchestrator affects versions 9.2.0.0 through 9.2.26.5, where a network attacker can compromise the E1 IOT Orchestrator Security component over HTTP without credentials or user interaction. The CVSS 3.1 score is 10.0 with scope change, meaning a successful attack can extend beyond the Orchestrator into additional connected EnterpriseOne products. No public exploit code or CISA KEV entry is identified at time of analysis, but the maximum severity, unauthenticated network vector, and broad version range make this a top remediation priority for exposed deployments.
Unauthenticated network attackers can achieve takeover of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 through the Enterprise Infrastructure SEC component, provided they first convince a legitimate user to interact with attacker-supplied content over HTTP. The CVSS 3.1 score is 8.8 with high confidentiality, integrity, and availability impact, while the UI:R requirement is the main practical barrier to exploitation. No public exploit code was identified at time of analysis and no KEV status is present in the supplied intelligence.
JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 contain a takeover-class vulnerability in the Enterprise Infrastructure SEC component that a low-privileged, network-positioned attacker can exploit over HTTP with no user interaction, yielding full confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8). Oracle's CPU October 2026 advisory frames it as easily exploitable, but the PR:L vector means valid low-privilege credentials are a prerequisite, so exposure is concentrated among insiders or attackers who already hold a foothold or stolen account. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied; an attacker who clears the authentication bar can compromise the JD Edwards EnterpriseOne Tools deployment itself.
JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 exposes an Interoperability SEC weakness over JDENET that can let unauthenticated network attackers read and alter critical application data. Oracle describes exploitation as difficult, with high attack complexity as the main barrier, and no public exploit identified at time of analysis or confirmed active exploitation (CISA KEV). Availability is not affected, but confidentiality and integrity impacts are high.
Unauthenticated attackers positioned on the same network segment as an Oracle JD Edwards EnterpriseOne Tools host can read and tamper with protected data through the Enterprise Infrastructure SEC component in supported releases 9.2.0.0 through 9.2.26.5. The flaw scores CVSS 3.1 base 8.1 (AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:N): once an attacker has layer-2 adjacency to the EnterpriseOne hardware, no credentials, user interaction, or special conditions are required, and the result is full loss of confidentiality and integrity of EnterpriseOne-accessible data with no availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven less by exploit maturity than by whether an organization exposes its EnterpriseOne host segment to untrusted or flat internal networks.
Compromise of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 allows unauthenticated attackers on the adjacent network segment to read critical data and make limited unauthorized modifications through the Monitoring and Diagnostics SEC component. The CVSS 8.2 severity reflects no credentials or user interaction and a scope change that can affect connected products, but exploitation requires Layer 2 adjacency rather than public-network reachability; no public exploit identified at time of analysis.
Unauthenticated remote attackers can read critical data from Oracle JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 through the component tracked as Object and Env Tech SEC, with the flaw classified as an authentication bypass affecting the HTTP-facing web tier. The CVSS 3.1 score of 8.6 reflects a network-reachable, low-complexity, no-privileges, no-user-interaction attack that is confidentiality-only but carries a scope change, so downstream systems trusting the Tools layer may also be exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, but the exposure-based risk is high where the JD Edwards HTTP interface is internet-facing or reachable from untrusted segments.
Oracle JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 expose an unauthenticated, network-reachable weakness in the Interoperability 'SEC' component that can let a remote attacker read, create, delete, or modify critical data over HTTPS, with no user interaction required and no availability impact. Oracle characterizes the flaw as 'difficult to exploit' (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning success depends on conditions outside the attacker's full control rather than a single deterministic request. No public exploit code has been identified at time of analysis, and the issue is addressed through the Oracle Critical Patch Update referenced in the advisory (October 2026).
Authentication bypass in Oracle JD Edwards EnterpriseOne Tools (Monitoring and Diagnostics SEC) lets a low-privileged attacker with network access over HTTP read and modify critical application data in versions 9.2.0.0 through 9.2.26.5. Exploitation requires a valid low-privileged account (PR:L), no user interaction, and low attack complexity, with high confidentiality and integrity impact but no availability impact. The provided intelligence identifies no public exploit code and no confirmed active exploitation; internet-exposed EnterpriseOne web tiers are the highest-risk deployments.
Low-privileged authenticated users can achieve full takeover of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) by sending crafted HTTP requests to the Monitoring and Diagnostics SEC component, gaining high impact across confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). No user interaction or elevated privileges are required - only a valid low-tier account and network reachability to the EnterpriseOne Tools HTTP interface - making any compromised or over-provisioned service account a viable launch point. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the low attack complexity and the pre-authentication-free path from a standard account to full compromise warrant prompt patching.
JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) allows a low-privileged authenticated attacker with HTTP network access to read and modify critical data through a flaw in the Enterprise Infrastructure SEC component, according to Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), with high confidentiality and integrity impact and no availability impact. No public exploit code or active exploitation has been identified at time of analysis, though the "Authentication Bypass" tag conflicts with the PR:L vector and should be confirmed with Oracle.
Authenticated low-privileged users with HTTP reachability to the JD Edwards EnterpriseOne Tools web tier can take full control of the Web Runtime SEC component in versions 9.2.0.0 through 9.2.26.5, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The barrier to entry is low: any valid non-administrative EnterpriseOne account plus network access to the HTML/web runtime is sufficient, with no user interaction and no non-default configuration precondition cited by Oracle. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but EPSS scoring was not available in the supplied intelligence, so prevalence-weighted risk should be treated as unquantified rather than low.
Unauthenticated SOAP requests to the JD Edwards EnterpriseOne Tools Interoperability SEC component can expose critical data in versions 9.2.0.0 through 9.2.26.5, with a scope change that may extend impact to connected products. The CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), and only confidentiality is affected; no public exploit identified at time of analysis. Risk is highest where the SOAP Interoperability service is deployed and reachable from untrusted networks.
Low-privileged local users with logon access to a JD Edwards EnterpriseOne Tools host can bypass authentication in the Monitoring and Diagnostics (SEC) component and gain read/write control over critical data. Affected releases are Tools 9.2.0.0 through 9.2.26.5; exploitation requires an existing interactive account on the server (CVSS vector AV:L/PR:L), so the realistic threat is insider abuse or an attacker operating after an initial foothold, not a remote mass-exploitation campaign. Impact is rated CVSS 8.4 because a scope change (S:C) lets the compromise spill into connected products and the underlying ERP data, though no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated HTTP access to JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can allow a remote attacker to read and alter critical application data, with CVSS 9.1 reflecting high confidentiality and integrity impact but no availability impact. The flaw is in the Enterprise Infrastructure SEC component and is rated PR:N/AC:L/UI:N, so the main practical barrier is network reachability to an affected instance; no public exploit was identified at time of analysis and no CISA KEV confirmation was provided. Oracle's October 2026 Critical Patch Update is the reference advisory for remediation.
High-privileged authenticated attackers can take over Oracle iProcurement 12.2.3 through 12.2.15 by sending crafted HTTP requests to the E-Content Manager Catalog component. The flaw is rated CVSS 7.2 with high confidentiality, integrity, and availability impact, but the PR:H vector means an attacker must already hold an elevated account on the E-Business Suite instance. No public exploit identified at time of analysis, and no KEV entry is provided.
Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 can be fully taken over by a low-privileged authenticated attacker who reaches the OIM Legacy UI over HTTP. The flaw is network-reachable, low complexity, and requires no user interaction, but it is not unauthenticated: any valid low-privilege account is enough. No public exploit was identified at the time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the available vendor reference.
Oracle Solaris 11.4 can be driven into a complete denial-of-service condition and made to expose a limited subset of accessible data by a low-privileged attacker who can reach the Services component over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) gives a 7.1 score: a valid low-privileged Solaris account is required, but no user interaction is needed and attack complexity is low, so exposure is greatest where low-level accounts are widely provisioned or the HTTP Services endpoint is reachable from untrusted networks. No public exploit identified at time of analysis, and there is no CISA KEV confirmation; this is a moderate-priority issue rather than a top-tier emergency, with Oracle's October 2026 Critical Patch Update as the fix reference.
Unauthenticated network attackers can cause a complete denial of service-hang or repeatable crash-against Oracle Solaris 11.4 by reaching an HTTP-handling service that routes into the vulnerable Kernel component. The flaw is rated CVSS 7.5 with availability-only impact (C:N/I:N/A:H) and, per the vector, requires no privileges or user interaction; it cannot be used for data theft or code execution. No public exploit or CISA KEV entry is identified in the provided data, so the practical risk is bounded by whether the exposed HTTP service is reachable from untrusted networks.
Unauthenticated network attackers can cause a hang or frequently repeatable crash of Oracle Solaris 11.4 by reaching the Kernel component through an HTTP-exposed path, producing a complete denial of service with no confidentiality or integrity impact. The CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code or CISA KEV entry was identified at time of analysis. Practical exposure is limited to systems where the vulnerable HTTP-handling path is reachable from untrusted networks.
Local privilege escalation in the Oracle Solaris 11.4 kernel lets an attacker who already holds a low-privileged logon on the host elevate to full control, compromising confidentiality, integrity, and availability. The flaw is local-only (AV:L) and requires a valid account (PR:L), but needs no user interaction and is low complexity, so a local user meeting the prerequisite can exploit it reliably. The provided intelligence does not confirm CISA KEV active exploitation or publicly available exploit code, so exploitation status is no public exploit identified at time of analysis.
Oracle Solaris 11.4 exposes an HTTP-reachable service in its Services component that remote unauthenticated attackers can exploit to crash or repeatedly hang the system (complete denial of service) and read a subset of accessible data. No authentication or user interaction is required, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) scores 8.2, with availability impact dominant and a secondary confidentiality leak; scope is unchanged, so impact stays confined to the Solaris host. No public exploit code or confirmed active exploitation was identified at time of analysis, and real-world urgency hinges primarily on whether the affected HTTP service is exposed beyond trusted management networks.
Remote takeover of Oracle SOA Suite is possible for low-privileged, authenticated attackers who can reach the Adapters component over HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0; Oracle rates it CVSS 9.9 because successful exploitation can also significantly affect connected products through scope change. No public exploit was identified at time of analysis, but the combination of low attack complexity, no user interaction, and high confidentiality, integrity, and availability impact makes this a high-priority patch target.
Low-privileged authenticated attackers with network access can take over Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through its Adapters component, with CVSS 9.9 and a scope change that can extend impact to connected Oracle products. Exploitation requires only low privileges and no user interaction, though authentication requirements keep fully unauthenticated attacks out of scope; no public exploit code or CISA KEV entry was identified at time of analysis. This is a high-priority issue because the Adapters interface is often network-exposed and the scope change can amplify a single compromise across integrated middleware.
Authenticated low-privileged attackers with network access to the Fabric Layer component of Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 can achieve high confidentiality and integrity impact, including creation, deletion, or modification of critical data and full read access to BPM Suite data, with scope change extending impact to additional Oracle products. The flaw requires a valid account (CVSS PR:L) but no user interaction and low attack complexity, making it easily exploitable once credentials are obtained. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Solaris 11.4 exposes a local attack path through its Plugins component in which an attacker who already holds high-privileged logon access must also obtain interaction from a different user, after which the attacker can read and modify critical Solaris data and potentially affect other products because the scope changes. CVSS 3.1 scores this at 7.4 with high confidentiality and integrity impact but no availability impact, making it serious for privileged local environments while remaining constrained by the PR:H and UI:R prerequisites. No public exploit was identified at time of analysis, and the Oracle October 2026 Critical Patch Update advisory is the available remediation reference.
Authenticated high-privileged attackers with network access can achieve full takeover of Oracle Business Intelligence Enterprise Edition 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 through the Analytics Web Administration component, with scope change extending impact to connected products. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); no public exploit identified at time of analysis.
Oracle SOA Suite Fabric Layer can be taken over by low-privileged remote attackers with network access, affecting releases 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 score of 8.8 reflects full confidentiality, integrity, and availability impact; exploitation requires a valid low-privilege account (PR:L), but no user interaction and low attack complexity make it straightforward once credentials or a session are obtained. Available intelligence does not identify public exploit code or CISA KEV active exploitation at time of analysis.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged attacker with HTTP access to the Fabric Layer to create, delete, or modify critical data and cause a partial denial of service. The CVSS 3.1 vector requires a valid low-privileged account (PR:L) but no user interaction, and confidentiality is not affected. No public exploit code or confirmed active exploitation was identified at time of analysis, so priority is driven by exposure of low-privilege SOA accounts and the HTTP interface.
Unauthenticated HTTP access to the Oracle SOA Suite Fabric Layer can disclose critical data in Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0. The flaw is network-reachable with low complexity and requires no privileges or user interaction (CVSS 3.1 base 7.5, confidentiality-only), and no public exploit code was identified at time of analysis. Real-world exposure is limited to deployments whose SOA Suite HTTP interface is reachable by untrusted networks.
Remote unauthenticated attackers can achieve takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer over HTTP, with the 9.8 CVSS reflecting high confidentiality, integrity, and availability impact and no privileges or user interaction required. No public exploit identified at time of analysis and no CISA KEV confirmation is present in the supplied data, but internet-reachable SOA Suite instances should be treated as high priority because the assessed vector is pre-authentication network exploitation.
Oracle SOA Suite releases 12.2.1.4.0 and 14.1.2.0.0 contain a critical flaw in the Fabric Layer component that can be reached over HTTP without any credentials, letting a remote attacker seize full control of the SOA Suite deployment. With a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation yields complete loss of confidentiality, integrity, and availability of the affected middleware, effectively a takeover of the product. There is no KEV listing and no public exploit identified at time of analysis, but the pre-authentication network vector and the fact that Oracle's Fabric Layer normally sits on an internet- or partner-facing service bus make this a top-tier patch priority; EPSS data was not supplied, and our independent assessment confirms the unauthenticated remote exploitation path with network reachability as the primary practical barrier.
Unauthenticated remote compromise of Oracle SOA Suite's Fabric Layer can lead to full takeover of the affected installation. The flaw affects SOA Suite 12.2.1.4.0 and 14.1.2.0.0 and is rated CVSS 9.8 with complete confidentiality, integrity, and availability impact; exploitation requires network access to the SOA Suite HTTP interface. No public exploit identified at time of analysis, and the main practical constraint is reachability rather than authentication or user interaction.
Oracle SOA Suite's Enterprise Scheduling System exposes a SOAP interface that unauthenticated remote attackers can reach on versions 12.2.1.4.0 and 14.1.2.0.0, allowing takeover of the product with high confidentiality, integrity, and availability impact. The 9.8 CVSS score and AV:N/AC:L/PR:N/UI:N vector make network reachability the primary exposure factor, so internet-facing or broadly reachable SOAP endpoints are the highest priority. No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 contain an easily exploitable Fabric Layer flaw that lets a low-privileged, network-positioned attacker take over the SOA Suite service over HTTP. Successful exploitation can also impact integrated products because the vulnerability changes scope, with high confidentiality, integrity, and availability impact; a low-privilege authenticated account is required. No public exploit code or CISA KEV entry was identified at the time of analysis.
Unauthenticated remote takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 is achievable through the Adapters component of Oracle Fusion Middleware, with Oracle assigning the maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No credentials, user interaction, or special preconditions are required beyond network reachability of the SOA Suite HTTP listener, and the scope-change rating means successful exploitation can cascade into connected or dependent products rather than being contained to the SOA Suite host. At the time of analysis there is no public exploit code or CISA KEV listing, but the combination of maximum severity, unauthenticated access, and low complexity makes this a top-priority patch item for any internet- or broadly internally reachable deployment.
Unauthenticated attackers who can reach the HTTP interface of Oracle SOA Suite's Fabric Layer can bypass authentication to read critical data and make limited unauthorized modifications in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the flaw 9.3 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N); the scope change indicates that a successful compromise can reach beyond SOA Suite into other Fusion Middleware components deployed in the same environment. No public exploit code or confirmed active exploitation was identified at time of analysis, but the absence of authentication, user-interaction, or complexity prerequisites makes this a high-priority patch target wherever the SOA HTTP interface is network-reachable.
Oracle SOA Suite's Fabric Layer can be taken over by a low-privileged attacker who already has authenticated network access via HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The high attack complexity (AC:H) means exploitation depends on conditions outside the attacker's direct control, and no public exploit was identified at time of analysis. The issue carries a 7.5 CVSS base score with high confidentiality, integrity, and availability impact.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 contain an improper access control weakness in the Fusion Middleware Fabric Layer that lets a low-privileged, network-positioned attacker read and partially modify data beyond their intended authorization. Exploitation is over HTTP, requires only a valid low-privilege account (PR:L) and no user interaction, yielding high confidentiality impact plus limited integrity impact for a CVSS 3.1 base score of 7.1 (High). No public exploit code or confirmed active exploitation was identified at time of analysis, though the low attack complexity and the prevalence of internet-facing SOA Suite consoles make exposed Fabric Layer endpoints an attractive target.
Authenticated attackers with only low privileges can achieve full takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer over HTTP, with high impact to confidentiality, integrity, and availability. Exploitation is rated difficult (CVSS AC:H) because specific conditions outside the attacker's control must align, and a valid low-privileged SOA Suite account is required (PR:L). No public exploit code or CISA KEV entry was identified in the available intelligence at time of analysis.
Low-privileged authenticated attackers with HTTP network access can achieve full takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through a flaw in the Fabric Layer component, with high impact to confidentiality, integrity and availability (CVSS 3.1 base score 7.5). The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U) means a valid low-privileged account is required and Oracle rates the flaw as difficult to exploit, so attack complexity and account provisioning are the main real-world barriers rather than the score alone. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle tracks the fix through its October 2026 Critical Patch Update.
Remote unauthenticated attackers who can reach the Adapters component of Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0 over HTTP can modify or delete critical data and cause a hang or frequently repeatable crash, producing a CVSS 9.1 integrity and availability impact. No public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data, but the low-complexity, no-privilege vector makes patching and reducing network exposure high priorities.
Low-privileged authenticated attackers can take full control of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer component reachable over HTTP, with a CVSS 3.1 base score of 9.9. The scope-change rating (S:C) means a successful compromise is not contained to the SOA Suite instance and can significantly impact additional connected products, so confidentiality, integrity and availability are all rated high. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the practical gate for attackers is possession of any valid low-privilege account plus network reachability of the SOA Suite HTTP interface.
Full takeover of Oracle SOA Suite is achievable by authenticated low-privilege attackers who can reach the Fabric Layer over HTTP in versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is network-reachable, low-complexity, and requires no user interaction, with high confidentiality, integrity, and availability impact once a valid low-privilege account is obtained. No public exploit code or CISA KEV entry is identified in the supplied intelligence; vendor fixes are referenced through Oracle's October 2026 Critical Patch Update advisory.
Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised by a low-privileged, authenticated remote attacker exploiting the Human Workflow (11g+) component over SOAP, with a scope change that may extend impact to additional products. Successful exploitation can result in takeover of the BPM Suite with high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, but the low attack complexity and high impact make this a priority patching target.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 are exposed to unauthenticated remote takeover through the Fabric Layer component reachable via T3 and IIOP. An attacker with network access can exploit the flaw without credentials or user interaction to achieve high confidentiality, integrity, and availability impact; the changed scope means interconnected products may also be affected. No public exploit identified at time of analysis, and the supplied intelligence does not indicate CISA KEV listing, but the unauthenticated network vector and CVSS 10.0 score make this a top-priority exposure for internet- or broadly reachable T3/IIOP listeners.
Unauthenticated remote takeover of Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Human Workflow component exposed over HTTP. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or non-default configuration are required beyond network reachability. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle's October 2026 Critical Patch Update advisory is the authoritative fix source.
Unauthenticated HTTP access to the Oracle SOA Suite Fabric Layer can expose critical data and, because of a scope change, may affect integrated products that trust SOA Suite. The flaw affects Oracle Fusion Middleware SOA Suite 12.2.1.4.0 and 14.1.2.0.0 and is rated CVSS 8.6 with confidentiality-only impact. No public exploit was identified at time of analysis.
Local low-privilege users with a logon to the infrastructure hosting Oracle HTTP Server 12.2.1.4.0 can exploit the OSSL module to take full control of the HTTP Server, with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) confirms the attack is local, requires an authenticated low-privileged account, needs no user interaction, and has low complexity once that access exists. No public exploit identified at time of analysis, and no confirmed active exploitation was provided in the intelligence.
Oracle Java SE (8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27), GraalVM for JDK 17.0.20.1/21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1 contain a moderate-priority, difficult-to-exploit flaw in the 2D component that unauthenticated remote attackers can reach through APIs processing attacker-supplied data. Successful exploitation can repeatedly hang or crash the JVM (complete denial of service) and may allow limited unauthorized reads and updates of accessible data. No public exploit code or CISA KEV entry was identified at time of analysis; Oracle addresses the issue in its October 2026 Critical Patch Update.
Remote, unauthenticated takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 is possible when attackers can reach the T3 or IIOP listener used by the End User Self Service component. Oracle rates this 9.8 with no credentials, no user interaction, and no non-default configuration required, so default deployments are exposed if those protocols are network-reachable. No public exploit was identified at time of analysis, but risk is highest where T3/IIOP are internet-facing or broadly reachable from untrusted segments.
Privilege escalation through the REST WebServices component of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged authenticated attacker with HTTP network access to take over the OIM deployment, with high confidentiality, integrity and availability impact (CVSS 8.8). Exploitation requires a valid low-privilege account on the target instance (PR:L) but no user interaction and only low attack complexity, so exposure hinges on whether the REST interface is reachable by untrusted networks. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied with the source data.
Oracle Outside In PDF Export SDK 8.5.8 (part of Oracle Fusion Middleware) can be fully compromised - confidentiality, integrity, and availability all high - when a third-party application that embeds the SDK processes a maliciously crafted document. The vulnerability is unauthenticated and network-reachable over HTTP, but Oracle rates it difficult to exploit and it requires a human other than the attacker to trigger parsing of the malicious file, so practical exposure depends entirely on whether a reachable service feeds untrusted documents into the PDF Export component. No public exploit code or confirmed active exploitation was identified at time of analysis; the 7.5 score reflects the high impact and the AC:H/UI:R preconditions rather than demonstrated weaponization.
Takeover of Oracle Outside In Technology 8.5.8 can occur when a victim-side application processes a crafted document through the Outside In PDF Export SDK. The flaw is network-reachable but requires human interaction and high attack complexity, and no public exploit has been identified at time of analysis. This is a moderate-priority issue concentrated in deployments that feed untrusted files into Outside In.
Unauthenticated network attackers can read critical data from Oracle Siebel CRM Integration's Open Integration component in versions 25.12 through 26.9 over HTTP, with CVSS 3.1 base score 7.5 reflecting high confidentiality impact and no integrity or availability impact. Exploitation requires only that the integration HTTP endpoint be reachable, since the assessed vector is PR:N/UI:N with low attack complexity. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Oracle BPM Suite 12.2.1.4.0 and 14.1.2.0.0 expose the Case Management Service (11g+) to unauthenticated, low-complexity HTTP attacks that can read critical data and make limited unauthorized changes. Oracle rates the issue 8.2 (High) with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, meaning no credentials or user interaction are required against a reachable instance. No public exploit was identified at time of analysis, so exposure is primarily a function of whether the BPM Suite HTTP interface is reachable from untrusted networks.
Takeover of Oracle Outside In Technology 8.5.8 is possible for an attacker who already has a local logon on the host running the Outside In Clean Content SDK, with high confidentiality, integrity, and availability impact and no additional authentication or user interaction required. The flaw is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis; risk is concentrated where untrusted documents reach the Clean Content SDK on multi-user or otherwise locally exposed hosts.
Oracle Outside In Technology 8.5.8 contains a high-severity flaw in the Outside In Clean Content SDK that becomes exploitable when the SDK is embedded in an HTTP-facing service accepting attacker-supplied files for parsing or conversion. A low-privileged authenticated network attacker can exploit it without user interaction to achieve high confidentiality, integrity, and availability impact, with scope change extending the impact to the host product. No public exploit code or CISA KEV entry was identified at time of analysis.
Oracle Outside In Technology 8.5.8 can expose sensitive data to unauthenticated remote attackers when a host application embedding the Outside In Clean Content SDK parses an attacker-supplied document, producing high confidentiality impact and a scope change into the hosting product. The vendor CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), and no public exploit code or CISA KEV entry was identified at time of analysis.
Oracle Outside In Technology 8.5.8 (Outside In Clean Content SDK) can be driven into a hang or repeatable crash by a crafted document delivered over HTTP, giving remote unauthenticated attackers a complete denial of service against the affected parsing engine. The CVSS 3.1 score is 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so no credentials or user interaction are required, but the impact is confined to availability - no data disclosure or code execution results. Exploitation depends on a host application actually routing attacker-supplied files into the SDK's parsing path, so exposure is limited to deployments with document upload, conversion, content-cleaning, or inspection features; there is no CISA KEV listing, no public exploit code noted in the available data, and no EPSS score was supplied, so no active exploitation is confirmed at time of analysis.
Crashing or hanging Oracle Outside In Technology 8.5.8's Clean Content SDK is possible for unauthenticated remote attackers who can get a crafted document into an application that embeds the library, yielding availability-only impact at CVSS 7.5. Because the flaw lives in a document-parsing SDK rather than a standalone network service, real exposure depends entirely on whether a document-upload, conversion, or content-extraction feature is reachable over HTTP. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a bounded denial-of-service risk rather than a compromise or escalation threat.
Oracle Solaris 11.3 and 11.4 can be fully taken over by an attacker who can already log on to the host, through a flaw in the operating system's 'Utility' component. Exploitation yields high confidentiality, integrity and availability impact - effectively a complete loss of control of the Solaris system - but it requires a local foothold: the CVSS vector is AV:L, and our assessed vector (PR:L) indicates at least a low-privileged local account is needed, contrary to Oracle's PR:N labelling. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; with low attack complexity and no user interaction, however, the step from local access to full compromise is short.
Authenticated low-privileged attackers with HTTP access can exploit Oracle iSupport in E-Business Suite 12.2.3 through 12.2.15 to create, delete, or modify critical Service Request data and cause partial denial of service, with scope change potentially affecting other EBS products. The flaw is easily exploitable (CVSS 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L), and because iSupport is a customer-facing self-service portal, the required credentials may be broadly available. No public exploit was identified at the time of analysis.
Crafted-document processing in Oracle Outside In Technology 8.5.8 can let a remote unauthenticated attacker access or alter sensitive data when a victim opens or processes a malicious file in an application that embeds the Outside In Clean Content SDK. The CVSS 8.2 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, so HTTP delivery needs no credentials but exploitation depends on victim-side parsing, and the scope change means the real impact tracks the privileges of the host product. No public exploit was identified at time of analysis, and no KEV entry is indicated.
Denial of service in Oracle Outside In Technology 8.5.8 allows unauthenticated remote attackers to hang or repeatedly crash the Outside In Clean Content SDK by supplying crafted documents over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity network attack with availability-only impact, although real exposure depends on whether a host application exposes document ingestion to untrusted senders. No public exploit code or CISA KEV entry was provided at time of analysis.
A denial-of-service flaw in Oracle Outside In Clean Content SDK 8.5.8 (part of Oracle Fusion Middleware) lets remote attackers crash or hang the parsing engine by submitting a malformed document. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H), no authentication or user interaction is required once a crafted file reaches the parser, but the real gate is deployment exposure: the SDK is a library, so only services that ingest and convert untrusted documents are meaningfully reachable. Impact is availability-only - complete denial of service with no confidentiality or integrity loss; no public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Outside In Clean Content SDK 8.5.8, as embedded in Oracle Fusion Middleware and integrating products, can be made to create, modify, or delete critical data by unauthenticated remote attackers who can supply documents over HTTP to an application that parses them with the SDK. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) indicates no authentication or user interaction, with scope change extending impact to the integrating product, although confidentiality and availability are unaffected. No public exploit identified at time of analysis, and no CISA KEV listing is provided.
Oracle Outside In Technology 8.5.8, specifically the Outside In Clean Content SDK, can be compromised by a crafted document delivered over HTTP, enabling an unauthenticated remote attacker to create, delete, or modify critical data and read a limited subset of accessible data when a victim opens, uploads, or triggers conversion of the malicious file. The scope-change rating means exploitation can affect host applications and other products that embed the SDK, not just Outside In itself, although mandatory user interaction prevents unattended mass exploitation. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a credible mid-to-high priority issue rather than an emergency.
Unauthenticated network attackers can corrupt or destroy data and trigger a hang or repeated crash in Oracle Outside In Technology 8.5.8 through the Outside In Clean Content SDK when an embedding application parses attacker-supplied documents. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), with high integrity and availability impact but no confidentiality impact; no public exploit code was identified at time of analysis. Real-world exposure depends on whether a product embedding the SDK accepts untrusted files for ingestion, conversion, indexing, or preview.
Low-privileged authenticated remote attackers can achieve full takeover of applications that embed Oracle Outside In Clean Content SDK 8.5.8 by sending crafted content over HTTP, with high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw affects Oracle Fusion Middleware's Outside In Technology component, and real exposure depends on whether an integrating product accepts attacker-supplied files and passes them to the SDK. All available intelligence is vendor-sourced from Oracle's October 2026 Critical Patch Update; no public exploit code or confirmed active exploitation was identified at time of analysis.
Improper authorization in Oracle E-Business Suite iSupport (12.2.3 through 12.2.15) allows a low-privileged, authenticated user with HTTP network access to create, delete, or modify critical iSupport data and to read a limited subset of that data, yielding a CVSS 3.1 base score of 7.1 (C:L/I:H/A:N). Exploitation is considered easy (AC:L, UI:N) but is not pre-authentication: the attacker must already hold a valid low-privilege account, such as a registered self-service/customer user, despite the 'Authentication Bypass' tagging seen in intelligence feeds. No public exploit code or CISA KEV listing was identified at time of analysis, so this is a mid-to-high priority patching item rather than an emergency.
Unauthenticated network attackers can create, delete, modify, or read critical data in Oracle E-Business Suite iProcurement versions 12.2.3 through 12.2.15 by reaching the Internal Operations component over HTTPS. Oracle rates the issue difficult to exploit because of high attack complexity, meaning successful exploitation likely requires a specific server-side condition rather than a single deterministic request. No public exploit code or confirmed active exploitation was identified at time of analysis.
Local attackers who can log on to the infrastructure hosting JD Edwards EnterpriseOne Tools can exploit a flaw in the Deployment SEC component to achieve full takeover of the product, but only if they can persuade another user to perform an action on attacker-controlled input. The vulnerability affects versions 9.2.0.0 through 9.2.26.5 and carries a CVSS 3.1 base score of 7.8 with high impacts to confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, and the required host access plus user interaction make this a high-severity but not opportunistic remote threat, favoring insider or post-compromise scenarios.
Unauthenticated attackers positioned on the same physical network segment as a JD Edwards EnterpriseOne Tools host can potentially achieve full takeover of the product (confidentiality, integrity and availability all High) by exploiting a flaw in the Installation Security component of supported releases 9.2.0.0 through 9.2.26.5. The vendor-supplied CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N) means exploitation is not possible from the internet and is further gated by high attack complexity, so real-world priority is materially lower than the 7.5 base score suggests. No public exploit code, CISA KEV entry, or EPSS score was present in the available intelligence at time of analysis, and Oracle addresses the issue through its October 2026 Critical Patch Update advisory.
Adjacent-network attackers can exploit an installation-security weakness in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.4 to take over the product, provided a person other than the attacker performs a required interaction; no authentication is needed and the scope change means connected products may also be affected. The CVSS 3.1 score is 8.8, but exploitation is constrained by the AV:A adjacency requirement and UI:R human interaction. No public exploit identified at time of analysis and no CISA KEV entry is present in the available data.
Unauthenticated information disclosure in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 allows a network attacker to read critical data through the Installation Security component, with a CVSS 3.1 base score of 7.5. The flaw is low complexity and requires no credentials or user interaction, but impact is limited to confidentiality, with no integrity or availability effect. No public exploit was identified at time of analysis, and practical risk is concentrated on instances reachable over HTTP from an attacker's network position because JD Edwards EnterpriseOne is typically an internally deployed ERP.
Unauthenticated remote takeover of Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 is possible through the Core component, with a CVSS 9.8 vector requiring only HTTP network access and no credentials or user interaction. Successful exploitation yields high confidentiality, integrity, and availability impact, effectively handing the attacker control of the server. No public exploit identified at time of analysis, and no EPSS score was provided; Oracle's October 2026 Critical Patch Update advisory is the authoritative remediation source.
Low-privileged authenticated attackers can achieve full takeover of the Oracle iProcurement application (E-Business Suite 12.2.3 through 12.2.15) by reaching the Requisition Management component over HTTP, with high impact to confidentiality, integrity, and availability. The flaw is rated high complexity (AC:H) - Oracle describes it as 'difficult to exploit', meaning success depends on conditions such as specific configuration, timing, or data state rather than a single deterministic request - and requires a valid low-privileged session, so anonymous users cannot trigger it. No public exploit code has been identified and there is no CISA KEV listing at time of analysis, but because a compromised account yields application-level takeover, any provisioned iProcurement user should be treated as a potential launch point.
Oracle iProcurement's E-Content Manager Catalog component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes a high-privilege attack path: an authenticated attacker who already holds an elevated account can use HTTPS network access to take over the iProcurement application, with high confidentiality, integrity, and availability impact. CVSS 3.1 scores this 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting reliable exploitation once privileged credentials are obtained, with no user interaction required. No public exploit code or CISA KEV entry was identified in the provided intelligence, so the practical threat is a malicious or compromised privileged insider rather than an anonymous remote attacker.
Full compromise of JD Edwards EnterpriseOne Tools can be achieved by an attacker who can log on locally to the host running the Tools installation, provided a separate user or administrator performs a required action. This affects Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 and is scored CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis, and no CISA KEV entry was supplied; the local-access plus human-interaction prerequisites substantially narrow practical risk compared with a network-reachable flaw.
Takeover of JD Edwards EnterpriseOne Tools (Installation Security component, supported versions 9.2.0.0 through 9.2.26.5) is achievable by an attacker who already holds a logon on the host where the tooling executes, provided a second person - an operator or administrator - is tricked into a user-interaction step such as opening or processing attacker-supplied content. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but the combination of a local attack vector plus a mandatory human victim makes this a high-severity rather than high-urgency issue at this moment. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied with the source data.
Unauthenticated network attackers can achieve takeover of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.4 by exploiting a high-complexity flaw in the Installation Security component exposed over HTTP. Oracle rates the issue 8.1 with full confidentiality, integrity, and availability impact, but characterizes exploitation as difficult because additional conditions beyond the attacker's control must be met; no public exploit identified at time of analysis, and no CISA KEV entry was provided. Exposure is greatest where the Tools HTTP interface is broadly reachable.
Local privilege escalation in Oracle JD Edwards EnterpriseOne Tools (Installation Security component, versions 9.2.0.0 through 9.2.26.5) allows an attacker holding low-privileged logon access on the application host to take over the product, with high confidentiality, integrity, and availability impact (CVSS 7.8). Exploitation is not remote: it requires a local foothold and valid low-privileged credentials on the infrastructure where EnterpriseOne Tools runs, so the practical exposure is insider threat and post-exploitation escalation rather than an internet-facing emergency. No public exploit code has been identified at time of analysis.
An authenticated, low-privileged attacker with network access to the JDENET service can fully compromise JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5, gaining high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The defect sits in the Installation SEC component, and successful exploitation is described by Oracle as enabling takeover of the EnterpriseOne Tools instance. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low attack complexity and the fact that JDENET is frequently reachable across enterprise networks make this a credible operational priority rather than an inflated high-CVSS score.
Unauthenticated network attackers can read critical data from Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 via the Oracle Net communication layer (CVE-2026-91308), which Oracle rates as easily exploitable and assigns CVSS 3.1 7.5 HIGH. The flaw is a confidentiality-only authentication bypass in the Installation Security component: PR:N/UI:N with C:H, while integrity and availability are unaffected. No CISA KEV entry or public exploit code was identified in the supplied intelligence at time of analysis, so risk is highest where the Oracle Net listener is reachable from untrusted networks.
Unauthenticated network attackers can access critical data in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 by exploiting an Installation Security flaw reachable over Oracle Net. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) describes a low-complexity confidentiality-only issue with no integrity or availability impact. No public exploit code was identified at time of analysis, and the primary exposure constraint is whether Oracle Net/listener access is reachable from untrusted networks.
A high-severity local privilege escalation and takeover flaw exists in the Installation Security component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5). An attacker who already holds interactive logon access to the host running EnterpriseOne Tools and low-level credentials can exploit the component to gain full control of the application, with complete confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, AV:L/PR:L/AC:L/UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the requirement for pre-existing local access plus valid credentials is the primary limiting factor on real-world risk.
Unauthenticated attackers with HTTPS reachability to the Installation Security component in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can read and modify critical EnterpriseOne Tools data; availability is not impacted. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N), and Oracle's October 2026 Critical Patch Update is the cited advisory. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is highest for internet-exposed instances.
Local attackers who already hold logon access to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can achieve full takeover of the application through its Installation Security component, provided a legitimate operator is induced to perform an interactive step such as running an installer or configuration action. The 7.8 High CVSS 3.1 score (AV:L/AC:L/PR:N/UI:R) reflects high confidentiality, integrity and availability impact with no application-level credentials required, but the local-access and victim-interaction prerequisites confine realistic exploitation to insider or post-foothold scenarios rather than remote mass exploitation. No public exploit code and no CISA KEV entry were identified at time of analysis, so this sits well below network-facing criticals in prioritization.
Oracle JD Edwards EnterpriseOne Tools (Installation Security component) versions 9.2.0.0 through 9.2.26.5 can be taken over by a remote, unauthenticated attacker who convinces another user to interact with attacker-supplied content delivered over HTTP, yielding high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). The mandatory victim interaction (UI:R) means delivery depends on social engineering rather than a direct server-side hit, which limits automated mass exploitation. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible high-priority item rather than a drop-everything emergency; the fix ships in Oracle's October 2026 Critical Patch Update.
Unauthenticated remote takeover of JD Edwards EnterpriseOne Orchestrator affects versions 9.2.0.0 through 9.2.26.5, where a network attacker can compromise the E1 IOT Orchestrator Security component over HTTP without credentials or user interaction. The CVSS 3.1 score is 10.0 with scope change, meaning a successful attack can extend beyond the Orchestrator into additional connected EnterpriseOne products. No public exploit code or CISA KEV entry is identified at time of analysis, but the maximum severity, unauthenticated network vector, and broad version range make this a top remediation priority for exposed deployments.
Unauthenticated network attackers can achieve takeover of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 through the Enterprise Infrastructure SEC component, provided they first convince a legitimate user to interact with attacker-supplied content over HTTP. The CVSS 3.1 score is 8.8 with high confidentiality, integrity, and availability impact, while the UI:R requirement is the main practical barrier to exploitation. No public exploit code was identified at time of analysis and no KEV status is present in the supplied intelligence.
JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 contain a takeover-class vulnerability in the Enterprise Infrastructure SEC component that a low-privileged, network-positioned attacker can exploit over HTTP with no user interaction, yielding full confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8). Oracle's CPU October 2026 advisory frames it as easily exploitable, but the PR:L vector means valid low-privilege credentials are a prerequisite, so exposure is concentrated among insiders or attackers who already hold a foothold or stolen account. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied; an attacker who clears the authentication bar can compromise the JD Edwards EnterpriseOne Tools deployment itself.
JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 exposes an Interoperability SEC weakness over JDENET that can let unauthenticated network attackers read and alter critical application data. Oracle describes exploitation as difficult, with high attack complexity as the main barrier, and no public exploit identified at time of analysis or confirmed active exploitation (CISA KEV). Availability is not affected, but confidentiality and integrity impacts are high.
Unauthenticated attackers positioned on the same network segment as an Oracle JD Edwards EnterpriseOne Tools host can read and tamper with protected data through the Enterprise Infrastructure SEC component in supported releases 9.2.0.0 through 9.2.26.5. The flaw scores CVSS 3.1 base 8.1 (AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:N): once an attacker has layer-2 adjacency to the EnterpriseOne hardware, no credentials, user interaction, or special conditions are required, and the result is full loss of confidentiality and integrity of EnterpriseOne-accessible data with no availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven less by exploit maturity than by whether an organization exposes its EnterpriseOne host segment to untrusted or flat internal networks.
Compromise of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 allows unauthenticated attackers on the adjacent network segment to read critical data and make limited unauthorized modifications through the Monitoring and Diagnostics SEC component. The CVSS 8.2 severity reflects no credentials or user interaction and a scope change that can affect connected products, but exploitation requires Layer 2 adjacency rather than public-network reachability; no public exploit identified at time of analysis.
Unauthenticated remote attackers can read critical data from Oracle JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 through the component tracked as Object and Env Tech SEC, with the flaw classified as an authentication bypass affecting the HTTP-facing web tier. The CVSS 3.1 score of 8.6 reflects a network-reachable, low-complexity, no-privileges, no-user-interaction attack that is confidentiality-only but carries a scope change, so downstream systems trusting the Tools layer may also be exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, but the exposure-based risk is high where the JD Edwards HTTP interface is internet-facing or reachable from untrusted segments.
Oracle JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 expose an unauthenticated, network-reachable weakness in the Interoperability 'SEC' component that can let a remote attacker read, create, delete, or modify critical data over HTTPS, with no user interaction required and no availability impact. Oracle characterizes the flaw as 'difficult to exploit' (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning success depends on conditions outside the attacker's full control rather than a single deterministic request. No public exploit code has been identified at time of analysis, and the issue is addressed through the Oracle Critical Patch Update referenced in the advisory (October 2026).
Authentication bypass in Oracle JD Edwards EnterpriseOne Tools (Monitoring and Diagnostics SEC) lets a low-privileged attacker with network access over HTTP read and modify critical application data in versions 9.2.0.0 through 9.2.26.5. Exploitation requires a valid low-privileged account (PR:L), no user interaction, and low attack complexity, with high confidentiality and integrity impact but no availability impact. The provided intelligence identifies no public exploit code and no confirmed active exploitation; internet-exposed EnterpriseOne web tiers are the highest-risk deployments.
Low-privileged authenticated users can achieve full takeover of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) by sending crafted HTTP requests to the Monitoring and Diagnostics SEC component, gaining high impact across confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). No user interaction or elevated privileges are required - only a valid low-tier account and network reachability to the EnterpriseOne Tools HTTP interface - making any compromised or over-provisioned service account a viable launch point. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the low attack complexity and the pre-authentication-free path from a standard account to full compromise warrant prompt patching.
JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) allows a low-privileged authenticated attacker with HTTP network access to read and modify critical data through a flaw in the Enterprise Infrastructure SEC component, according to Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), with high confidentiality and integrity impact and no availability impact. No public exploit code or active exploitation has been identified at time of analysis, though the "Authentication Bypass" tag conflicts with the PR:L vector and should be confirmed with Oracle.
Authenticated low-privileged users with HTTP reachability to the JD Edwards EnterpriseOne Tools web tier can take full control of the Web Runtime SEC component in versions 9.2.0.0 through 9.2.26.5, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The barrier to entry is low: any valid non-administrative EnterpriseOne account plus network access to the HTML/web runtime is sufficient, with no user interaction and no non-default configuration precondition cited by Oracle. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but EPSS scoring was not available in the supplied intelligence, so prevalence-weighted risk should be treated as unquantified rather than low.
Unauthenticated SOAP requests to the JD Edwards EnterpriseOne Tools Interoperability SEC component can expose critical data in versions 9.2.0.0 through 9.2.26.5, with a scope change that may extend impact to connected products. The CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), and only confidentiality is affected; no public exploit identified at time of analysis. Risk is highest where the SOAP Interoperability service is deployed and reachable from untrusted networks.
Low-privileged local users with logon access to a JD Edwards EnterpriseOne Tools host can bypass authentication in the Monitoring and Diagnostics (SEC) component and gain read/write control over critical data. Affected releases are Tools 9.2.0.0 through 9.2.26.5; exploitation requires an existing interactive account on the server (CVSS vector AV:L/PR:L), so the realistic threat is insider abuse or an attacker operating after an initial foothold, not a remote mass-exploitation campaign. Impact is rated CVSS 8.4 because a scope change (S:C) lets the compromise spill into connected products and the underlying ERP data, though no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated HTTP access to JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can allow a remote attacker to read and alter critical application data, with CVSS 9.1 reflecting high confidentiality and integrity impact but no availability impact. The flaw is in the Enterprise Infrastructure SEC component and is rated PR:N/AC:L/UI:N, so the main practical barrier is network reachability to an affected instance; no public exploit was identified at time of analysis and no CISA KEV confirmation was provided. Oracle's October 2026 Critical Patch Update is the reference advisory for remediation.
High-privileged authenticated attackers can take over Oracle iProcurement 12.2.3 through 12.2.15 by sending crafted HTTP requests to the E-Content Manager Catalog component. The flaw is rated CVSS 7.2 with high confidentiality, integrity, and availability impact, but the PR:H vector means an attacker must already hold an elevated account on the E-Business Suite instance. No public exploit identified at time of analysis, and no KEV entry is provided.
Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 can be fully taken over by a low-privileged authenticated attacker who reaches the OIM Legacy UI over HTTP. The flaw is network-reachable, low complexity, and requires no user interaction, but it is not unauthenticated: any valid low-privilege account is enough. No public exploit was identified at the time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the available vendor reference.
Oracle Solaris 11.4 can be driven into a complete denial-of-service condition and made to expose a limited subset of accessible data by a low-privileged attacker who can reach the Services component over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) gives a 7.1 score: a valid low-privileged Solaris account is required, but no user interaction is needed and attack complexity is low, so exposure is greatest where low-level accounts are widely provisioned or the HTTP Services endpoint is reachable from untrusted networks. No public exploit identified at time of analysis, and there is no CISA KEV confirmation; this is a moderate-priority issue rather than a top-tier emergency, with Oracle's October 2026 Critical Patch Update as the fix reference.
Unauthenticated network attackers can cause a complete denial of service-hang or repeatable crash-against Oracle Solaris 11.4 by reaching an HTTP-handling service that routes into the vulnerable Kernel component. The flaw is rated CVSS 7.5 with availability-only impact (C:N/I:N/A:H) and, per the vector, requires no privileges or user interaction; it cannot be used for data theft or code execution. No public exploit or CISA KEV entry is identified in the provided data, so the practical risk is bounded by whether the exposed HTTP service is reachable from untrusted networks.
Unauthenticated network attackers can cause a hang or frequently repeatable crash of Oracle Solaris 11.4 by reaching the Kernel component through an HTTP-exposed path, producing a complete denial of service with no confidentiality or integrity impact. The CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code or CISA KEV entry was identified at time of analysis. Practical exposure is limited to systems where the vulnerable HTTP-handling path is reachable from untrusted networks.
Local privilege escalation in the Oracle Solaris 11.4 kernel lets an attacker who already holds a low-privileged logon on the host elevate to full control, compromising confidentiality, integrity, and availability. The flaw is local-only (AV:L) and requires a valid account (PR:L), but needs no user interaction and is low complexity, so a local user meeting the prerequisite can exploit it reliably. The provided intelligence does not confirm CISA KEV active exploitation or publicly available exploit code, so exploitation status is no public exploit identified at time of analysis.
Oracle Solaris 11.4 exposes an HTTP-reachable service in its Services component that remote unauthenticated attackers can exploit to crash or repeatedly hang the system (complete denial of service) and read a subset of accessible data. No authentication or user interaction is required, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) scores 8.2, with availability impact dominant and a secondary confidentiality leak; scope is unchanged, so impact stays confined to the Solaris host. No public exploit code or confirmed active exploitation was identified at time of analysis, and real-world urgency hinges primarily on whether the affected HTTP service is exposed beyond trusted management networks.
Remote takeover of Oracle SOA Suite is possible for low-privileged, authenticated attackers who can reach the Adapters component over HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0; Oracle rates it CVSS 9.9 because successful exploitation can also significantly affect connected products through scope change. No public exploit was identified at time of analysis, but the combination of low attack complexity, no user interaction, and high confidentiality, integrity, and availability impact makes this a high-priority patch target.
Low-privileged authenticated attackers with network access can take over Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through its Adapters component, with CVSS 9.9 and a scope change that can extend impact to connected Oracle products. Exploitation requires only low privileges and no user interaction, though authentication requirements keep fully unauthenticated attacks out of scope; no public exploit code or CISA KEV entry was identified at time of analysis. This is a high-priority issue because the Adapters interface is often network-exposed and the scope change can amplify a single compromise across integrated middleware.
Authenticated low-privileged attackers with network access to the Fabric Layer component of Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 can achieve high confidentiality and integrity impact, including creation, deletion, or modification of critical data and full read access to BPM Suite data, with scope change extending impact to additional Oracle products. The flaw requires a valid account (CVSS PR:L) but no user interaction and low attack complexity, making it easily exploitable once credentials are obtained. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Solaris 11.4 exposes a local attack path through its Plugins component in which an attacker who already holds high-privileged logon access must also obtain interaction from a different user, after which the attacker can read and modify critical Solaris data and potentially affect other products because the scope changes. CVSS 3.1 scores this at 7.4 with high confidentiality and integrity impact but no availability impact, making it serious for privileged local environments while remaining constrained by the PR:H and UI:R prerequisites. No public exploit was identified at time of analysis, and the Oracle October 2026 Critical Patch Update advisory is the available remediation reference.
Authenticated high-privileged attackers with network access can achieve full takeover of Oracle Business Intelligence Enterprise Edition 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 through the Analytics Web Administration component, with scope change extending impact to connected products. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); no public exploit identified at time of analysis.
Oracle SOA Suite Fabric Layer can be taken over by low-privileged remote attackers with network access, affecting releases 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 score of 8.8 reflects full confidentiality, integrity, and availability impact; exploitation requires a valid low-privilege account (PR:L), but no user interaction and low attack complexity make it straightforward once credentials or a session are obtained. Available intelligence does not identify public exploit code or CISA KEV active exploitation at time of analysis.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged attacker with HTTP access to the Fabric Layer to create, delete, or modify critical data and cause a partial denial of service. The CVSS 3.1 vector requires a valid low-privileged account (PR:L) but no user interaction, and confidentiality is not affected. No public exploit code or confirmed active exploitation was identified at time of analysis, so priority is driven by exposure of low-privilege SOA accounts and the HTTP interface.
Unauthenticated HTTP access to the Oracle SOA Suite Fabric Layer can disclose critical data in Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0. The flaw is network-reachable with low complexity and requires no privileges or user interaction (CVSS 3.1 base 7.5, confidentiality-only), and no public exploit code was identified at time of analysis. Real-world exposure is limited to deployments whose SOA Suite HTTP interface is reachable by untrusted networks.
Remote unauthenticated attackers can achieve takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer over HTTP, with the 9.8 CVSS reflecting high confidentiality, integrity, and availability impact and no privileges or user interaction required. No public exploit identified at time of analysis and no CISA KEV confirmation is present in the supplied data, but internet-reachable SOA Suite instances should be treated as high priority because the assessed vector is pre-authentication network exploitation.
Oracle SOA Suite releases 12.2.1.4.0 and 14.1.2.0.0 contain a critical flaw in the Fabric Layer component that can be reached over HTTP without any credentials, letting a remote attacker seize full control of the SOA Suite deployment. With a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation yields complete loss of confidentiality, integrity, and availability of the affected middleware, effectively a takeover of the product. There is no KEV listing and no public exploit identified at time of analysis, but the pre-authentication network vector and the fact that Oracle's Fabric Layer normally sits on an internet- or partner-facing service bus make this a top-tier patch priority; EPSS data was not supplied, and our independent assessment confirms the unauthenticated remote exploitation path with network reachability as the primary practical barrier.
Unauthenticated remote compromise of Oracle SOA Suite's Fabric Layer can lead to full takeover of the affected installation. The flaw affects SOA Suite 12.2.1.4.0 and 14.1.2.0.0 and is rated CVSS 9.8 with complete confidentiality, integrity, and availability impact; exploitation requires network access to the SOA Suite HTTP interface. No public exploit identified at time of analysis, and the main practical constraint is reachability rather than authentication or user interaction.
Oracle SOA Suite's Enterprise Scheduling System exposes a SOAP interface that unauthenticated remote attackers can reach on versions 12.2.1.4.0 and 14.1.2.0.0, allowing takeover of the product with high confidentiality, integrity, and availability impact. The 9.8 CVSS score and AV:N/AC:L/PR:N/UI:N vector make network reachability the primary exposure factor, so internet-facing or broadly reachable SOAP endpoints are the highest priority. No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 contain an easily exploitable Fabric Layer flaw that lets a low-privileged, network-positioned attacker take over the SOA Suite service over HTTP. Successful exploitation can also impact integrated products because the vulnerability changes scope, with high confidentiality, integrity, and availability impact; a low-privilege authenticated account is required. No public exploit code or CISA KEV entry was identified at the time of analysis.
Unauthenticated remote takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 is achievable through the Adapters component of Oracle Fusion Middleware, with Oracle assigning the maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No credentials, user interaction, or special preconditions are required beyond network reachability of the SOA Suite HTTP listener, and the scope-change rating means successful exploitation can cascade into connected or dependent products rather than being contained to the SOA Suite host. At the time of analysis there is no public exploit code or CISA KEV listing, but the combination of maximum severity, unauthenticated access, and low complexity makes this a top-priority patch item for any internet- or broadly internally reachable deployment.
Unauthenticated attackers who can reach the HTTP interface of Oracle SOA Suite's Fabric Layer can bypass authentication to read critical data and make limited unauthorized modifications in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the flaw 9.3 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N); the scope change indicates that a successful compromise can reach beyond SOA Suite into other Fusion Middleware components deployed in the same environment. No public exploit code or confirmed active exploitation was identified at time of analysis, but the absence of authentication, user-interaction, or complexity prerequisites makes this a high-priority patch target wherever the SOA HTTP interface is network-reachable.
Oracle SOA Suite's Fabric Layer can be taken over by a low-privileged attacker who already has authenticated network access via HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The high attack complexity (AC:H) means exploitation depends on conditions outside the attacker's direct control, and no public exploit was identified at time of analysis. The issue carries a 7.5 CVSS base score with high confidentiality, integrity, and availability impact.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 contain an improper access control weakness in the Fusion Middleware Fabric Layer that lets a low-privileged, network-positioned attacker read and partially modify data beyond their intended authorization. Exploitation is over HTTP, requires only a valid low-privilege account (PR:L) and no user interaction, yielding high confidentiality impact plus limited integrity impact for a CVSS 3.1 base score of 7.1 (High). No public exploit code or confirmed active exploitation was identified at time of analysis, though the low attack complexity and the prevalence of internet-facing SOA Suite consoles make exposed Fabric Layer endpoints an attractive target.
Authenticated attackers with only low privileges can achieve full takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer over HTTP, with high impact to confidentiality, integrity, and availability. Exploitation is rated difficult (CVSS AC:H) because specific conditions outside the attacker's control must align, and a valid low-privileged SOA Suite account is required (PR:L). No public exploit code or CISA KEV entry was identified in the available intelligence at time of analysis.
Low-privileged authenticated attackers with HTTP network access can achieve full takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through a flaw in the Fabric Layer component, with high impact to confidentiality, integrity and availability (CVSS 3.1 base score 7.5). The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U) means a valid low-privileged account is required and Oracle rates the flaw as difficult to exploit, so attack complexity and account provisioning are the main real-world barriers rather than the score alone. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle tracks the fix through its October 2026 Critical Patch Update.
Remote unauthenticated attackers who can reach the Adapters component of Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0 over HTTP can modify or delete critical data and cause a hang or frequently repeatable crash, producing a CVSS 9.1 integrity and availability impact. No public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data, but the low-complexity, no-privilege vector makes patching and reducing network exposure high priorities.
Low-privileged authenticated attackers can take full control of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer component reachable over HTTP, with a CVSS 3.1 base score of 9.9. The scope-change rating (S:C) means a successful compromise is not contained to the SOA Suite instance and can significantly impact additional connected products, so confidentiality, integrity and availability are all rated high. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the practical gate for attackers is possession of any valid low-privilege account plus network reachability of the SOA Suite HTTP interface.
Full takeover of Oracle SOA Suite is achievable by authenticated low-privilege attackers who can reach the Fabric Layer over HTTP in versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is network-reachable, low-complexity, and requires no user interaction, with high confidentiality, integrity, and availability impact once a valid low-privilege account is obtained. No public exploit code or CISA KEV entry is identified in the supplied intelligence; vendor fixes are referenced through Oracle's October 2026 Critical Patch Update advisory.
Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised by a low-privileged, authenticated remote attacker exploiting the Human Workflow (11g+) component over SOAP, with a scope change that may extend impact to additional products. Successful exploitation can result in takeover of the BPM Suite with high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, but the low attack complexity and high impact make this a priority patching target.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 are exposed to unauthenticated remote takeover through the Fabric Layer component reachable via T3 and IIOP. An attacker with network access can exploit the flaw without credentials or user interaction to achieve high confidentiality, integrity, and availability impact; the changed scope means interconnected products may also be affected. No public exploit identified at time of analysis, and the supplied intelligence does not indicate CISA KEV listing, but the unauthenticated network vector and CVSS 10.0 score make this a top-priority exposure for internet- or broadly reachable T3/IIOP listeners.
Unauthenticated remote takeover of Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Human Workflow component exposed over HTTP. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or non-default configuration are required beyond network reachability. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle's October 2026 Critical Patch Update advisory is the authoritative fix source.
Unauthenticated HTTP access to the Oracle SOA Suite Fabric Layer can expose critical data and, because of a scope change, may affect integrated products that trust SOA Suite. The flaw affects Oracle Fusion Middleware SOA Suite 12.2.1.4.0 and 14.1.2.0.0 and is rated CVSS 8.6 with confidentiality-only impact. No public exploit was identified at time of analysis.