Oracle
Monthly
Full compromise of Oracle WebCenter Sites (Fusion Middleware) is possible over the network by an unauthenticated attacker via HTTP, resulting in complete product takeover with high confidentiality, integrity, and availability impact. Supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and Oracle addresses it in the July 2026 Critical Patch Update. The high attack complexity (AC:H) tempers real-world risk, and there is no public exploit identified at time of analysis and no CISA KEV listing.
Unauthorized data disclosure in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker reach and read all data accessible to the application over HTTP, with a scope change that can significantly impact other connected products. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 score of 8.6 driven entirely by confidentiality impact. No public exploit is identified at time of analysis, and it is fixed in the Oracle Critical Patch Update of July 2026.
Remote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows an unauthenticated attacker with only HTTP network access to fully compromise the platform, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity, and availability and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a top-priority patching item.
Unauthenticated information disclosure in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote attacker with only HTTP network access to read critical data and potentially all data accessible to the application. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 7.5 with pure confidentiality impact; no public exploit has been identified at time of analysis and it is not listed in CISA KEV. Oracle addressed the issue in the July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 lets a remote unauthenticated attacker read, create, delete, or modify all data accessible to the product over HTTP, with a scope change that can significantly impact adjacent products. Oracle rates this CVSS 8.7 with high confidentiality and integrity impact but high attack complexity, and the vendor tags it as an authentication bypass. No public exploit identified at time of analysis and it is not on CISA KEV.
Full compromise of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a low-privileged attacker sending HTTP requests over the network, with successful attacks resulting in complete takeover of the product. Oracle rates this CVSS 3.1 9.9 with a scope change, meaning the impact extends beyond WebCenter Sites into adjacent products. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and minimal privilege requirement make it a high patch priority; a fix was delivered in the Oracle July 2026 Critical Patch Update.
Remote takeover of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated attacker with only HTTP network access to fully compromise the product, resulting in complete confidentiality, integrity, and availability loss (CVSS 3.1 9.8). Oracle rates the flaw 'easily exploitable' and disclosed it in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data access in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows a remote, unauthenticated attacker to reach all data accessible to the product over HTTP. The flaw carries a scope change, meaning a successful attack can significantly impact additional connected products beyond WebCenter Sites itself. Oracle rates it CVSS 3.1 8.6 (confidentiality-only); no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle tags it as an Authentication Bypass.
Full compromise of Oracle Managed File Transfer (MFT Runtime Server) allows a low-privileged, network-authenticated attacker to take over the product via HTTP, per Oracle's July 2026 Critical Patch Update. The flaw affects Fusion Middleware MFT versions 12.2.1.4.0 and 14.1.2.0.0, carries a CVSS 8.8 with full confidentiality, integrity, and availability impact, and is rated by Oracle as 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Information disclosure in Oracle SOA Suite (Integration Business Insight component), versions 12.2.1.4.0 and 14.1.2.0.0, allows a low-privileged attacker with HTTP network access to gain unauthorized access to all SOA Suite-accessible critical data, with a scope change that may significantly impact additional connected products. Oracle rates this CVSS 3.1 7.7 (High) with confidentiality-only impact and no integrity or availability effect. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the 'Authentication Bypass' tag hints at auth-weakening behavior but the CVSS vector confirms some privilege (PR:L) is still required.
Privilege escalation to full product takeover in Oracle Managed File Transfer (versions 12.2.1.4.0 and 14.1.2.0.0), part of Oracle Fusion Middleware's MFT Runtime Server component, allows a low-privileged attacker with HTTP network access to compromise the product and, because of a scope change, significantly impact additional connected products. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CVSS 3.1 base score of 9.9 and the easily-exploitable, low-privilege nature make this a top-priority Critical Patch Update item. The flaw is addressed in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Integration Business Insight component in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the product with high confidentiality, integrity, and availability impact. Addressed in the Oracle Critical Patch Update of July 2026, this issue carries a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the 'easily exploitable' language from Oracle (reflected as AC:L) makes prompt patching prudent for exposed instances.
Account takeover in Oracle Managed File Transfer (MFT Runtime Server) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, authenticated attacker with network access over HTTP to fully compromise the product. Oracle rates the flaw CVSS 8.8 with high confidentiality, integrity, and availability impact and describes it as easily exploitable, but no public exploit has been identified at time of analysis and it is not listed in CISA KEV. The issue was disclosed by Oracle in the July 2026 Critical Patch Update.
Unauthenticated data compromise in Oracle SOA Suite (12.2.1.4.0 and 14.1.2.0.0) lets a remote attacker reach the B2B Engine component over HTTP and read all data accessible to the product, plus induce a partial denial of service. The flaw requires no credentials and no user interaction (CVSS 8.2, C:H/A:L), placing it among the higher-severity items in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector warrants prompt patching.
Full compromise of Oracle SOA Suite is possible through its B2B Engine component, where an unauthenticated remote attacker sending crafted HTTP traffic can achieve complete takeover of the affected instance. Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0 are affected, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.1). Oracle rates the flaw as difficult to exploit (AC:H), and there is no public exploit identified at time of analysis and no CISA KEV listing.
Full takeover of Oracle Business Process Management Suite is possible when a low-privileged attacker reaches the T3 or IIOP protocol endpoints of the Human Workflow component in Fusion Middleware 12.2.1.4.0 or 14.1.2.0.0. Because the flaw carries a scope change, successful exploitation impacts additional products beyond BPM itself, yielding compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, but the 9.9 CVSS and low attack complexity make this a top-priority patch from Oracle's July 2026 Critical Patch Update.
Complete takeover of Oracle SOA Suite is possible when an unauthenticated remote attacker sends crafted HTTP traffic to the Enterprise Scheduling System component in versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 base score of 9.8 reflects full loss of confidentiality, integrity, and availability with no privileges or user interaction required. This was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis, but the trivial exploitation profile makes it a high-priority patch target.
Privilege-escalating data compromise in Oracle SOA Suite (Oracle Fusion Middleware) lets a low-privileged, remote attacker with HTTP access abuse the Integration Business Insight component to read, create, modify, or delete all data accessible to SOA Suite. Rated CVSS 3.1 9.6 (Critical) with a scope change that can significantly impact other products beyond SOA Suite itself. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle SOA Suite is possible through the Integration Business Insight component, where a low-privileged attacker with network HTTP access to affected deployments (versions 12.2.1.4.0 and 14.1.2.0.0) can fully compromise confidentiality, integrity, and availability. Oracle rates this CVSS 8.8 and disclosed it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, but the low attack complexity and "easily exploitable" language make it a high-priority patching target. Any authenticated user of the middleware stack - not just administrators - can reach the flaw.
Full system takeover of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Enterprise Scheduling System component, where an unauthenticated remote attacker can compromise affected 12.2.1.4.0 and 14.1.2.0.0 deployments over HTTP. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity, and availability impact, reflecting a network-facing, no-privilege, no-interaction attack. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS and KEV data were not provided in the input.
Full takeover of Oracle Managed File Transfer (MFT Runtime Server) is achievable by a low-privileged remote attacker over HTTP in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this CVSS 9.9 because the flaw carries a scope change, so a successful attack can also significantly impact products beyond MFT itself. No public exploit has been identified at time of analysis; the fix ships in the Oracle July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote unauthenticated attacker to reach critical data over HTTP, with a scope change (S:C) meaning the impact extends to additional connected products beyond the connector itself. The vendor rates it CVSS 8.6 with confidentiality-only impact and low attack complexity, and tags indicate an authentication-bypass class weakness. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so risk is currently based on the vendor's own severity assessment via the July 2026 Critical Patch Update.
Full takeover of Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) is possible in supported versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the connector over HTTP can compromise it end to end. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. At the time of analysis there is no public exploit identified and it is not listed in CISA KEV, but the low attack complexity and lack of any authentication make it a high-priority patching target.
Privileged tampering and data disclosure in the Oracle Identity Manager Connector (PeopleSoft Applications component) of Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 lets a high-privileged, network-based attacker read, create, delete, or modify all connector-accessible data, with a scope change that can significantly impact additional products beyond the connector itself. The CVSS 3.1 base score is 7.7 (C:H/I:H/A:N), but exploitation is rated high-complexity and requires existing high privileges, so this is not a drive-by flaw. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Integrity and availability compromise in the Oracle Identity Manager Connector (Generic Unix Connector component) of Oracle Fusion Middleware allows an unauthenticated attacker positioned on the adjacent physical communication segment to modify, create or delete connector-accessible data and to cause a complete, repeatable denial of service. Versions 12.2.1.4.0 and 14.1.2.1.0 are affected, and because of a scope change the attack may significantly impact additional integrated products beyond the connector itself. There is no public exploit identified at time of analysis; the flaw is rated CVSS 3.1 8.0 despite high attack complexity.
Complete takeover of the Oracle Identity Manager Connector (PeopleSoft Applications component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, with CVSS 9.8 reflecting full confidentiality, integrity, and availability loss. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, and the fix ships in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and 'takeover' outcome make it a top-tier patch priority for any environment running this connector.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged attacker with HTTP network access fully compromise the connector, with a scope change that lets the attack significantly impact other products. Oracle rates it CVSS 3.1 9.9 (Critical) with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is currently theoretical based on the vendor's July 2026 Critical Patch Update disclosure.
Local privilege-driven takeover in Oracle HTTP Server 14.1.2.0.0 (Oracle Fusion Middleware) lets a low-privileged attacker with logon access to the host running OHS fully compromise the server via the bundled HTTP/2 module (mod_http2.so). With a CVSS 3.1 base score of 7.8 and full confidentiality, integrity, and availability impact, successful exploitation yields complete takeover of the OHS instance. Fixed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Full server takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 is possible via the administration Console component, where a high-privileged attacker with HTTP network access can fully compromise confidentiality, integrity, and availability. Rated CVSS 3.1 7.2, this is part of Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege abuse in the Console component of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 lets a high-privileged, network-based attacker corrupt or delete critical data and read a subset of data, with a scope change that can impact other products beyond WebLogic itself. Oracle rates it CVSS 3.1 7.6 and, despite the 'Authentication Bypass' tag applied by the reporter, the CVSS vector requires PR:H (high existing privileges). No public exploit identified at time of analysis and it is not listed in CISA KEV; disclosed in the Oracle Critical Patch Update of July 2026.
Unauthorized data access in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows an attacker with local logon to the hosting infrastructure to compromise the server and read all WebLogic-accessible data, with a scope change that can significantly impact other collocated products. Oracle rates it CVSS 3.1 7.1 (confidentiality-only). This is addressed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-based attacker read, create, delete, or modify all data accessible to the application. Because the flaw carries a scope change, successful exploitation may also significantly impact products beyond WebCenter Content itself. No public exploit identified at time of analysis, and the flaw is rated difficult to exploit (AC:H); Oracle addressed it in the July 2026 Critical Patch Update.
Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic T3 or IIOP protocol interface of the Client Bundle component, per the Oracle Critical Patch Update of July 2026. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation not only compromises Capture but can significantly impact additional connected products. No public exploit has been identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch.
Cross-context data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets a low-privileged, authenticated attacker abuse HTTP-facing functionality to read and modify all Content-Server-accessible data, with a scope change that can significantly impact adjacent Oracle products. Exploitation requires tricking a legitimate user into interacting with attacker-controlled content, and Oracle rates it CVSS 3.1 8.7 (confidentiality and integrity high, no availability impact). Disclosed in Oracle's July 2026 Critical Patch Update with no public exploit identified at time of analysis and not listed in CISA KEV.
Cross-context data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged authenticated attacker with HTTP network access to gain unauthorized read access to all WebCenter Content data and limited write access, provided a separate victim user is tricked into an interaction. Because the CVSS scope is changed (S:C), a successful attack can significantly impact resources beyond WebCenter Content itself, consistent with a stored/reflected injection-style flaw served through the content platform. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vulnerability was reported by Oracle and patched in the July 2026 Critical Patch Update.
Data compromise in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component of Oracle Fusion Middleware) allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all directory-accessible data over LDAP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, the flaw is described by Oracle as 'easily exploitable' and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Takeover of Oracle Unified Directory is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component), where a high-privileged attacker with network access via LDAP can fully compromise the directory service. Oracle rates this CVSS 7.2 with high confidentiality, integrity, and availability impact, and describes it as 'easily exploitable' once the required privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is gated primarily by the authentication requirement.
Account takeover in Oracle WebCenter Content: Imaging (Core component of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the Imaging service. Rated CVSS 8.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as 'easily exploitable' and results in complete takeover of the product. No public exploit identified at time of analysis, and it is not on CISA KEV.
Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with network access over the T3 or IIOP protocols can take over the Imaging application entirely (CVSS 3.1 7.2, high confidentiality, integrity and availability impact). Fixes are delivered in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Account takeover in Oracle JD Edwards EnterpriseOne Solution Advisor 9.2 lets a low-privileged, network-authenticated attacker fully compromise the Solution Advisor component over HTTP. Oracle rates the flaw 8.8 (High) with full confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning a foothold with minimal application privileges can escalate to complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector warrant prompt patching in the July 2026 Oracle Critical Patch Update.
Full takeover of Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 is possible when a low-privileged attacker with network access to the JDENET service chains a hard-to-exploit flaw in the Human Resources component. Successful exploitation yields high confidentiality, integrity, and availability impact (complete compromise of the HR module). No public exploit has been identified at time of analysis and it is not listed in CISA KEV; risk is tempered by high attack complexity (AC:H) and a required authenticated foothold (PR:L).
Full compromise of Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 is possible when a low-privileged attacker with network access abuses the proprietary JDENET communication protocol, per Oracle's July 2026 Critical Patch Update. Successful exploitation yields complete takeover of the CRM Foundation component with high confidentiality, integrity, and availability impact, though Oracle rates the attack complexity as high. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Full product takeover of Oracle JD Edwards EnterpriseOne Advanced Pricing - Procurement (version 9.2) is possible via the proprietary JDENET network protocol, where a low-privileged, network-authenticated attacker can compromise confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.5, tempered by high attack complexity (AC:H), meaning exploitation is not straightforward. There is no public exploit identified at time of analysis and it is not on CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Full compromise of Oracle JD Edwards EnterpriseOne Requirements Planning 9.2 is possible for a low-privileged attacker reaching the proprietary JDENET network protocol, yielding confidentiality, integrity, and availability impact ("takeover"). The flaw carries a CVSS 3.1 base score of 7.5 but is rated hard to exploit (AC:H) and requires existing low-level privileges (PR:L). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial-of-service and partial data tampering in Oracle JD Edwards EnterpriseOne General Ledger 9.2 (E1 Foundation component) lets a remote, unauthenticated attacker reach the application over HTTP to cause a complete hang or repeatable crash, plus limited unauthorized read and write access to General Ledger data. The CVSS 3.1 base score is 7.0 with high attack complexity, meaning exploitation is possible without credentials but not trivially repeatable. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the input.
Product takeover in Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 allows an authenticated low-privileged attacker with HTTP network access to fully compromise the Human Resources component, gaining high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Oracle rates the flaw as easily exploitable, but no public exploit identified at time of analysis and it is not listed in CISA KEV. The bug is addressed in Oracle's July 2026 Critical Patch Update.
Denial-of-service and information disclosure in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (OW HR PR Foundation component) allows a low-privileged, authenticated attacker with network/HTTP access to hang or repeatedly crash the application (complete DoS) and read a subset of accessible data. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
Full compromise of Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 is possible by a low-privileged, network-based attacker over HTTP, with Oracle rating the flaw "easily exploitable" and assigning a CVSS 3.1 base score of 8.8 spanning confidentiality, integrity, and availability. An authenticated user holding only minimal privileges can escalate to a complete takeover of the CRM Foundation component, gaining read/write access to CRM data and the ability to disrupt the service. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; the issue is addressed in Oracle's July 2026 Critical Patch Update.
Full product takeover in Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 lets an authenticated low-privileged attacker with HTTP network access compromise the CRM Foundation component and gain complete control over its confidentiality, integrity, and availability. Rated CVSS 3.1 8.8, the flaw is described by Oracle as easily exploitable and resolved in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-based takeover of Oracle WebCenter Content: Imaging (Core component) in Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-authenticated attacker to fully compromise the product over HTTP, yielding high confidentiality, integrity, and availability impact. Fixed in Oracle's July 2026 Critical Patch Update, this flaw carries a CVSS 3.1 base score of 8.8 and is classed as easily exploitable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host, per Oracle's July 2026 Critical Patch Update (CVE-2026-60471). The flaw carries a CVSS 3.1 base score of 8.3 and, notably, a scope change (S:C) meaning successful exploitation can significantly impact additional products beyond Imaging itself, resulting in takeover. There is no public exploit identified at time of analysis and the issue is not on CISA KEV, but the confidentiality, integrity, and availability impact are all High.
Unauthorized data compromise in Oracle WebCenter Content: Imaging (Core component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all Imaging-accessible data by tricking an authenticated user into interacting with a malicious request. Rated CVSS 3.1 8.7 (High) with a scope change that lets exploitation impact additional connected Oracle Fusion Middleware products beyond Imaging itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; authentication is required (PR:L) plus victim interaction (UI:R), which meaningfully limits mass exploitation.
Scope-changing confidentiality and integrity compromise in Oracle WebCenter Content: Imaging (Core component) affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, letting a low-privileged, network-based attacker who lures an authenticated user into an action read, create, delete, or modify all Imaging-accessible data. Oracle rates it CVSS 3.1 8.7 with a scope change, meaning successful attacks can significantly impact products beyond Imaging itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the Oracle July 2026 Critical Patch Update.
Unauthorized data access and partial data manipulation in Oracle WebCenter Content: Imaging (Fusion Middleware component: Core) lets a low-privileged, network-based attacker read all Imaging-accessible data and modify some of it over HTTP. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, with a CVSS 3.1 base score of 7.1 driven by high confidentiality and low integrity impact. No public exploit identified at time of analysis and the flaw is not on CISA KEV; the Oracle-supplied 'Authentication Bypass' tag is somewhat at odds with the CVSS PR:L requirement and should be verified against the vendor advisory.
Account/application takeover in Oracle WebCenter Content: Imaging (Core component of Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, where a remote unauthenticated attacker who lures a legitimate user into interacting with malicious content over HTTP can fully compromise the Imaging application. Oracle rates it CVSS 3.1 7.5 with high confidentiality, integrity, and availability impact, but flags it as difficult to exploit (AC:H) and dependent on user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with network access over HTTP can take over the Imaging service, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N) yields a 7.2 base score with high confidentiality, integrity, and availability impact, meaning the attacker gains complete control of the product. No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV, though the vendor tags it under Information Disclosure.
Full compromise of Oracle WebCenter Content: Imaging (Core component) in Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker sending crafted requests over the WebLogic T3 or IIOP protocols. Successful exploitation yields complete takeover of the Imaging service with high confidentiality, integrity, and availability impact (CVSS 8.8). This was disclosed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0), a component of Oracle Fusion Middleware, is achievable by a low-privileged attacker with network HTTP access, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the Imaging component with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle WebCenter Content: Imaging (Fusion Middleware Core component) allows an unauthenticated attacker with network access via the T3 or IIOP protocols to fully compromise the product, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not yet confirmed in the wild despite the maximal severity.
Full compromise of Oracle WebCenter Content is possible in the Content Server component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a remote unauthenticated attacker reaching the server over HTTP can achieve complete takeover with full confidentiality, integrity, and availability impact. The flaw carries a CVSS 3.1 base score of 8.1, tempered by high attack complexity (AC:H) that makes reliable exploitation difficult. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so risk is currently theoretical pending patch application from the Oracle July 2026 Critical Patch Update.
Privilege escalation to full takeover in Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Client Bundle component) allows a low-privileged attacker with network access over the WebLogic T3/IIOP protocols to fully compromise the product, with scope change meaning impact extends to other products in the environment. Rated CVSS 9.9 with high confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and not listed in CISA KEV.
Complete takeover of Oracle WebCenter Enterprise Capture is possible when an unauthenticated remote attacker reaches the Client Bundle component over Oracle's T3 or IIOP protocols. Affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 9.8 with full confidentiality, integrity, and availability impact, and is described by Oracle as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware Client Bundle component) is possible for a low-privileged attacker with HTTP network access, per Oracle's CPU July 2026 advisory. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation impacts confidentiality, integrity, and availability and can extend beyond Capture into additional connected products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patch.
Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privileged attacker reaches the server over the T3 or IIOP protocols, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation can take over the Capture product and significantly impact additional connected Oracle Fusion Middleware components. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch.
Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic-based Client Bundle component over the T3 or IIOP protocols, yielding complete confidentiality, integrity, and availability compromise. Oracle rates it CVSS 9.9 with a scope change, meaning exploitation can pivot beyond Capture into adjacent Fusion Middleware components. No public exploit identified at time of analysis, but the near-maximum score, low attack complexity, and network reachability make it a top-priority Critical Patch Update item.
Privilege-escalating account takeover in Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged attacker with HTTP network access fully compromise the product and, because of a scope change, significantly impact adjacent products. Rated CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact, it is described by Oracle as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is unproven despite the near-maximal score.
Local privilege-based takeover of Oracle HTTP Server (12.2.1.4.0 and 14.1.2.0.0) allows a low-privileged attacker with a logon session on the host to fully compromise the web server, yielding high confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.8 with a local attack vector (AV:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but complete server takeover makes it a meaningful lateral-movement and privilege-consolidation target once a foothold exists.
Privilege-abusing information disclosure and data tampering in Oracle WebCenter Content: Imaging (Core component) lets a low-privileged, network-based attacker read all Imaging-accessible data and modify some of it over HTTP. The flaw carries a scope change (CVSS 8.5), meaning a successful attack can reach beyond the Imaging module into other Fusion Middleware components, and Oracle tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' and shipped a fix in the July 2026 Critical Patch Update.
Information disclosure and partial data tampering in the Imaging component (Core) of Oracle WebCenter Content, part of Oracle Fusion Middleware, affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with HTTP network access can compromise the Imaging service, gaining unauthorized read access to all Imaging-accessible data and limited unauthorized update, insert, or delete capability, addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis; the record carries an 'Authentication Bypass' tag despite the CVSS requiring low privileges (PR:L).
Full compromise of Oracle WebCenter Content (Content Server component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker with HTTPS network access can achieve complete takeover of the product. The CVSS 3.1 base score is 8.1 with high confidentiality, integrity, and availability impact, though the flaw is rated difficult to exploit (AC:H). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthorized data access in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets an attacker who already holds a login session on the host infrastructure read or take complete access to all data the product can reach, and because of a scope change the impact can extend to additional connected products. Addressed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.1 with confidentiality-only impact; no public exploit is identified at time of analysis and it is not listed in CISA KEV. The Oracle-supplied tag 'Authentication Bypass' suggests the flaw circumvents application-level access controls once local/infrastructure logon is obtained.
Cross-scope data compromise in Oracle WebCenter Content (Content Server component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a remote unauthenticated attacker over HTTP read, create, delete, or modify all data accessible to the Content Server, with a scope change that can significantly impact other integrated Oracle Fusion Middleware products. Oracle rates it CVSS 3.1 8.7 (high complexity) with confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor tags suggest an authentication-bypass class issue.
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by a low-privileged attacker sending crafted HTTP requests over the network, per Oracle's July 2026 Critical Patch Update (CVE-2026-60447). The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning a successful attack extends beyond Capture itself to significantly impact additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch item.
Complete remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated network attacker abusing the T3 or IIOP protocols can fully compromise the product with high impact to confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 9.8 and describes it as easily exploitable, but there is no public exploit identified at time of analysis and it is not on CISA KEV. The T3/IIOP attack surface is the same WebLogic RMI channel historically abused via Java deserialization, making it a high-priority patch despite the absence of confirmed in-the-wild activity.
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible when a low-privileged attacker with network access via the WebLogic T3 or IIOP protocols exploits versions 12.2.1.4.0 and 14.1.2.0.0. Rated CVSS 3.1 9.9 with a scope change, successful attacks compromise confidentiality, integrity and availability and can significantly impact additional connected products beyond Capture itself. No public exploit identified at time of analysis, and the fix ships in Oracle's July 2026 Critical Patch Update.
Sensitive data disclosure and partial data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged, network-based attacker over HTTP to gain complete read access to all data the product can reach and to modify some of that data. Oracle rates the flaw CVSS 3.1 8.5 with a scope change, meaning exploitation can significantly impact adjacent products beyond WebCenter Content itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so treat this as a high-severity but not confirmed-exploited issue.
Scope-changing data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-based attacker read, create, delete, or modify all data accessible to the application. Exploitation is rated easy but requires tricking a separate user into an interaction (UI:R), and the flaw crosses a trust boundary to significantly impact additional products (scope change). No public exploit has been identified at time of analysis and it is not on CISA KEV; EPSS was not provided.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible by an unauthenticated remote attacker over the T3 or IIOP protocols, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) the attack is network-reachable, low-complexity, and requires no authentication or user interaction, yielding full confidentiality, integrity, and availability compromise (9.8 Critical). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated pre-auth nature over exposed WebLogic protocols makes this a high-priority patch.
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) in Oracle Fusion Middleware is achievable by a remote unauthenticated attacker over the T3 and IIOP protocols. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation results in complete takeover of the platform with high confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.
Information disclosure with scope change in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged remote attacker read all data accessible to the platform and impact additional connected products. The flaw is network-exploitable over HTTP with low attack complexity and only minimal existing privileges, and Oracle tags it as an authentication bypass affecting confidentiality only (no integrity or availability impact). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low exploitation barrier and cross-boundary scope change make it a meaningful risk in exposed telecom/messaging deployments.
Unauthenticated compromise of Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 (a Fusion Middleware component) is possible over the network via HTTP against the mod_ssl module, letting a remote attacker read, create, delete or modify all server-accessible data. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact but no availability impact, and tagged as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch.
Data tampering and denial-of-service in Oracle Unified Directory (OUD Core component) let a high-privileged, network-adjacent attacker abuse the LDAP interface to modify or destroy directory data and force a complete crash or hang of the service. Affected supported versions are 12.2.1.4.0 and 14.1.2.1.0, addressed in the Oracle July 2026 Critical Patch Update. The flaw carries a scope change, meaning a successful attack can significantly impact products beyond OUD itself. No public exploit has been identified at time of analysis.
Denial of service in Oracle Unified Directory (OUD Core) versions 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated attacker with LDAP network access hang or repeatedly crash the directory server, producing a complete availability outage. Oracle rates it CVSS 3.1 7.5 with availability-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; confidentiality and integrity are unaffected.
Full remote takeover of Oracle WebCenter Content (Fusion Middleware Content Server) is possible when an unauthenticated attacker reaches the HTTP interface, per Oracle's July 2026 Critical Patch Update (CPU). The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0 and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector and Oracle 'takeover' language make it a top-priority patch.
Unauthorized data disclosure in Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 (Oracle Fusion Middleware, mod_proxy component) lets an unauthenticated remote attacker over HTTP read critical data and, because of a scope change, reach data belonging to other back-end products the proxy fronts. The confidentiality-only impact combined with S:C strongly indicates a proxy-side request-forwarding/SSRF-class weakness that exposes internal resources rather than a code-execution flaw. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Unified Directory (OUD Core component of Oracle Fusion Middleware) is possible when a low-privileged attacker sends malicious traffic over LDAP to affected versions 12.2.1.4.0 and 14.1.2.1.0. Oracle rates this 8.8 (CVSS 3.1) and characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the directory server, breaching confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network-facing LDAP interface make it a high-priority patch item.
Full takeover of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a low-privileged attacker with LDAP network access can compromise the directory service and, because of a scope change, significantly impact additional connected products. Oracle rates this CVSS 9.9 and lists it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not on CISA KEV. The combination of low attack complexity, only low privileges required, and cross-product blast radius makes this one of the highest-severity fixes in the CPU.
Unauthorized data access in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component) lets a remote unauthenticated attacker abuse the LDAP interface to read critical directory data and make limited unauthorized modifications. Rated CVSS 8.2 and flagged by Oracle as easily exploitable, the flaw is tagged as an authentication bypass, meaning directory contents can be reached without valid credentials. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Scope-changing compromise of Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a remote, unauthenticated attacker abuse the LDAP interface to read and alter all directory-accessible data, tagged by Oracle as an authentication bypass. Because OUD brokers identity and access for downstream Fusion Middleware systems, successful attacks carry a CVSS 3.1 scope change (S:C) and can significantly impact other products beyond the directory itself. No public exploit identified at time of analysis; exploitation is rated high-complexity (AC:H), so this is a serious but non-trivial-to-weaponize flaw addressed in Oracle's July 2026 Critical Patch Update.
Elevation-of-scope compromise in Oracle Unified Directory (Fusion Middleware, OUD Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets an authenticated low-privileged attacker with LDAP network access read all OUD-accessible data and modify some of it, with a scope change that can significantly impact additional connected products. Oracle rates it CVSS 3.1 8.5, and the source intelligence tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and scope change make it a meaningful patch priority for Oracle-integrated identity infrastructure.
Full compromise of Oracle WebCenter Sites (Fusion Middleware) is possible over the network by an unauthenticated attacker via HTTP, resulting in complete product takeover with high confidentiality, integrity, and availability impact. Supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and Oracle addresses it in the July 2026 Critical Patch Update. The high attack complexity (AC:H) tempers real-world risk, and there is no public exploit identified at time of analysis and no CISA KEV listing.
Unauthorized data disclosure in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker reach and read all data accessible to the application over HTTP, with a scope change that can significantly impact other connected products. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 score of 8.6 driven entirely by confidentiality impact. No public exploit is identified at time of analysis, and it is fixed in the Oracle Critical Patch Update of July 2026.
Remote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows an unauthenticated attacker with only HTTP network access to fully compromise the platform, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity, and availability and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a top-priority patching item.
Unauthenticated information disclosure in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote attacker with only HTTP network access to read critical data and potentially all data accessible to the application. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 7.5 with pure confidentiality impact; no public exploit has been identified at time of analysis and it is not listed in CISA KEV. Oracle addressed the issue in the July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 lets a remote unauthenticated attacker read, create, delete, or modify all data accessible to the product over HTTP, with a scope change that can significantly impact adjacent products. Oracle rates this CVSS 8.7 with high confidentiality and integrity impact but high attack complexity, and the vendor tags it as an authentication bypass. No public exploit identified at time of analysis and it is not on CISA KEV.
Full compromise of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a low-privileged attacker sending HTTP requests over the network, with successful attacks resulting in complete takeover of the product. Oracle rates this CVSS 3.1 9.9 with a scope change, meaning the impact extends beyond WebCenter Sites into adjacent products. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and minimal privilege requirement make it a high patch priority; a fix was delivered in the Oracle July 2026 Critical Patch Update.
Remote takeover of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated attacker with only HTTP network access to fully compromise the product, resulting in complete confidentiality, integrity, and availability loss (CVSS 3.1 9.8). Oracle rates the flaw 'easily exploitable' and disclosed it in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data access in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows a remote, unauthenticated attacker to reach all data accessible to the product over HTTP. The flaw carries a scope change, meaning a successful attack can significantly impact additional connected products beyond WebCenter Sites itself. Oracle rates it CVSS 3.1 8.6 (confidentiality-only); no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle tags it as an Authentication Bypass.
Full compromise of Oracle Managed File Transfer (MFT Runtime Server) allows a low-privileged, network-authenticated attacker to take over the product via HTTP, per Oracle's July 2026 Critical Patch Update. The flaw affects Fusion Middleware MFT versions 12.2.1.4.0 and 14.1.2.0.0, carries a CVSS 8.8 with full confidentiality, integrity, and availability impact, and is rated by Oracle as 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Information disclosure in Oracle SOA Suite (Integration Business Insight component), versions 12.2.1.4.0 and 14.1.2.0.0, allows a low-privileged attacker with HTTP network access to gain unauthorized access to all SOA Suite-accessible critical data, with a scope change that may significantly impact additional connected products. Oracle rates this CVSS 3.1 7.7 (High) with confidentiality-only impact and no integrity or availability effect. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the 'Authentication Bypass' tag hints at auth-weakening behavior but the CVSS vector confirms some privilege (PR:L) is still required.
Privilege escalation to full product takeover in Oracle Managed File Transfer (versions 12.2.1.4.0 and 14.1.2.0.0), part of Oracle Fusion Middleware's MFT Runtime Server component, allows a low-privileged attacker with HTTP network access to compromise the product and, because of a scope change, significantly impact additional connected products. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CVSS 3.1 base score of 9.9 and the easily-exploitable, low-privilege nature make this a top-priority Critical Patch Update item. The flaw is addressed in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Integration Business Insight component in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the product with high confidentiality, integrity, and availability impact. Addressed in the Oracle Critical Patch Update of July 2026, this issue carries a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the 'easily exploitable' language from Oracle (reflected as AC:L) makes prompt patching prudent for exposed instances.
Account takeover in Oracle Managed File Transfer (MFT Runtime Server) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, authenticated attacker with network access over HTTP to fully compromise the product. Oracle rates the flaw CVSS 8.8 with high confidentiality, integrity, and availability impact and describes it as easily exploitable, but no public exploit has been identified at time of analysis and it is not listed in CISA KEV. The issue was disclosed by Oracle in the July 2026 Critical Patch Update.
Unauthenticated data compromise in Oracle SOA Suite (12.2.1.4.0 and 14.1.2.0.0) lets a remote attacker reach the B2B Engine component over HTTP and read all data accessible to the product, plus induce a partial denial of service. The flaw requires no credentials and no user interaction (CVSS 8.2, C:H/A:L), placing it among the higher-severity items in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector warrants prompt patching.
Full compromise of Oracle SOA Suite is possible through its B2B Engine component, where an unauthenticated remote attacker sending crafted HTTP traffic can achieve complete takeover of the affected instance. Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0 are affected, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.1). Oracle rates the flaw as difficult to exploit (AC:H), and there is no public exploit identified at time of analysis and no CISA KEV listing.
Full takeover of Oracle Business Process Management Suite is possible when a low-privileged attacker reaches the T3 or IIOP protocol endpoints of the Human Workflow component in Fusion Middleware 12.2.1.4.0 or 14.1.2.0.0. Because the flaw carries a scope change, successful exploitation impacts additional products beyond BPM itself, yielding compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, but the 9.9 CVSS and low attack complexity make this a top-priority patch from Oracle's July 2026 Critical Patch Update.
Complete takeover of Oracle SOA Suite is possible when an unauthenticated remote attacker sends crafted HTTP traffic to the Enterprise Scheduling System component in versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 base score of 9.8 reflects full loss of confidentiality, integrity, and availability with no privileges or user interaction required. This was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis, but the trivial exploitation profile makes it a high-priority patch target.
Privilege-escalating data compromise in Oracle SOA Suite (Oracle Fusion Middleware) lets a low-privileged, remote attacker with HTTP access abuse the Integration Business Insight component to read, create, modify, or delete all data accessible to SOA Suite. Rated CVSS 3.1 9.6 (Critical) with a scope change that can significantly impact other products beyond SOA Suite itself. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle SOA Suite is possible through the Integration Business Insight component, where a low-privileged attacker with network HTTP access to affected deployments (versions 12.2.1.4.0 and 14.1.2.0.0) can fully compromise confidentiality, integrity, and availability. Oracle rates this CVSS 8.8 and disclosed it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, but the low attack complexity and "easily exploitable" language make it a high-priority patching target. Any authenticated user of the middleware stack - not just administrators - can reach the flaw.
Full system takeover of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Enterprise Scheduling System component, where an unauthenticated remote attacker can compromise affected 12.2.1.4.0 and 14.1.2.0.0 deployments over HTTP. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity, and availability impact, reflecting a network-facing, no-privilege, no-interaction attack. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS and KEV data were not provided in the input.
Full takeover of Oracle Managed File Transfer (MFT Runtime Server) is achievable by a low-privileged remote attacker over HTTP in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this CVSS 9.9 because the flaw carries a scope change, so a successful attack can also significantly impact products beyond MFT itself. No public exploit has been identified at time of analysis; the fix ships in the Oracle July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote unauthenticated attacker to reach critical data over HTTP, with a scope change (S:C) meaning the impact extends to additional connected products beyond the connector itself. The vendor rates it CVSS 8.6 with confidentiality-only impact and low attack complexity, and tags indicate an authentication-bypass class weakness. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so risk is currently based on the vendor's own severity assessment via the July 2026 Critical Patch Update.
Full takeover of Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) is possible in supported versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the connector over HTTP can compromise it end to end. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. At the time of analysis there is no public exploit identified and it is not listed in CISA KEV, but the low attack complexity and lack of any authentication make it a high-priority patching target.
Privileged tampering and data disclosure in the Oracle Identity Manager Connector (PeopleSoft Applications component) of Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 lets a high-privileged, network-based attacker read, create, delete, or modify all connector-accessible data, with a scope change that can significantly impact additional products beyond the connector itself. The CVSS 3.1 base score is 7.7 (C:H/I:H/A:N), but exploitation is rated high-complexity and requires existing high privileges, so this is not a drive-by flaw. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Integrity and availability compromise in the Oracle Identity Manager Connector (Generic Unix Connector component) of Oracle Fusion Middleware allows an unauthenticated attacker positioned on the adjacent physical communication segment to modify, create or delete connector-accessible data and to cause a complete, repeatable denial of service. Versions 12.2.1.4.0 and 14.1.2.1.0 are affected, and because of a scope change the attack may significantly impact additional integrated products beyond the connector itself. There is no public exploit identified at time of analysis; the flaw is rated CVSS 3.1 8.0 despite high attack complexity.
Complete takeover of the Oracle Identity Manager Connector (PeopleSoft Applications component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, with CVSS 9.8 reflecting full confidentiality, integrity, and availability loss. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, and the fix ships in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and 'takeover' outcome make it a top-tier patch priority for any environment running this connector.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged attacker with HTTP network access fully compromise the connector, with a scope change that lets the attack significantly impact other products. Oracle rates it CVSS 3.1 9.9 (Critical) with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is currently theoretical based on the vendor's July 2026 Critical Patch Update disclosure.
Local privilege-driven takeover in Oracle HTTP Server 14.1.2.0.0 (Oracle Fusion Middleware) lets a low-privileged attacker with logon access to the host running OHS fully compromise the server via the bundled HTTP/2 module (mod_http2.so). With a CVSS 3.1 base score of 7.8 and full confidentiality, integrity, and availability impact, successful exploitation yields complete takeover of the OHS instance. Fixed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Full server takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 is possible via the administration Console component, where a high-privileged attacker with HTTP network access can fully compromise confidentiality, integrity, and availability. Rated CVSS 3.1 7.2, this is part of Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege abuse in the Console component of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 lets a high-privileged, network-based attacker corrupt or delete critical data and read a subset of data, with a scope change that can impact other products beyond WebLogic itself. Oracle rates it CVSS 3.1 7.6 and, despite the 'Authentication Bypass' tag applied by the reporter, the CVSS vector requires PR:H (high existing privileges). No public exploit identified at time of analysis and it is not listed in CISA KEV; disclosed in the Oracle Critical Patch Update of July 2026.
Unauthorized data access in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows an attacker with local logon to the hosting infrastructure to compromise the server and read all WebLogic-accessible data, with a scope change that can significantly impact other collocated products. Oracle rates it CVSS 3.1 7.1 (confidentiality-only). This is addressed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-based attacker read, create, delete, or modify all data accessible to the application. Because the flaw carries a scope change, successful exploitation may also significantly impact products beyond WebCenter Content itself. No public exploit identified at time of analysis, and the flaw is rated difficult to exploit (AC:H); Oracle addressed it in the July 2026 Critical Patch Update.
Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic T3 or IIOP protocol interface of the Client Bundle component, per the Oracle Critical Patch Update of July 2026. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation not only compromises Capture but can significantly impact additional connected products. No public exploit has been identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch.
Cross-context data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets a low-privileged, authenticated attacker abuse HTTP-facing functionality to read and modify all Content-Server-accessible data, with a scope change that can significantly impact adjacent Oracle products. Exploitation requires tricking a legitimate user into interacting with attacker-controlled content, and Oracle rates it CVSS 3.1 8.7 (confidentiality and integrity high, no availability impact). Disclosed in Oracle's July 2026 Critical Patch Update with no public exploit identified at time of analysis and not listed in CISA KEV.
Cross-context data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged authenticated attacker with HTTP network access to gain unauthorized read access to all WebCenter Content data and limited write access, provided a separate victim user is tricked into an interaction. Because the CVSS scope is changed (S:C), a successful attack can significantly impact resources beyond WebCenter Content itself, consistent with a stored/reflected injection-style flaw served through the content platform. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vulnerability was reported by Oracle and patched in the July 2026 Critical Patch Update.
Data compromise in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component of Oracle Fusion Middleware) allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all directory-accessible data over LDAP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, the flaw is described by Oracle as 'easily exploitable' and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Takeover of Oracle Unified Directory is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component), where a high-privileged attacker with network access via LDAP can fully compromise the directory service. Oracle rates this CVSS 7.2 with high confidentiality, integrity, and availability impact, and describes it as 'easily exploitable' once the required privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is gated primarily by the authentication requirement.
Account takeover in Oracle WebCenter Content: Imaging (Core component of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the Imaging service. Rated CVSS 8.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as 'easily exploitable' and results in complete takeover of the product. No public exploit identified at time of analysis, and it is not on CISA KEV.
Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with network access over the T3 or IIOP protocols can take over the Imaging application entirely (CVSS 3.1 7.2, high confidentiality, integrity and availability impact). Fixes are delivered in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Account takeover in Oracle JD Edwards EnterpriseOne Solution Advisor 9.2 lets a low-privileged, network-authenticated attacker fully compromise the Solution Advisor component over HTTP. Oracle rates the flaw 8.8 (High) with full confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning a foothold with minimal application privileges can escalate to complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector warrant prompt patching in the July 2026 Oracle Critical Patch Update.
Full takeover of Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 is possible when a low-privileged attacker with network access to the JDENET service chains a hard-to-exploit flaw in the Human Resources component. Successful exploitation yields high confidentiality, integrity, and availability impact (complete compromise of the HR module). No public exploit has been identified at time of analysis and it is not listed in CISA KEV; risk is tempered by high attack complexity (AC:H) and a required authenticated foothold (PR:L).
Full compromise of Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 is possible when a low-privileged attacker with network access abuses the proprietary JDENET communication protocol, per Oracle's July 2026 Critical Patch Update. Successful exploitation yields complete takeover of the CRM Foundation component with high confidentiality, integrity, and availability impact, though Oracle rates the attack complexity as high. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Full product takeover of Oracle JD Edwards EnterpriseOne Advanced Pricing - Procurement (version 9.2) is possible via the proprietary JDENET network protocol, where a low-privileged, network-authenticated attacker can compromise confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.5, tempered by high attack complexity (AC:H), meaning exploitation is not straightforward. There is no public exploit identified at time of analysis and it is not on CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Full compromise of Oracle JD Edwards EnterpriseOne Requirements Planning 9.2 is possible for a low-privileged attacker reaching the proprietary JDENET network protocol, yielding confidentiality, integrity, and availability impact ("takeover"). The flaw carries a CVSS 3.1 base score of 7.5 but is rated hard to exploit (AC:H) and requires existing low-level privileges (PR:L). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial-of-service and partial data tampering in Oracle JD Edwards EnterpriseOne General Ledger 9.2 (E1 Foundation component) lets a remote, unauthenticated attacker reach the application over HTTP to cause a complete hang or repeatable crash, plus limited unauthorized read and write access to General Ledger data. The CVSS 3.1 base score is 7.0 with high attack complexity, meaning exploitation is possible without credentials but not trivially repeatable. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the input.
Product takeover in Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 allows an authenticated low-privileged attacker with HTTP network access to fully compromise the Human Resources component, gaining high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Oracle rates the flaw as easily exploitable, but no public exploit identified at time of analysis and it is not listed in CISA KEV. The bug is addressed in Oracle's July 2026 Critical Patch Update.
Denial-of-service and information disclosure in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (OW HR PR Foundation component) allows a low-privileged, authenticated attacker with network/HTTP access to hang or repeatedly crash the application (complete DoS) and read a subset of accessible data. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
Full compromise of Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 is possible by a low-privileged, network-based attacker over HTTP, with Oracle rating the flaw "easily exploitable" and assigning a CVSS 3.1 base score of 8.8 spanning confidentiality, integrity, and availability. An authenticated user holding only minimal privileges can escalate to a complete takeover of the CRM Foundation component, gaining read/write access to CRM data and the ability to disrupt the service. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; the issue is addressed in Oracle's July 2026 Critical Patch Update.
Full product takeover in Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 lets an authenticated low-privileged attacker with HTTP network access compromise the CRM Foundation component and gain complete control over its confidentiality, integrity, and availability. Rated CVSS 3.1 8.8, the flaw is described by Oracle as easily exploitable and resolved in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-based takeover of Oracle WebCenter Content: Imaging (Core component) in Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-authenticated attacker to fully compromise the product over HTTP, yielding high confidentiality, integrity, and availability impact. Fixed in Oracle's July 2026 Critical Patch Update, this flaw carries a CVSS 3.1 base score of 8.8 and is classed as easily exploitable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host, per Oracle's July 2026 Critical Patch Update (CVE-2026-60471). The flaw carries a CVSS 3.1 base score of 8.3 and, notably, a scope change (S:C) meaning successful exploitation can significantly impact additional products beyond Imaging itself, resulting in takeover. There is no public exploit identified at time of analysis and the issue is not on CISA KEV, but the confidentiality, integrity, and availability impact are all High.
Unauthorized data compromise in Oracle WebCenter Content: Imaging (Core component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all Imaging-accessible data by tricking an authenticated user into interacting with a malicious request. Rated CVSS 3.1 8.7 (High) with a scope change that lets exploitation impact additional connected Oracle Fusion Middleware products beyond Imaging itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; authentication is required (PR:L) plus victim interaction (UI:R), which meaningfully limits mass exploitation.
Scope-changing confidentiality and integrity compromise in Oracle WebCenter Content: Imaging (Core component) affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, letting a low-privileged, network-based attacker who lures an authenticated user into an action read, create, delete, or modify all Imaging-accessible data. Oracle rates it CVSS 3.1 8.7 with a scope change, meaning successful attacks can significantly impact products beyond Imaging itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the Oracle July 2026 Critical Patch Update.
Unauthorized data access and partial data manipulation in Oracle WebCenter Content: Imaging (Fusion Middleware component: Core) lets a low-privileged, network-based attacker read all Imaging-accessible data and modify some of it over HTTP. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, with a CVSS 3.1 base score of 7.1 driven by high confidentiality and low integrity impact. No public exploit identified at time of analysis and the flaw is not on CISA KEV; the Oracle-supplied 'Authentication Bypass' tag is somewhat at odds with the CVSS PR:L requirement and should be verified against the vendor advisory.
Account/application takeover in Oracle WebCenter Content: Imaging (Core component of Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, where a remote unauthenticated attacker who lures a legitimate user into interacting with malicious content over HTTP can fully compromise the Imaging application. Oracle rates it CVSS 3.1 7.5 with high confidentiality, integrity, and availability impact, but flags it as difficult to exploit (AC:H) and dependent on user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with network access over HTTP can take over the Imaging service, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N) yields a 7.2 base score with high confidentiality, integrity, and availability impact, meaning the attacker gains complete control of the product. No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV, though the vendor tags it under Information Disclosure.
Full compromise of Oracle WebCenter Content: Imaging (Core component) in Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker sending crafted requests over the WebLogic T3 or IIOP protocols. Successful exploitation yields complete takeover of the Imaging service with high confidentiality, integrity, and availability impact (CVSS 8.8). This was disclosed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content: Imaging (versions 12.2.1.4.0 and 14.1.2.0.0), a component of Oracle Fusion Middleware, is achievable by a low-privileged attacker with network HTTP access, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the Imaging component with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle WebCenter Content: Imaging (Fusion Middleware Core component) allows an unauthenticated attacker with network access via the T3 or IIOP protocols to fully compromise the product, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not yet confirmed in the wild despite the maximal severity.
Full compromise of Oracle WebCenter Content is possible in the Content Server component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a remote unauthenticated attacker reaching the server over HTTP can achieve complete takeover with full confidentiality, integrity, and availability impact. The flaw carries a CVSS 3.1 base score of 8.1, tempered by high attack complexity (AC:H) that makes reliable exploitation difficult. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so risk is currently theoretical pending patch application from the Oracle July 2026 Critical Patch Update.
Privilege escalation to full takeover in Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Client Bundle component) allows a low-privileged attacker with network access over the WebLogic T3/IIOP protocols to fully compromise the product, with scope change meaning impact extends to other products in the environment. Rated CVSS 9.9 with high confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and not listed in CISA KEV.
Complete takeover of Oracle WebCenter Enterprise Capture is possible when an unauthenticated remote attacker reaches the Client Bundle component over Oracle's T3 or IIOP protocols. Affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 9.8 with full confidentiality, integrity, and availability impact, and is described by Oracle as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware Client Bundle component) is possible for a low-privileged attacker with HTTP network access, per Oracle's CPU July 2026 advisory. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation impacts confidentiality, integrity, and availability and can extend beyond Capture into additional connected products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patch.
Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privileged attacker reaches the server over the T3 or IIOP protocols, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation can take over the Capture product and significantly impact additional connected Oracle Fusion Middleware components. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch.
Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic-based Client Bundle component over the T3 or IIOP protocols, yielding complete confidentiality, integrity, and availability compromise. Oracle rates it CVSS 9.9 with a scope change, meaning exploitation can pivot beyond Capture into adjacent Fusion Middleware components. No public exploit identified at time of analysis, but the near-maximum score, low attack complexity, and network reachability make it a top-priority Critical Patch Update item.
Privilege-escalating account takeover in Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged attacker with HTTP network access fully compromise the product and, because of a scope change, significantly impact adjacent products. Rated CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact, it is described by Oracle as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is unproven despite the near-maximal score.
Local privilege-based takeover of Oracle HTTP Server (12.2.1.4.0 and 14.1.2.0.0) allows a low-privileged attacker with a logon session on the host to fully compromise the web server, yielding high confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.8 with a local attack vector (AV:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but complete server takeover makes it a meaningful lateral-movement and privilege-consolidation target once a foothold exists.
Privilege-abusing information disclosure and data tampering in Oracle WebCenter Content: Imaging (Core component) lets a low-privileged, network-based attacker read all Imaging-accessible data and modify some of it over HTTP. The flaw carries a scope change (CVSS 8.5), meaning a successful attack can reach beyond the Imaging module into other Fusion Middleware components, and Oracle tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' and shipped a fix in the July 2026 Critical Patch Update.
Information disclosure and partial data tampering in the Imaging component (Core) of Oracle WebCenter Content, part of Oracle Fusion Middleware, affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with HTTP network access can compromise the Imaging service, gaining unauthorized read access to all Imaging-accessible data and limited unauthorized update, insert, or delete capability, addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis; the record carries an 'Authentication Bypass' tag despite the CVSS requiring low privileges (PR:L).
Full compromise of Oracle WebCenter Content (Content Server component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker with HTTPS network access can achieve complete takeover of the product. The CVSS 3.1 base score is 8.1 with high confidentiality, integrity, and availability impact, though the flaw is rated difficult to exploit (AC:H). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthorized data access in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets an attacker who already holds a login session on the host infrastructure read or take complete access to all data the product can reach, and because of a scope change the impact can extend to additional connected products. Addressed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.1 with confidentiality-only impact; no public exploit is identified at time of analysis and it is not listed in CISA KEV. The Oracle-supplied tag 'Authentication Bypass' suggests the flaw circumvents application-level access controls once local/infrastructure logon is obtained.
Cross-scope data compromise in Oracle WebCenter Content (Content Server component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a remote unauthenticated attacker over HTTP read, create, delete, or modify all data accessible to the Content Server, with a scope change that can significantly impact other integrated Oracle Fusion Middleware products. Oracle rates it CVSS 3.1 8.7 (high complexity) with confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor tags suggest an authentication-bypass class issue.
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by a low-privileged attacker sending crafted HTTP requests over the network, per Oracle's July 2026 Critical Patch Update (CVE-2026-60447). The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning a successful attack extends beyond Capture itself to significantly impact additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch item.
Complete remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated network attacker abusing the T3 or IIOP protocols can fully compromise the product with high impact to confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 9.8 and describes it as easily exploitable, but there is no public exploit identified at time of analysis and it is not on CISA KEV. The T3/IIOP attack surface is the same WebLogic RMI channel historically abused via Java deserialization, making it a high-priority patch despite the absence of confirmed in-the-wild activity.
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible when a low-privileged attacker with network access via the WebLogic T3 or IIOP protocols exploits versions 12.2.1.4.0 and 14.1.2.0.0. Rated CVSS 3.1 9.9 with a scope change, successful attacks compromise confidentiality, integrity and availability and can significantly impact additional connected products beyond Capture itself. No public exploit identified at time of analysis, and the fix ships in Oracle's July 2026 Critical Patch Update.
Sensitive data disclosure and partial data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged, network-based attacker over HTTP to gain complete read access to all data the product can reach and to modify some of that data. Oracle rates the flaw CVSS 3.1 8.5 with a scope change, meaning exploitation can significantly impact adjacent products beyond WebCenter Content itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so treat this as a high-severity but not confirmed-exploited issue.
Scope-changing data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-based attacker read, create, delete, or modify all data accessible to the application. Exploitation is rated easy but requires tricking a separate user into an interaction (UI:R), and the flaw crosses a trust boundary to significantly impact additional products (scope change). No public exploit has been identified at time of analysis and it is not on CISA KEV; EPSS was not provided.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible by an unauthenticated remote attacker over the T3 or IIOP protocols, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) the attack is network-reachable, low-complexity, and requires no authentication or user interaction, yielding full confidentiality, integrity, and availability compromise (9.8 Critical). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated pre-auth nature over exposed WebLogic protocols makes this a high-priority patch.
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) in Oracle Fusion Middleware is achievable by a remote unauthenticated attacker over the T3 and IIOP protocols. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation results in complete takeover of the platform with high confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.
Information disclosure with scope change in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged remote attacker read all data accessible to the platform and impact additional connected products. The flaw is network-exploitable over HTTP with low attack complexity and only minimal existing privileges, and Oracle tags it as an authentication bypass affecting confidentiality only (no integrity or availability impact). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low exploitation barrier and cross-boundary scope change make it a meaningful risk in exposed telecom/messaging deployments.
Unauthenticated compromise of Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 (a Fusion Middleware component) is possible over the network via HTTP against the mod_ssl module, letting a remote attacker read, create, delete or modify all server-accessible data. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact but no availability impact, and tagged as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch.
Data tampering and denial-of-service in Oracle Unified Directory (OUD Core component) let a high-privileged, network-adjacent attacker abuse the LDAP interface to modify or destroy directory data and force a complete crash or hang of the service. Affected supported versions are 12.2.1.4.0 and 14.1.2.1.0, addressed in the Oracle July 2026 Critical Patch Update. The flaw carries a scope change, meaning a successful attack can significantly impact products beyond OUD itself. No public exploit has been identified at time of analysis.
Denial of service in Oracle Unified Directory (OUD Core) versions 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated attacker with LDAP network access hang or repeatedly crash the directory server, producing a complete availability outage. Oracle rates it CVSS 3.1 7.5 with availability-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; confidentiality and integrity are unaffected.
Full remote takeover of Oracle WebCenter Content (Fusion Middleware Content Server) is possible when an unauthenticated attacker reaches the HTTP interface, per Oracle's July 2026 Critical Patch Update (CPU). The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0 and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector and Oracle 'takeover' language make it a top-priority patch.
Unauthorized data disclosure in Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 (Oracle Fusion Middleware, mod_proxy component) lets an unauthenticated remote attacker over HTTP read critical data and, because of a scope change, reach data belonging to other back-end products the proxy fronts. The confidentiality-only impact combined with S:C strongly indicates a proxy-side request-forwarding/SSRF-class weakness that exposes internal resources rather than a code-execution flaw. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Unified Directory (OUD Core component of Oracle Fusion Middleware) is possible when a low-privileged attacker sends malicious traffic over LDAP to affected versions 12.2.1.4.0 and 14.1.2.1.0. Oracle rates this 8.8 (CVSS 3.1) and characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the directory server, breaching confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network-facing LDAP interface make it a high-priority patch item.
Full takeover of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a low-privileged attacker with LDAP network access can compromise the directory service and, because of a scope change, significantly impact additional connected products. Oracle rates this CVSS 9.9 and lists it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not on CISA KEV. The combination of low attack complexity, only low privileges required, and cross-product blast radius makes this one of the highest-severity fixes in the CPU.
Unauthorized data access in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component) lets a remote unauthenticated attacker abuse the LDAP interface to read critical directory data and make limited unauthorized modifications. Rated CVSS 8.2 and flagged by Oracle as easily exploitable, the flaw is tagged as an authentication bypass, meaning directory contents can be reached without valid credentials. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Scope-changing compromise of Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a remote, unauthenticated attacker abuse the LDAP interface to read and alter all directory-accessible data, tagged by Oracle as an authentication bypass. Because OUD brokers identity and access for downstream Fusion Middleware systems, successful attacks carry a CVSS 3.1 scope change (S:C) and can significantly impact other products beyond the directory itself. No public exploit identified at time of analysis; exploitation is rated high-complexity (AC:H), so this is a serious but non-trivial-to-weaponize flaw addressed in Oracle's July 2026 Critical Patch Update.
Elevation-of-scope compromise in Oracle Unified Directory (Fusion Middleware, OUD Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets an authenticated low-privileged attacker with LDAP network access read all OUD-accessible data and modify some of it, with a scope change that can significantly impact additional connected products. Oracle rates it CVSS 3.1 8.5, and the source intelligence tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and scope change make it a meaningful patch priority for Oracle-integrated identity infrastructure.