Oracle
Monthly
Unauthorized data access in Oracle Field Service (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, remotely authenticated attacker to read all Field Service-accessible data and make limited unauthorized modifications over HTTP. Rated CVSS 3.1 7.1 (high) with high confidentiality and low integrity impact, the flaw is described by Oracle as easily exploitable and is tagged as an authentication bypass. There is no public exploit identified at time of analysis, it is not on CISA KEV, and no EPSS score was supplied.
Takeover of the Oracle Installed Base component in Oracle E-Business Suite (Create Item Instance function) is possible by a low-privileged, remote attacker over HTTP against versions 12.2.3 through 12.2.15. Oracle's July 2026 Critical Patch Update rates this at CVSS 8.8 with full confidentiality, integrity, and availability impact, meaning any authenticated EBS user account can fully compromise the Installed Base module. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle E-Business Intelligence (Definition component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the product. The CVSS 3.1 vector (8.1) reflects High confidentiality and integrity impact with no availability effect, meaning an authenticated user can escalate their reach to critical business intelligence data without needing elevated roles. No public exploit identified at time of analysis, and the flaw is addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Sales Offline (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis; not listed in CISA KEV.
Full takeover of the Oracle Trading Community module in Oracle E-Business Suite (versions 12.2.3 through 12.2.12) is achievable by a high-privileged, authenticated attacker sending crafted HTTP requests to the Party Search UI component. Because the CVSS vector reports high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), a successful attack yields complete compromise of the Trading Community application rather than mere data leakage. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthorized data compromise in Oracle iReceivables (Oracle E-Business Suite, AR Web Utilities component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all iReceivables-accessible data. Oracle rates it CVSS 3.1 8.1 (High) with High confidentiality and integrity impact but no availability impact, and the vendor/community has tagged it as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a strong patching priority for exposed EBS deployments.
Data compromise in Oracle MySQL Router 8.4.0-8.4.10 and 9.7.0-9.7.1 allows a network attacker to gain unauthorized read and write access to all data reachable through the Router component. The flaw is reachable unauthenticated over HTTP (PR:N) but is rated hard to exploit (AC:H), and there is no public exploit identified at time of analysis. Oracle's tagging references an authentication-bypass class of issue, consistent with the unauthenticated network vector.
Privilege-escalation and data-compromise flaw in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 (Market Place component) lets a low-privileged user who can log on to the host running ODI read, create, delete, or modify all ODI-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact other products beyond ODI itself, driving the CVSS 3.1 base score to 8.4. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' for an authenticated local user.
Privilege escalation and full data compromise in Oracle BI Publisher (versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0) allows a low-privileged, network-authenticated attacker to abuse the Web Service API and read, create, delete, or modify all BI Publisher-accessible data, with a scope change that lets attacks significantly impact additional products. Rated CVSS 3.1 9.9 (Critical), it is easily exploitable over HTTP with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Price Protection (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with network HTTP access to read, create, delete, or modify all Price Protection-accessible data. The flaw carries a CVSS 3.1 base score of 8.1 (C:H/I:H) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) allows a low-privileged, network-based attacker to compromise the product via HTTP through the Siebel Cloud Manager component. Because the flaw carries a scope change, successful exploitation can pivot beyond Siebel to significantly impact additional connected products, driving the rare CVSS 9.9 rating. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patch item.
Data compromise in Oracle EDI Gateway (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all EDI Gateway-accessible data, including critical data. Rated CVSS 8.1, the flaw is disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass-class issue; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Process Manufacturing Financials (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in the Oracle Process Manufacturing (OPM) Inventory module of Oracle E-Business Suite 12.2.3-12.2.15 lets a low-privileged, authenticated network attacker read and modify all OPM Inventory-accessible data over HTTP. Rated CVSS 3.1 8.1 (High) for combined Confidentiality and Integrity impact with no availability effect, it was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, and it is not on CISA KEV.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets an unauthenticated remote attacker over HTTP read all Siebel-accessible data, tamper with some records, and cause a partial denial of service. Oracle rates it CVSS 7.0 but flags it as difficult to exploit (AC:H), and no public exploit identified at time of analysis. Disclosed via the Oracle July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets a remote unauthenticated attacker reach sensitive data over HTTP. The flaw is tagged as an authentication bypass and, per Oracle's own scoring, is 'easily exploitable' with a high confidentiality impact but no integrity or availability effect (CVSS 3.1 base 7.5). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided in the source data.
Data compromise in Oracle Interaction Blending (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with local logon access to the hosting infrastructure to read, create, delete, or modify all data accessible to the product. The flaw carries a CVSS 3.1 base score of 7.1 with high confidentiality and integrity impact but no availability impact, and no public exploit has been identified at time of analysis. It was disclosed by Oracle in the July 2026 Critical Patch Update.
Data compromise in Oracle Universal Work Queue (Oracle E-Business Suite component UWQ Server Issues), versions 12.2.3 through 12.2.15, lets a remote unauthenticated attacker read and modify all UWQ-accessible data (C:H/I:H) by luring an authenticated user into interacting with attacker-supplied content over HTTP. The CVSS 3.1 base score is 8.1, driven by high confidentiality and integrity impact with no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Takeover of Oracle Enterprise Asset Management (the eAM module of Oracle E-Business Suite, Internal Operations component) is possible by a low-privileged, authenticated network attacker sending crafted HTTP requests. Oracle rates this CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.3 through 12.2.15, and describes exploitation as easy. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle Content Manager (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, modify, or delete all Content Manager-accessible data. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting high confidentiality and integrity damage without service disruption. No public exploit identified at time of analysis and it is not listed in CISA KEV; the Oracle-supplied 'Authentication Bypass' tag conflicts with the PR:L vector and should be treated cautiously.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) allows a low-privileged attacker with network HTTP access to read all data accessible to the application. Oracle rates it CVSS 3.1 7.7 with a scope change, and the ENISA EUVD flags an authentication-bypass characteristic, meaning a minimally-authenticated actor can escalate to broad confidentiality compromise that spills into additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) lets a remote, unauthenticated attacker reach and read critical application data over HTTP. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact, and the intelligence tags flag it as an authentication-bypass class issue, so attackers can obtain complete access to all data accessible to the affected applications without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Data compromise in Oracle U.S. Federal Financials (a module of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets an authenticated low-privileged attacker reach the Internal Operations component over HTTP and read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability impact; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Disclosed via Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Process Manufacturing (OPM) Regulatory Management, a component of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read critical application data. The flaw carries a scope change (S:C), so successful attacks can significantly impact additional products beyond OPM Regulatory Management itself. It is confidentiality-only (CVSS 3.1 7.7) and tagged as an authentication bypass; no public exploit identified at time of analysis.
Full compromise of Oracle Process Manufacturing (OPM) Regulatory Management, a component of Oracle E-Business Suite, is possible by a low-privileged remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting EBS versions 12.2.3 through 12.2.15, the flaw is rated CVSS 8.8 and yields complete takeover of the OPM Regulatory Management module (high confidentiality, integrity, and availability impact). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patching target.
Account takeover in Oracle General Ledger (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with network access via SOAP fully compromise the General Ledger module, gaining high impact to confidentiality, integrity, and availability. The Oracle July 2026 Critical Patch Update rates it CVSS 3.1 8.8 and describes it as easily exploitable, resulting in complete takeover of the affected component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Data compromise and cross-product impact in Oracle E-Business Suite (Oracle Common Application Components, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical application data and cause a partial denial of service. Because the flaw carries a scope change (S:C), a successful attack can significantly affect additional Oracle products beyond the vulnerable component. Oracle rates it CVSS 3.1 8.4 but flags it as difficult to exploit (AC:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle Applications Framework (Search Bean component) affects Oracle E-Business Suite versions 12.2.3 through 12.2.15, allowing a low-privileged, authenticated attacker with HTTP network access to fully compromise the Applications Framework. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and results in complete takeover of the component. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though its inclusion in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.
Account or application takeover of Oracle Applications Framework - the presentation-layer component of Oracle E-Business Suite - is possible when a low-privileged, authenticated attacker reaches the vulnerable Search Bean over HTTP. Affected releases span 12.2.3 through 12.2.15, and a successful attack yields full confidentiality, integrity, and availability compromise of the framework (CVSS 3.1 8.8). This was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) lets a remote attacker reach the BI Platform Security component over HTTP and read all BI-accessible data plus perform limited unauthorized writes. Oracle rates it CVSS 3.1 8.2 and the reporter tags it an authentication bypass, meaning no credentials are needed against affected default deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and no-privilege requirement make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Denial-of-service and limited data tampering in Oracle Business Intelligence Enterprise Edition (BI Platform Security component, versions 8.2.0.0.0 and 26.01.0.0.0) lets an unauthenticated remote attacker over HTTP hang or repeatedly crash the server (complete DOS) and perform limited unauthorized read, insert, update, or delete of accessible data. Oracle rates it CVSS 3.1 8.6 and describes it as easily exploitable with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of the Oracle Applications Technology Stack is possible in Oracle E-Business Suite 12.2.3 through 12.2.15 via the Client System Analyzer component, which is reachable over HTTP by unauthenticated network attackers. Exploitation is rated difficult (high attack complexity) but a successful attack yields complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (French Public Sector Specific component) lets a remote, unauthenticated attacker read all HR-accessible data and modify a subset of it over HTTP. Oracle's July 2026 CPU rates it easily exploitable with high confidentiality and low integrity impact (CVSS 3.1 base 8.2), and third-party intel tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Integrity and availability compromise in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (Core component) allows a network-based, unauthenticated attacker to create, delete or modify critical data and to trigger a complete, repeatable denial of service. The flaw is rated CVSS 7.4 and is fixed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis, and confidentiality is not impacted. Despite requiring no authentication, the CVSS vector flags high attack complexity (AC:H), which meaningfully raises the bar for reliable exploitation.
Cross-privilege data compromise in Oracle PeopleSoft Enterprise HCM Global Payroll for Switzerland 9.2 lets a low-privileged, network-based attacker read, alter, or delete critical payroll data and, because of a scope change, impact other integrated PeopleSoft products beyond the vulnerable module. The flaw is rated CVSS 3.1 8.2 (high) with confidentiality and integrity impact but no availability impact, and it is difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV; the fix is delivered through the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP by an unauthenticated remote attacker who lures a legitimate user into interacting with malicious content. Rated CVSS 3.1 8.8 with high confidentiality, integrity and availability impact, the flaw can lead to full takeover of the WebCenter Content instance. Disclosed via Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation to full takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) lets a low-privileged, network-based attacker fully compromise the server over HTTP. Because the CVSS vector marks a scope change (S:C), a successful attack can significantly impact additional products beyond WebCenter Content itself, driving the near-maximal 9.9 base score. No public exploit identified at time of analysis, but the ease of exploitation (AC:L, PR:L) and complete confidentiality, integrity, and availability impact make this a top-priority patch in Oracle's July 2026 Critical Patch Update.
Local privilege escalation to full system takeover in Oracle Solaris 11.4 lets a low-privileged local user compromise the Filesystems component and, due to a scope change, significantly impact additional products beyond Solaris itself. Exploitation is rated difficult (high attack complexity) and requires an existing local logon, but a successful attack yields complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis; this was disclosed in the Oracle Critical Patch Update of July 2026 and is not listed in CISA KEV.
Local privilege-abuse in the Filesystems component of Oracle Solaris 11.4 allows a low-privileged user with logon access to the host to corrupt or destroy critical operating-system data and to trigger a complete, repeatable denial of service (hang or crash) of the OS. Disclosed in Oracle's July 2026 Critical Patch Update and rated CVSS 3.1 7.1 with high Integrity and Availability impact but no confidentiality loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full product takeover of Oracle WebCenter Content (Content Server component) in versions 12.2.1.4.0 and 14.1.2.0.0 can be achieved by an unauthenticated remote attacker over HTTP, but only by luring a separate user into an interaction that triggers the flaw. Rated CVSS 3.1 7.5 with high confidentiality, integrity, and availability impact, the issue is classified 'difficult to exploit' due to high attack complexity and the required human interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the practical risk is gated by the social-engineering step despite the severe potential impact.
Cross-context data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-reachable attacker read and alter critical data after tricking a legitimate user into interacting with malicious content. Because the flaw crosses a security scope boundary (S:C), successful attacks can significantly impact products beyond WebCenter Content itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.7; no public exploit identified at time of analysis.
Full compromise of Oracle WebCenter Content is possible in versions 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component of Oracle Fusion Middleware), where a low-privileged, network-adjacent attacker sending crafted HTTP requests can escalate to complete takeover of the product with high confidentiality, integrity, and availability impact. Oracle rates this 8.8 (CVSS 3.1) and describes it as 'easily exploitable,' meaning any authenticated user with minimal privileges can seize the system. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'takeover' outcome make it a priority patch.
Privilege-based full compromise of Oracle WebCenter Content (Web Content Management component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-authenticated attacker take over the entire product over HTTP. Oracle rates it CVSS 3.1 8.8 with High confidentiality, integrity, and availability impact, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and 'takeover' outcome make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Account takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged attacker with HTTP network access fully compromise the server. The CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle WebCenter Content (Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to read, create, modify, or delete all content-server-accessible data. Oracle rates this 8.1 (High) with confidentiality and integrity fully impacted but no availability effect, and the intelligence tags flag an authentication-bypass angle. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the July 2026 Oracle Critical Patch Update.
Account and system takeover in Oracle WebCenter Content (Fusion Middleware Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-based attacker to fully compromise the product when a legitimate user is tricked into interacting with attacker-supplied content. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.0 and full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' framing make it a high-priority patch item.
Full takeover of Oracle WebCenter Content (Web Content Management component) is possible when a remote, unauthenticated attacker lures a victim into interacting with malicious content over HTTP. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Oracle's own Critical Patch Update process (July 2026).
Account/instance takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the product after luring a victim user into an action. Oracle rates it CVSS 3.1 8.0 with High impact to confidentiality, integrity, and availability, and the ecalert tag flags Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Unauthenticated data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware Web Content Management component) lets a remote attacker read, create, delete, or modify all data accessible to the product over HTTP with no credentials or user interaction. Oracle rates it CVSS 9.1 (C:H/I:H) and vendor tags describe it as an authentication bypass, making it a high-priority patch from the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full application takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-based attacker to compromise confidentiality, integrity, and availability once a legitimate user is tricked into interacting with attacker-influenced content. The flaw carries an Oracle-assigned CVSS 3.1 score of 8.0 (AV:N/AC:L/PR:L/UI:R) and is addressed in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sensitive data disclosure in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) lets a low-privileged, network-based attacker read or fully access all data the application can reach and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 7.1 and describes it as easily exploitable, though it requires an existing low-level account (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged, network-authenticated attacker who lures a victim into a triggering action can achieve complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). Oracle rates the flaw as easily exploitable over HTTP but conditions it on human interaction from a second party. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with HTTP network access can escalate to complete takeover of the product with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable, though it requires existing high privileges. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.
Full takeover of Oracle WebCenter Content (Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthenticated remote attacker over HTTP, requiring no user interaction. The scope-changing flaw (CVSS 3.1 base 10.0) lets attackers compromise the Web Content Management component and pivot to impact adjacent Oracle products. No public exploit identified at time of analysis, but the maximum severity and trivial exploitability make this a top-priority patch from the July 2026 Oracle Critical Patch Update.
Account/system takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets a low-privileged, authenticated attacker with HTTP network access fully compromise the platform, provided a legitimate user is lured into interacting with attacker-supplied content. Oracle rates it CVSS 3.1 8.0 with full Confidentiality, Integrity, and Availability loss and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'takeover' outcome and low complexity make it a high-priority patch item.
Unauthorized data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to gain access to critical data and cause limited data tampering and partial denial of service, provided a legitimate user is tricked into interacting with the attack. The flaw carries a CVSS 3.1 score of 7.6 and was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access and partial denial of service in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker compromise the platform after tricking a legitimate user into interacting with attacker-controlled content. Per Oracle's July 2026 Critical Patch Update, successful exploitation yields high confidentiality impact (complete read access to WebCenter Content data) plus limited integrity and availability damage. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, though Oracle rates it easily exploitable.
Full takeover of Oracle WebCenter Content (Content Server component) is possible when a remote, unauthenticated attacker lures a legitimate user into interacting with a malicious HTTP request, yielding high confidentiality, integrity, and availability impact plus a scope change to adjacent products. It affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 score of 8.3. No public exploit identified at time of analysis and it is not listed in CISA KEV, though exploitation complexity is high.
Full takeover of Oracle WebCenter Content (Content Server component) in Oracle Fusion Middleware allows a remote unauthenticated attacker to fully compromise confidentiality, integrity, and availability, but only after luring an authenticated victim into interacting with an attacker-supplied trigger (UI:R). It affects supported versions 12.2.1.4.0 and 14.1.2.0.0, carries a CVSS 3.1 base score of 8.8, and is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle WebCenter Content (Content Server component of Oracle Fusion Middleware) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote, unauthenticated attacker sending crafted HTTP traffic can compromise confidentiality, integrity, and availability, but the attack requires human interaction from a user other than the attacker (UI:R). No public exploit has been identified at time of analysis, and the flaw is fixed in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 can be achieved by a remote, unauthenticated attacker over HTTP, provided a legitimate user is lured into a triggering interaction. Rated CVSS 8.8 with high confidentiality, integrity, and availability impact, successful exploitation yields takeover of the WebCenter Content instance. There is no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and network vector make this a priority patch item.
Full product takeover in Oracle WebCenter Content (Content Server component) 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to compromise confidentiality, integrity, and availability by luring a victim into interacting with a malicious HTTP request or link. The flaw carries a CVSS 3.1 base score of 8.8 and results in complete takeover, but exploitation requires human interaction from a legitimate user. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was fixed in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle WebCenter Content (Content Server component) is possible when an unauthenticated remote attacker over HTTP lures a legitimate user into interacting with malicious content, per Oracle's July 2026 Critical Patch Update. Affected supported releases are 12.2.1.4.0 and 14.1.2.0.0, and the CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but rated high due to the complete-compromise outcome.
Full takeover of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a remote, unauthenticated attacker over HTTP, but only after luring a legitimate user into interacting with attacker-controlled input (UI:R). The CVSS 3.1 base score is 8.8 with High impact to confidentiality, integrity and availability, meaning a successful attack yields complete compromise of the product. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, so exploitation is theoretical rather than confirmed.
Full takeover of Oracle WebCenter Content (Content Server component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is achievable by a remote, unauthenticated attacker over HTTP when a legitimate user is lured into interacting with attacker-influenced content. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R with high Confidentiality, Integrity and Availability impact (8.8), the flaw yields complete compromise of the content management system, though the required human interaction meaningfully narrows practical exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation status remains theoretical based on Oracle's July 2026 CPU disclosure.
Scope-changing information disclosure and data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an unauthenticated network attacker who lures a victim into a single interaction read or alter all data the product can access. Rated CVSS 3.1 9.3 (C:H/I:H, scope change), the flaw is dangerous because compromise can spill into other integrated Oracle Fusion Middleware products, though availability is unaffected. No public exploit identified at time of analysis and it is not on CISA KEV, so exploitation is currently theoretical but the criticality warrants prompt patching.
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker read and tamper with all Content Server data and pivot into other connected products. Exploitation is network-based over HTTP and requires luring a victim to trigger the attack (UI:R), with a resulting CVSS 3.1 score of 9.3 driven by a scope change and High confidentiality/integrity impact. No public exploit identified at time of analysis; this entry is disclosed via Oracle's July 2026 Critical Patch Update and is not listed in CISA KEV.
Unauthorized critical-data access in Oracle JDeveloper (Fusion Middleware, Data Visualization Tools component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote unauthenticated attacker read all JDeveloper-accessible data and modify some of it over HTTP, with a scope change that can significantly impact adjacent Oracle products. Oracle rates it CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but non-trivial given the unauthenticated network vector.
Full takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 is possible when a low-privileged attacker with HTTP network access exploits a flaw in the Installation Security component. Because the CVSS scope is changed (S:C), a successful attack does not stay contained to EnterpriseOne Tools but can significantly impact additional connected products, yielding full confidentiality, integrity, and availability loss (CVSS 9.9). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Local privilege escalation to full product takeover in Oracle Data Integrator (Studio component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a low-privileged attacker who can log on to the host where ODI runs fully compromise the product with high confidentiality, integrity, and availability impact. Oracle rates it CVSS 3.1 7.8; there is no public exploit identified at time of analysis and it is not on the CISA KEV list. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update.
Data compromise in Oracle MySQL Connector/J (MySQL Connectors 9.7.0 through 9.7.1) allows a low-privileged attacker with network access over multiple protocols to read, create, delete, or modify all data accessible to the connector and to cause a partial denial of service. Oracle rates this CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), reflecting high difficulty of exploitation but broad confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Unauthorized information disclosure in Oracle JDeveloper (Fusion Middleware Security Framework) versions 12.2.1.4.0 and 14.1.2.0.0 lets a network attacker read critical data without credentials. Remote unauthenticated attackers reaching the product over HTTP can obtain complete access to all JDeveloper-accessible data, with a CVSS 3.1 base score of 7.5 driven entirely by confidentiality impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag 'Authentication Bypass' suggests the flaw stems from a missing or broken authentication check.
Full system takeover in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 is possible when an unauthenticated remote attacker reaches the Web Runtime Security component over HTTP, per Oracle's July 2026 Critical Patch Update. Despite requiring no credentials, the attack is rated hard to execute (CVSS 3.1 8.1, AC:H), and success yields complete confidentiality, integrity, and availability compromise of the Tools layer. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Full application takeover in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (Time Accounting and HRM Base component) allows an authenticated, low-privileged attacker to compromise the product over HTTP. Per the CVSS vector (PR:L), a valid low-privilege account is required and exploitation is difficult (AC:H), but success yields high confidentiality, integrity, and availability impact — effectively total compromise of the HCM Foundation instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle JD Edwards EnterpriseOne Procurement and Subcontract Management (version 9.2) is achievable by a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 score of 8.8 and Oracle explicitly characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the Procurement component (confidentiality, integrity, and availability all high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authenticated-yet-low-barrier profile makes it a strong patch priority for JD Edwards operators.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) lets remote attackers reach the application over HTTP and read all data the module can access, with limited unauthorized insert/update/delete on some data. Vendor and community tags flag this as an authentication bypass, aligning with the PR:N (no privileges) CVSS vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 8.2.
Data manipulation and denial-of-service in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Person Data component) lets a low-privileged, network-authenticated attacker create, delete or modify critical data, read a subset of accessible data, and trigger a repeatable crash of the module. The flaw carries a CVSS 3.1 base score of 7.1 and is flagged as difficult to exploit (AC:H). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 allows a remote, unauthenticated attacker to read, create, modify, or delete critical application data over HTTP. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact), making it easily exploitable without user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patching target.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Higher Ed Statistics Agency - UK HESA component) lets a remote, unauthenticated attacker reach all data accessible to the Student Records module over HTTP. The flaw is easily exploitable per Oracle and, tagged as an authentication bypass, yields high confidentiality impact with no integrity or availability effect (CVSS 3.1 7.5). No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Full takeover of Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 is possible for a low-privileged attacker with network (HTTP) access to the Security component, resulting in high confidentiality, integrity and availability impact. Oracle rates this CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H), and it requires an authenticated (low-privilege) session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Privilege-escalating takeover of Oracle PeopleSoft Enterprise CS Student Records (Campus Solutions) 9.2.38, specifically the Australian Features component, allows a low-privileged attacker with only HTTP network access to fully compromise the module. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8), a single valid low-level application account is enough to achieve complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed via the Oracle Critical Patch Update of July 2026.
Full product takeover in Oracle PeopleSoft Enterprise CS Student Financials 9.2.38 (Billing component) allows a low-privileged, authenticated attacker with HTTP network access to compromise the application, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) indicates easy exploitation yielding complete confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Full takeover of Oracle PeopleSoft Enterprise FIN Project Costing 9.2 (Projects component) is achievable by an attacker with logon access to the host infrastructure, exploiting a local flaw that requires tricking a legitimate user into performing an action. Per the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R), exploitation is local and low-complexity but gated on human interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was reported by Oracle and fixed in the July 2026 Critical Patch Update.
Data compromise in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Research Tracking component) lets a low-privileged, network-authenticated attacker over HTTPS read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), it was disclosed in Oracle's July 2026 Critical Patch Update and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle PeopleSoft Enterprise CS Student Records version 9.2.38 (Research Tracking component) allows an authenticated, low-privileged attacker with network HTTP access to take over the module, impacting confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.5 despite high attack complexity (AC:H), reflecting the severity of a complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Cash Management 9.2 allows a remote, unauthenticated attacker to read, create, delete, or modify all data accessible to the Cash Management component over HTTP. The flaw carries a scope change, meaning a successful attack can significantly impact products beyond Cash Management itself. No public exploit identified at time of analysis; the CVSS 3.1 base score is 8.7 driven by high confidentiality and integrity impact, though the vector rates exploitation as difficult (AC:H).
Account takeover in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Integration and Interfaces component) lets a low-privileged, network-based attacker fully compromise the module over HTTP. The Oracle CPU July 2026 advisory rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, and Oracle labels it 'easily exploitable,' meaning any authenticated user can escalate to complete control of the application. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single required privilege make it a strong patching priority for higher-education and enterprise PeopleSoft deployments.
Unauthorized data modification in Oracle PeopleSoft Enterprise FIN Staffing Front Office 9.2 allows a remote, unauthenticated attacker to create, delete, or modify critical data via crafted HTTP requests. The flaw is confined to the Staffing Front Office component and carries an integrity-only impact (CVSS 3.1 7.5, C:N/I:H/A:N). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthorized data disclosure in Oracle MySQL Connector/J (the official MySQL JDBC driver) versions 9.7.0 through 9.7.1 allows a low-privileged attacker with network access to compromise confidentiality, with a scope change that lets the attack significantly impact additional products beyond the connector itself. Fixed in the Oracle Critical Patch Update of July 2026 and tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.7 with high confidentiality impact and no integrity or availability effect. No public exploit identified at time of analysis, and there is no CISA KEV or EPSS signal in the provided data.
Unauthorized data access and partial denial of service in Oracle Transportation Management 6.5.3 (CSV Management component) allow a low-privileged, network-authenticated attacker over HTTP to read all OTM-accessible data, perform limited unauthorized inserts/updates/deletes, and partially degrade availability. Rated CVSS 3.1 7.6 (High). No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.
Unauthorized data access in Oracle Field Service (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, remotely authenticated attacker to read all Field Service-accessible data and make limited unauthorized modifications over HTTP. Rated CVSS 3.1 7.1 (high) with high confidentiality and low integrity impact, the flaw is described by Oracle as easily exploitable and is tagged as an authentication bypass. There is no public exploit identified at time of analysis, it is not on CISA KEV, and no EPSS score was supplied.
Takeover of the Oracle Installed Base component in Oracle E-Business Suite (Create Item Instance function) is possible by a low-privileged, remote attacker over HTTP against versions 12.2.3 through 12.2.15. Oracle's July 2026 Critical Patch Update rates this at CVSS 8.8 with full confidentiality, integrity, and availability impact, meaning any authenticated EBS user account can fully compromise the Installed Base module. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle E-Business Intelligence (Definition component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the product. The CVSS 3.1 vector (8.1) reflects High confidentiality and integrity impact with no availability effect, meaning an authenticated user can escalate their reach to critical business intelligence data without needing elevated roles. No public exploit identified at time of analysis, and the flaw is addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Sales Offline (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis; not listed in CISA KEV.
Full takeover of the Oracle Trading Community module in Oracle E-Business Suite (versions 12.2.3 through 12.2.12) is achievable by a high-privileged, authenticated attacker sending crafted HTTP requests to the Party Search UI component. Because the CVSS vector reports high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), a successful attack yields complete compromise of the Trading Community application rather than mere data leakage. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthorized data compromise in Oracle iReceivables (Oracle E-Business Suite, AR Web Utilities component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all iReceivables-accessible data. Oracle rates it CVSS 3.1 8.1 (High) with High confidentiality and integrity impact but no availability impact, and the vendor/community has tagged it as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a strong patching priority for exposed EBS deployments.
Data compromise in Oracle MySQL Router 8.4.0-8.4.10 and 9.7.0-9.7.1 allows a network attacker to gain unauthorized read and write access to all data reachable through the Router component. The flaw is reachable unauthenticated over HTTP (PR:N) but is rated hard to exploit (AC:H), and there is no public exploit identified at time of analysis. Oracle's tagging references an authentication-bypass class of issue, consistent with the unauthenticated network vector.
Privilege-escalation and data-compromise flaw in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 (Market Place component) lets a low-privileged user who can log on to the host running ODI read, create, delete, or modify all ODI-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact other products beyond ODI itself, driving the CVSS 3.1 base score to 8.4. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' for an authenticated local user.
Privilege escalation and full data compromise in Oracle BI Publisher (versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0) allows a low-privileged, network-authenticated attacker to abuse the Web Service API and read, create, delete, or modify all BI Publisher-accessible data, with a scope change that lets attacks significantly impact additional products. Rated CVSS 3.1 9.9 (Critical), it is easily exploitable over HTTP with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Price Protection (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with network HTTP access to read, create, delete, or modify all Price Protection-accessible data. The flaw carries a CVSS 3.1 base score of 8.1 (C:H/I:H) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) allows a low-privileged, network-based attacker to compromise the product via HTTP through the Siebel Cloud Manager component. Because the flaw carries a scope change, successful exploitation can pivot beyond Siebel to significantly impact additional connected products, driving the rare CVSS 9.9 rating. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patch item.
Data compromise in Oracle EDI Gateway (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all EDI Gateway-accessible data, including critical data. Rated CVSS 8.1, the flaw is disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass-class issue; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Process Manufacturing Financials (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in the Oracle Process Manufacturing (OPM) Inventory module of Oracle E-Business Suite 12.2.3-12.2.15 lets a low-privileged, authenticated network attacker read and modify all OPM Inventory-accessible data over HTTP. Rated CVSS 3.1 8.1 (High) for combined Confidentiality and Integrity impact with no availability effect, it was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, and it is not on CISA KEV.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets an unauthenticated remote attacker over HTTP read all Siebel-accessible data, tamper with some records, and cause a partial denial of service. Oracle rates it CVSS 7.0 but flags it as difficult to exploit (AC:H), and no public exploit identified at time of analysis. Disclosed via the Oracle July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets a remote unauthenticated attacker reach sensitive data over HTTP. The flaw is tagged as an authentication bypass and, per Oracle's own scoring, is 'easily exploitable' with a high confidentiality impact but no integrity or availability effect (CVSS 3.1 base 7.5). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided in the source data.
Data compromise in Oracle Interaction Blending (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with local logon access to the hosting infrastructure to read, create, delete, or modify all data accessible to the product. The flaw carries a CVSS 3.1 base score of 7.1 with high confidentiality and integrity impact but no availability impact, and no public exploit has been identified at time of analysis. It was disclosed by Oracle in the July 2026 Critical Patch Update.
Data compromise in Oracle Universal Work Queue (Oracle E-Business Suite component UWQ Server Issues), versions 12.2.3 through 12.2.15, lets a remote unauthenticated attacker read and modify all UWQ-accessible data (C:H/I:H) by luring an authenticated user into interacting with attacker-supplied content over HTTP. The CVSS 3.1 base score is 8.1, driven by high confidentiality and integrity impact with no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Takeover of Oracle Enterprise Asset Management (the eAM module of Oracle E-Business Suite, Internal Operations component) is possible by a low-privileged, authenticated network attacker sending crafted HTTP requests. Oracle rates this CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.3 through 12.2.15, and describes exploitation as easy. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle Content Manager (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, modify, or delete all Content Manager-accessible data. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting high confidentiality and integrity damage without service disruption. No public exploit identified at time of analysis and it is not listed in CISA KEV; the Oracle-supplied 'Authentication Bypass' tag conflicts with the PR:L vector and should be treated cautiously.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) allows a low-privileged attacker with network HTTP access to read all data accessible to the application. Oracle rates it CVSS 3.1 7.7 with a scope change, and the ENISA EUVD flags an authentication-bypass characteristic, meaning a minimally-authenticated actor can escalate to broad confidentiality compromise that spills into additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) lets a remote, unauthenticated attacker reach and read critical application data over HTTP. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact, and the intelligence tags flag it as an authentication-bypass class issue, so attackers can obtain complete access to all data accessible to the affected applications without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Data compromise in Oracle U.S. Federal Financials (a module of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets an authenticated low-privileged attacker reach the Internal Operations component over HTTP and read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability impact; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Disclosed via Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Process Manufacturing (OPM) Regulatory Management, a component of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read critical application data. The flaw carries a scope change (S:C), so successful attacks can significantly impact additional products beyond OPM Regulatory Management itself. It is confidentiality-only (CVSS 3.1 7.7) and tagged as an authentication bypass; no public exploit identified at time of analysis.
Full compromise of Oracle Process Manufacturing (OPM) Regulatory Management, a component of Oracle E-Business Suite, is possible by a low-privileged remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting EBS versions 12.2.3 through 12.2.15, the flaw is rated CVSS 8.8 and yields complete takeover of the OPM Regulatory Management module (high confidentiality, integrity, and availability impact). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patching target.
Account takeover in Oracle General Ledger (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with network access via SOAP fully compromise the General Ledger module, gaining high impact to confidentiality, integrity, and availability. The Oracle July 2026 Critical Patch Update rates it CVSS 3.1 8.8 and describes it as easily exploitable, resulting in complete takeover of the affected component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Data compromise and cross-product impact in Oracle E-Business Suite (Oracle Common Application Components, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical application data and cause a partial denial of service. Because the flaw carries a scope change (S:C), a successful attack can significantly affect additional Oracle products beyond the vulnerable component. Oracle rates it CVSS 3.1 8.4 but flags it as difficult to exploit (AC:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle Applications Framework (Search Bean component) affects Oracle E-Business Suite versions 12.2.3 through 12.2.15, allowing a low-privileged, authenticated attacker with HTTP network access to fully compromise the Applications Framework. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and results in complete takeover of the component. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though its inclusion in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.
Account or application takeover of Oracle Applications Framework - the presentation-layer component of Oracle E-Business Suite - is possible when a low-privileged, authenticated attacker reaches the vulnerable Search Bean over HTTP. Affected releases span 12.2.3 through 12.2.15, and a successful attack yields full confidentiality, integrity, and availability compromise of the framework (CVSS 3.1 8.8). This was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) lets a remote attacker reach the BI Platform Security component over HTTP and read all BI-accessible data plus perform limited unauthorized writes. Oracle rates it CVSS 3.1 8.2 and the reporter tags it an authentication bypass, meaning no credentials are needed against affected default deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and no-privilege requirement make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Denial-of-service and limited data tampering in Oracle Business Intelligence Enterprise Edition (BI Platform Security component, versions 8.2.0.0.0 and 26.01.0.0.0) lets an unauthenticated remote attacker over HTTP hang or repeatedly crash the server (complete DOS) and perform limited unauthorized read, insert, update, or delete of accessible data. Oracle rates it CVSS 3.1 8.6 and describes it as easily exploitable with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of the Oracle Applications Technology Stack is possible in Oracle E-Business Suite 12.2.3 through 12.2.15 via the Client System Analyzer component, which is reachable over HTTP by unauthenticated network attackers. Exploitation is rated difficult (high attack complexity) but a successful attack yields complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (French Public Sector Specific component) lets a remote, unauthenticated attacker read all HR-accessible data and modify a subset of it over HTTP. Oracle's July 2026 CPU rates it easily exploitable with high confidentiality and low integrity impact (CVSS 3.1 base 8.2), and third-party intel tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Integrity and availability compromise in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (Core component) allows a network-based, unauthenticated attacker to create, delete or modify critical data and to trigger a complete, repeatable denial of service. The flaw is rated CVSS 7.4 and is fixed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis, and confidentiality is not impacted. Despite requiring no authentication, the CVSS vector flags high attack complexity (AC:H), which meaningfully raises the bar for reliable exploitation.
Cross-privilege data compromise in Oracle PeopleSoft Enterprise HCM Global Payroll for Switzerland 9.2 lets a low-privileged, network-based attacker read, alter, or delete critical payroll data and, because of a scope change, impact other integrated PeopleSoft products beyond the vulnerable module. The flaw is rated CVSS 3.1 8.2 (high) with confidentiality and integrity impact but no availability impact, and it is difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV; the fix is delivered through the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP by an unauthenticated remote attacker who lures a legitimate user into interacting with malicious content. Rated CVSS 3.1 8.8 with high confidentiality, integrity and availability impact, the flaw can lead to full takeover of the WebCenter Content instance. Disclosed via Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation to full takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) lets a low-privileged, network-based attacker fully compromise the server over HTTP. Because the CVSS vector marks a scope change (S:C), a successful attack can significantly impact additional products beyond WebCenter Content itself, driving the near-maximal 9.9 base score. No public exploit identified at time of analysis, but the ease of exploitation (AC:L, PR:L) and complete confidentiality, integrity, and availability impact make this a top-priority patch in Oracle's July 2026 Critical Patch Update.
Local privilege escalation to full system takeover in Oracle Solaris 11.4 lets a low-privileged local user compromise the Filesystems component and, due to a scope change, significantly impact additional products beyond Solaris itself. Exploitation is rated difficult (high attack complexity) and requires an existing local logon, but a successful attack yields complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis; this was disclosed in the Oracle Critical Patch Update of July 2026 and is not listed in CISA KEV.
Local privilege-abuse in the Filesystems component of Oracle Solaris 11.4 allows a low-privileged user with logon access to the host to corrupt or destroy critical operating-system data and to trigger a complete, repeatable denial of service (hang or crash) of the OS. Disclosed in Oracle's July 2026 Critical Patch Update and rated CVSS 3.1 7.1 with high Integrity and Availability impact but no confidentiality loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full product takeover of Oracle WebCenter Content (Content Server component) in versions 12.2.1.4.0 and 14.1.2.0.0 can be achieved by an unauthenticated remote attacker over HTTP, but only by luring a separate user into an interaction that triggers the flaw. Rated CVSS 3.1 7.5 with high confidentiality, integrity, and availability impact, the issue is classified 'difficult to exploit' due to high attack complexity and the required human interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the practical risk is gated by the social-engineering step despite the severe potential impact.
Cross-context data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-reachable attacker read and alter critical data after tricking a legitimate user into interacting with malicious content. Because the flaw crosses a security scope boundary (S:C), successful attacks can significantly impact products beyond WebCenter Content itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.7; no public exploit identified at time of analysis.
Full compromise of Oracle WebCenter Content is possible in versions 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component of Oracle Fusion Middleware), where a low-privileged, network-adjacent attacker sending crafted HTTP requests can escalate to complete takeover of the product with high confidentiality, integrity, and availability impact. Oracle rates this 8.8 (CVSS 3.1) and describes it as 'easily exploitable,' meaning any authenticated user with minimal privileges can seize the system. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'takeover' outcome make it a priority patch.
Privilege-based full compromise of Oracle WebCenter Content (Web Content Management component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-authenticated attacker take over the entire product over HTTP. Oracle rates it CVSS 3.1 8.8 with High confidentiality, integrity, and availability impact, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and 'takeover' outcome make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Account takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged attacker with HTTP network access fully compromise the server. The CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle WebCenter Content (Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to read, create, modify, or delete all content-server-accessible data. Oracle rates this 8.1 (High) with confidentiality and integrity fully impacted but no availability effect, and the intelligence tags flag an authentication-bypass angle. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the July 2026 Oracle Critical Patch Update.
Account and system takeover in Oracle WebCenter Content (Fusion Middleware Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-based attacker to fully compromise the product when a legitimate user is tricked into interacting with attacker-supplied content. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.0 and full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' framing make it a high-priority patch item.
Full takeover of Oracle WebCenter Content (Web Content Management component) is possible when a remote, unauthenticated attacker lures a victim into interacting with malicious content over HTTP. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Oracle's own Critical Patch Update process (July 2026).
Account/instance takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the product after luring a victim user into an action. Oracle rates it CVSS 3.1 8.0 with High impact to confidentiality, integrity, and availability, and the ecalert tag flags Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Unauthenticated data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware Web Content Management component) lets a remote attacker read, create, delete, or modify all data accessible to the product over HTTP with no credentials or user interaction. Oracle rates it CVSS 9.1 (C:H/I:H) and vendor tags describe it as an authentication bypass, making it a high-priority patch from the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full application takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-based attacker to compromise confidentiality, integrity, and availability once a legitimate user is tricked into interacting with attacker-influenced content. The flaw carries an Oracle-assigned CVSS 3.1 score of 8.0 (AV:N/AC:L/PR:L/UI:R) and is addressed in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sensitive data disclosure in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) lets a low-privileged, network-based attacker read or fully access all data the application can reach and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 7.1 and describes it as easily exploitable, though it requires an existing low-level account (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged, network-authenticated attacker who lures a victim into a triggering action can achieve complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). Oracle rates the flaw as easily exploitable over HTTP but conditions it on human interaction from a second party. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with HTTP network access can escalate to complete takeover of the product with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable, though it requires existing high privileges. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.
Full takeover of Oracle WebCenter Content (Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthenticated remote attacker over HTTP, requiring no user interaction. The scope-changing flaw (CVSS 3.1 base 10.0) lets attackers compromise the Web Content Management component and pivot to impact adjacent Oracle products. No public exploit identified at time of analysis, but the maximum severity and trivial exploitability make this a top-priority patch from the July 2026 Oracle Critical Patch Update.
Account/system takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets a low-privileged, authenticated attacker with HTTP network access fully compromise the platform, provided a legitimate user is lured into interacting with attacker-supplied content. Oracle rates it CVSS 3.1 8.0 with full Confidentiality, Integrity, and Availability loss and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'takeover' outcome and low complexity make it a high-priority patch item.
Unauthorized data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to gain access to critical data and cause limited data tampering and partial denial of service, provided a legitimate user is tricked into interacting with the attack. The flaw carries a CVSS 3.1 score of 7.6 and was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access and partial denial of service in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker compromise the platform after tricking a legitimate user into interacting with attacker-controlled content. Per Oracle's July 2026 Critical Patch Update, successful exploitation yields high confidentiality impact (complete read access to WebCenter Content data) plus limited integrity and availability damage. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, though Oracle rates it easily exploitable.
Full takeover of Oracle WebCenter Content (Content Server component) is possible when a remote, unauthenticated attacker lures a legitimate user into interacting with a malicious HTTP request, yielding high confidentiality, integrity, and availability impact plus a scope change to adjacent products. It affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 score of 8.3. No public exploit identified at time of analysis and it is not listed in CISA KEV, though exploitation complexity is high.
Full takeover of Oracle WebCenter Content (Content Server component) in Oracle Fusion Middleware allows a remote unauthenticated attacker to fully compromise confidentiality, integrity, and availability, but only after luring an authenticated victim into interacting with an attacker-supplied trigger (UI:R). It affects supported versions 12.2.1.4.0 and 14.1.2.0.0, carries a CVSS 3.1 base score of 8.8, and is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle WebCenter Content (Content Server component of Oracle Fusion Middleware) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote, unauthenticated attacker sending crafted HTTP traffic can compromise confidentiality, integrity, and availability, but the attack requires human interaction from a user other than the attacker (UI:R). No public exploit has been identified at time of analysis, and the flaw is fixed in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 can be achieved by a remote, unauthenticated attacker over HTTP, provided a legitimate user is lured into a triggering interaction. Rated CVSS 8.8 with high confidentiality, integrity, and availability impact, successful exploitation yields takeover of the WebCenter Content instance. There is no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and network vector make this a priority patch item.
Full product takeover in Oracle WebCenter Content (Content Server component) 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to compromise confidentiality, integrity, and availability by luring a victim into interacting with a malicious HTTP request or link. The flaw carries a CVSS 3.1 base score of 8.8 and results in complete takeover, but exploitation requires human interaction from a legitimate user. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was fixed in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle WebCenter Content (Content Server component) is possible when an unauthenticated remote attacker over HTTP lures a legitimate user into interacting with malicious content, per Oracle's July 2026 Critical Patch Update. Affected supported releases are 12.2.1.4.0 and 14.1.2.0.0, and the CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but rated high due to the complete-compromise outcome.
Full takeover of Oracle WebCenter Content (Content Server component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a remote, unauthenticated attacker over HTTP, but only after luring a legitimate user into interacting with attacker-controlled input (UI:R). The CVSS 3.1 base score is 8.8 with High impact to confidentiality, integrity and availability, meaning a successful attack yields complete compromise of the product. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, so exploitation is theoretical rather than confirmed.
Full takeover of Oracle WebCenter Content (Content Server component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is achievable by a remote, unauthenticated attacker over HTTP when a legitimate user is lured into interacting with attacker-influenced content. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R with high Confidentiality, Integrity and Availability impact (8.8), the flaw yields complete compromise of the content management system, though the required human interaction meaningfully narrows practical exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation status remains theoretical based on Oracle's July 2026 CPU disclosure.
Scope-changing information disclosure and data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an unauthenticated network attacker who lures a victim into a single interaction read or alter all data the product can access. Rated CVSS 3.1 9.3 (C:H/I:H, scope change), the flaw is dangerous because compromise can spill into other integrated Oracle Fusion Middleware products, though availability is unaffected. No public exploit identified at time of analysis and it is not on CISA KEV, so exploitation is currently theoretical but the criticality warrants prompt patching.
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker read and tamper with all Content Server data and pivot into other connected products. Exploitation is network-based over HTTP and requires luring a victim to trigger the attack (UI:R), with a resulting CVSS 3.1 score of 9.3 driven by a scope change and High confidentiality/integrity impact. No public exploit identified at time of analysis; this entry is disclosed via Oracle's July 2026 Critical Patch Update and is not listed in CISA KEV.
Unauthorized critical-data access in Oracle JDeveloper (Fusion Middleware, Data Visualization Tools component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote unauthenticated attacker read all JDeveloper-accessible data and modify some of it over HTTP, with a scope change that can significantly impact adjacent Oracle products. Oracle rates it CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but non-trivial given the unauthenticated network vector.
Full takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 is possible when a low-privileged attacker with HTTP network access exploits a flaw in the Installation Security component. Because the CVSS scope is changed (S:C), a successful attack does not stay contained to EnterpriseOne Tools but can significantly impact additional connected products, yielding full confidentiality, integrity, and availability loss (CVSS 9.9). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Local privilege escalation to full product takeover in Oracle Data Integrator (Studio component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a low-privileged attacker who can log on to the host where ODI runs fully compromise the product with high confidentiality, integrity, and availability impact. Oracle rates it CVSS 3.1 7.8; there is no public exploit identified at time of analysis and it is not on the CISA KEV list. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update.
Data compromise in Oracle MySQL Connector/J (MySQL Connectors 9.7.0 through 9.7.1) allows a low-privileged attacker with network access over multiple protocols to read, create, delete, or modify all data accessible to the connector and to cause a partial denial of service. Oracle rates this CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), reflecting high difficulty of exploitation but broad confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Unauthorized information disclosure in Oracle JDeveloper (Fusion Middleware Security Framework) versions 12.2.1.4.0 and 14.1.2.0.0 lets a network attacker read critical data without credentials. Remote unauthenticated attackers reaching the product over HTTP can obtain complete access to all JDeveloper-accessible data, with a CVSS 3.1 base score of 7.5 driven entirely by confidentiality impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag 'Authentication Bypass' suggests the flaw stems from a missing or broken authentication check.
Full system takeover in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 is possible when an unauthenticated remote attacker reaches the Web Runtime Security component over HTTP, per Oracle's July 2026 Critical Patch Update. Despite requiring no credentials, the attack is rated hard to execute (CVSS 3.1 8.1, AC:H), and success yields complete confidentiality, integrity, and availability compromise of the Tools layer. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Full application takeover in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (Time Accounting and HRM Base component) allows an authenticated, low-privileged attacker to compromise the product over HTTP. Per the CVSS vector (PR:L), a valid low-privilege account is required and exploitation is difficult (AC:H), but success yields high confidentiality, integrity, and availability impact — effectively total compromise of the HCM Foundation instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle JD Edwards EnterpriseOne Procurement and Subcontract Management (version 9.2) is achievable by a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 score of 8.8 and Oracle explicitly characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the Procurement component (confidentiality, integrity, and availability all high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authenticated-yet-low-barrier profile makes it a strong patch priority for JD Edwards operators.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) lets remote attackers reach the application over HTTP and read all data the module can access, with limited unauthorized insert/update/delete on some data. Vendor and community tags flag this as an authentication bypass, aligning with the PR:N (no privileges) CVSS vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 8.2.
Data manipulation and denial-of-service in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Person Data component) lets a low-privileged, network-authenticated attacker create, delete or modify critical data, read a subset of accessible data, and trigger a repeatable crash of the module. The flaw carries a CVSS 3.1 base score of 7.1 and is flagged as difficult to exploit (AC:H). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 allows a remote, unauthenticated attacker to read, create, modify, or delete critical application data over HTTP. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact), making it easily exploitable without user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patching target.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Higher Ed Statistics Agency - UK HESA component) lets a remote, unauthenticated attacker reach all data accessible to the Student Records module over HTTP. The flaw is easily exploitable per Oracle and, tagged as an authentication bypass, yields high confidentiality impact with no integrity or availability effect (CVSS 3.1 7.5). No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Full takeover of Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 is possible for a low-privileged attacker with network (HTTP) access to the Security component, resulting in high confidentiality, integrity and availability impact. Oracle rates this CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H), and it requires an authenticated (low-privilege) session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Privilege-escalating takeover of Oracle PeopleSoft Enterprise CS Student Records (Campus Solutions) 9.2.38, specifically the Australian Features component, allows a low-privileged attacker with only HTTP network access to fully compromise the module. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8), a single valid low-level application account is enough to achieve complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed via the Oracle Critical Patch Update of July 2026.
Full product takeover in Oracle PeopleSoft Enterprise CS Student Financials 9.2.38 (Billing component) allows a low-privileged, authenticated attacker with HTTP network access to compromise the application, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) indicates easy exploitation yielding complete confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Full takeover of Oracle PeopleSoft Enterprise FIN Project Costing 9.2 (Projects component) is achievable by an attacker with logon access to the host infrastructure, exploiting a local flaw that requires tricking a legitimate user into performing an action. Per the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R), exploitation is local and low-complexity but gated on human interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was reported by Oracle and fixed in the July 2026 Critical Patch Update.
Data compromise in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Research Tracking component) lets a low-privileged, network-authenticated attacker over HTTPS read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), it was disclosed in Oracle's July 2026 Critical Patch Update and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle PeopleSoft Enterprise CS Student Records version 9.2.38 (Research Tracking component) allows an authenticated, low-privileged attacker with network HTTP access to take over the module, impacting confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.5 despite high attack complexity (AC:H), reflecting the severity of a complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Cash Management 9.2 allows a remote, unauthenticated attacker to read, create, delete, or modify all data accessible to the Cash Management component over HTTP. The flaw carries a scope change, meaning a successful attack can significantly impact products beyond Cash Management itself. No public exploit identified at time of analysis; the CVSS 3.1 base score is 8.7 driven by high confidentiality and integrity impact, though the vector rates exploitation as difficult (AC:H).
Account takeover in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Integration and Interfaces component) lets a low-privileged, network-based attacker fully compromise the module over HTTP. The Oracle CPU July 2026 advisory rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, and Oracle labels it 'easily exploitable,' meaning any authenticated user can escalate to complete control of the application. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single required privilege make it a strong patching priority for higher-education and enterprise PeopleSoft deployments.
Unauthorized data modification in Oracle PeopleSoft Enterprise FIN Staffing Front Office 9.2 allows a remote, unauthenticated attacker to create, delete, or modify critical data via crafted HTTP requests. The flaw is confined to the Staffing Front Office component and carries an integrity-only impact (CVSS 3.1 7.5, C:N/I:H/A:N). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthorized data disclosure in Oracle MySQL Connector/J (the official MySQL JDBC driver) versions 9.7.0 through 9.7.1 allows a low-privileged attacker with network access to compromise confidentiality, with a scope change that lets the attack significantly impact additional products beyond the connector itself. Fixed in the Oracle Critical Patch Update of July 2026 and tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.7 with high confidentiality impact and no integrity or availability effect. No public exploit identified at time of analysis, and there is no CISA KEV or EPSS signal in the provided data.
Unauthorized data access and partial denial of service in Oracle Transportation Management 6.5.3 (CSV Management component) allow a low-privileged, network-authenticated attacker over HTTP to read all OTM-accessible data, perform limited unauthorized inserts/updates/deletes, and partially degrade availability. Rated CVSS 3.1 7.6 (High). No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.