Oracle
Monthly
Unauthorized data access in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass by Oracle, the flaw presents a moderate but concrete integrity and confidentiality risk for organizations running this specific microservice framework version. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and no user interaction requirement lower the barrier for exploitation by any authenticated user.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows attackers with HTTP network access to read a subset of application-accessible data and trigger partial denial of service conditions. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L vector confirms low-complexity, zero-authentication exploitation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; this issue was disclosed through Oracle's Critical Security Patch Update for August 2026 (EUVD-2026-62158).
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an Authentication Bypass by Oracle Security, the flaw is rated Medium (CVSS 5.4) with low attack complexity, meaning any attacker holding even minimal credentials can trivially exploit it without user interaction. No public exploit code or CISA KEV listing is associated at time of analysis, though the straightforward exploitation conditions make this a credible threat in multi-tenant or shared-access Helidon deployments.
Unauthorized data access and manipulation in Oracle Helidon 4.5.0's Imperative Web Server allows low-privileged network attackers to read restricted data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass, the flaw enables authenticated users to exceed their intended authorization scope within the Helidon application. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though Oracle's August 2026 Critical Patch Update confirms the issue.
Unauthorized read access to data in Oracle Helidon 4.5.1's Imperative Web Server component is achievable by unauthenticated network attackers via HTTP, exploiting what the vendor tags as an authentication bypass condition. The affected version is precisely 4.5.1 of Oracle's Java microservices framework, and the vulnerability exposes a subset of data accessible to the server without requiring any credentials or user interaction. No public exploit has been identified at time of analysis, and Oracle has disclosed this issue as part of its August 2026 Critical Patch Update.
Authentication bypass in Oracle Helidon 3.2.19 Imperative Web Server exposes critical data to unauthenticated network attackers via HTTP. The flaw, tagged as an Authentication Bypass by the reporter, allows a remote attacker without credentials to gain complete read access to all data accessible by the Helidon server instance. No public exploit code or active exploitation has been identified at time of analysis; however, the high confidentiality impact warrants timely patching in any environment running this specific version.
The Imperative Web Server in Oracle Helidon 4.5.0 exposes an authentication bypass that permits remote unauthenticated HTTP attackers to read a subset of application-accessible data. Tagged by Oracle CSIRT as an authentication bypass and disclosed in the August 2026 Critical Patch Update, the flaw carries a CVSS 5.3 Medium score with network-accessible, zero-complexity exploitation conditions - conditions that may understate practical risk given the complete absence of authentication prerequisites. No active exploitation has been confirmed via CISA KEV, and no public exploit code was identified at time of analysis.
Unauthorized data access and modification is possible in Oracle Helidon 4.5.1 via a flaw in its Imperative Web Server component, classified under the Authentication Bypass tag. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that unauthenticated remote attackers can exploit this over HTTP with no user interaction and low attack complexity. Successful exploitation results in partial confidentiality and integrity compromise of Helidon-accessible data; no patch version has been independently confirmed beyond the Oracle August 2026 CPU advisory.
Unauthorized data access in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated network-based attackers to read a subset of Helidon-accessible data and perform unauthorized insert, update, or delete operations against the same data store. The 'Authentication Bypass' tag in the intelligence feeds indicates the underlying mechanism circumvents expected access controls on HTTP endpoints. With AC:H, exploitation is non-trivial - specific conditions must be met - and no active exploitation has been identified; however, the unauthenticated network vector warrants patching in production deployments.
Unauthorized read access to application data is achievable against Oracle Helidon 4.5.1's Imperative Web Server component via unauthenticated HTTP requests. The vulnerability, tagged as an Authentication Bypass, allows remote attackers with network access to retrieve a subset of data without credentials, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). No public exploit has been identified at time of analysis, and the issue is addressed in Oracle's Critical Patch Update for August 2026.
Unauthorized data read in Oracle Helidon 3.2.19's Imperative Web Server component allows unauthenticated remote attackers to access a subset of protected application data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network-level exploitation with no credentials or user interaction required, consistent with the intelligence tag of Authentication Bypass. Impact is bounded to confidentiality only (C:L, I:N, A:N), suggesting an access control bypass that exposes a partial data view rather than full system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting or client-side injection in Oracle Helidon 4.5.0's Imperative Web Server component enables unauthenticated, network-accessible attacks that produce partial confidentiality and integrity impacts while extending harm to additional products through a scope change. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is the canonical fingerprint of reflected or stored XSS - an attacker delivers a crafted HTTP payload that, once interacted with by a victim user, executes within a different security scope such as a browser session. No public exploit code has been identified and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; Oracle disclosed it through the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Helidon 4.1.0's Imperative Web Server component allows network-accessible attackers to bypass authentication controls via HTTP, resulting in unauthorized partial read and write access to application data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable with no prerequisites beyond network reachability, and the 'Authentication Bypass' tag corroborates an access-control failure in the web server layer. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and zero-authentication requirement make this an attractive target for automated scanning.
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2 permits partial data disclosure and partial denial of service without any credentials or user interaction. Oracle's own advisory characterizes this as 'easily exploitable', and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-prerequisite network reachability. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to partial confidentiality and availability degradation rather than full system compromise.
Unauthorized data exposure in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated network attackers to read a subset of application-accessible data via HTTP. Tagged as an authentication bypass, the vulnerability is trivially exploitable with no complexity barriers - any attacker with HTTP access to the service can trigger it. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and impact is constrained to partial confidentiality loss with no integrity or availability consequences.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows network-adjacent attackers to bypass authentication and perform unauthorized read and write operations on application data over HTTP. Tagged explicitly as an Authentication Bypass by Oracle's security team, this vulnerability exposes a subset of Helidon-accessible data to disclosure and tampering without requiring credentials or user interaction. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the low attack complexity and zero-privilege requirement make it a straightforward target for automated scanning.
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network attackers to read a subset of application-accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability, tagged as an Authentication Bypass by Oracle, is remotely exploitable without credentials or user interaction against the affected version. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and absence of authentication requirements make this straightforward to exploit once a target instance is identified.
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated remote attackers to read a subset of application-accessible data via HTTP. The vulnerability is tagged as an authentication bypass, meaning protections that should gate read access can be circumvented without credentials. No public exploit code has been identified at time of analysis, and it has not been listed in the CISA KEV catalog, though Oracle disclosed this via their August 2026 Critical Patch Update (CPU).
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server enables unauthenticated remote attackers to read a subset of application-accessible data via HTTP, confirmed by Oracle's August 2026 Critical Patch Update. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable, zero-complexity network access requiring no authentication or user interaction. No public exploit has been identified at time of analysis, though the 'Authentication Bypass' tag from multi-source intelligence indicates a structural access control failure in the HTTP request handling pipeline.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component allows a low-privileged, network-adjacent attacker to read unauthorized data subsets and perform unauthorized insert, update, or delete operations via HTTP. Rated CVSS 5.4 Medium with low attack complexity and no user interaction required, this flaw is tagged as an authentication bypass by multi-source intelligence, suggesting a low-privileged user can exceed their authorized scope within the Helidon web layer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local high-privilege information disclosure in Oracle Helidon 4.5.1's Imperative Web Server component allows an attacker with OS-level logon access to the hosting infrastructure to read all data accessible to the Helidon process. The CVSS vector (AV:L/AC:L/PR:H) confirms exploitation is constrained to local infrastructure access with elevated credentials, resulting in complete confidentiality loss (C:H) with no integrity or availability impact. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Authentication bypass in Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to read a subset of data accessible within the Helidon service over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable from any network location against default deployments without credentials. Impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequence, though the 'Authentication Bypass' tag suggests access-control logic failures that may expose protected endpoints. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows a low-privileged, network-authenticated attacker to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability is tagged as an authentication bypass, suggesting that existing access controls within the Imperative Web Server can be circumvented by an attacker who holds any valid low-privilege credential. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized write, insert, or delete operations. Exploitation via HTTP requires high attack complexity and at least low-level authentication, limiting opportunistic mass exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data disclosure in Oracle Helidon 4.5.0 affects the Imperative Web Server component, enabling unauthenticated network attackers to read a subset of accessible application data via HTTP. Tagged as an authentication bypass, the flaw requires no privileges or user interaction, making it trivially reachable from any network vantage point. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, though its zero-authentication, low-complexity profile warrants timely patching in network-exposed deployments.
Unauthorized data read in Oracle Helidon 3.2.18 allows unauthenticated remote attackers to access a subset of data served by the Imperative Web Server component over HTTP, with no credentials or user interaction required. Tagged as an Authentication Bypass by Oracle CERT, the flaw is classified as 'easily exploitable' in Oracle's August 2026 Critical Patch Update advisory. No public exploit code or active exploitation has been identified at time of analysis, but the absence of any authentication prerequisite lowers the bar for opportunistic reconnaissance.
Cross-site scripting or authentication bypass in Oracle Helidon 4.1 Imperative Web Server (version 4.5.0) allows unauthenticated remote attackers to perform unauthorized read and write operations against Helidon-accessible data, with scope change extending impact to additional dependent products. Exploitation requires victim interaction, consistent with a reflected XSS or similar client-side injection pattern in the HTTP server component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this accessible to unsophisticated attackers once a victim is lured.
Cross-site scripting or equivalent client-side injection in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to compromise confidentiality and integrity of Helidon-accessible data when a victim user interacts with attacker-controlled content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is a canonical XSS fingerprint - scope change combined with user interaction and partial C/I impact - despite the 'Authentication Bypass' tag in the intelligence metadata, which may indicate a secondary or misclassified characteristic. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component exposes HTTP endpoints to unauthenticated network attackers, enabling unauthorized read access to a subset of application data and unauthorized write, insert, or delete operations on accessible data. The flaw, tagged as an Authentication Bypass by Oracle and reported via the August 2026 Critical Patch Update, is reachable by any attacker with HTTP connectivity to the service with no complexity barriers. No public exploit code has been identified and the vulnerability is not currently listed in CISA KEV, but the zero-authentication network attack vector warrants prompt patching of affected Helidon 4.5.0 deployments.
Unauthenticated network exploitation of Oracle Helidon 3.2.18's Imperative Web Server component allows remote attackers to bypass authentication controls, gaining unauthorized read access to a subset of application data and unauthorized write/insert/delete capability against some accessible data. Tagged as an authentication bypass by Oracle Security (secalert_us@oracle.com), the vulnerability requires no privileges and no user interaction, making it trivially automatable over HTTP. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle has disclosed this via their August 2026 Critical Patch Update.
Unauthorized data access in Oracle Helidon 3.2.18 (Imperative Web Server component) allows a low-privileged, network-adjacent attacker to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass, the flaw enables privilege escalation beyond the attacker's authorized scope within the web server layer. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in source intelligence.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server component exposes sensitive application data to unauthenticated network attackers over HTTP. Successful exploitation yields complete read access to all Helidon-accessible data and limited write capability (insert, update, delete), with no availability impact. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the high attack complexity rating tempers immediate mass-exploitation risk, though the confidentiality impact warrants prompt patching for internet-exposed deployments.
Helidon 3.2.18's Imperative Web Server component exposes an unauthenticated, network-accessible denial-of-service condition via HTTP that allows remote attackers to partially degrade service availability without any credentials or user interaction. Only the Availability dimension is affected - Confidentiality and Integrity remain intact - classifying this as a medium-severity partial DoS. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower operational priority tier despite its trivial exploitation conditions.
Unauthorized data read in Oracle Helidon 4.5.0's Imperative Web Server component exposes a subset of server-accessible data to unauthenticated remote attackers over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable without credentials, and the 'Authentication Bypass' tag from intelligence sources suggests access controls within the Imperative Web Server are being circumvented rather than simply an information leak. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Unauthenticated remote data modification is possible in Oracle Helidon 3.2.19 via its Imperative Web Server component, exploitable over HTTP with no credentials or user interaction required. Successful exploitation allows an attacker to perform unauthorized insert, update, or delete operations on data accessible to the Helidon instance, with no confidentiality or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Local exploitation of Oracle Helidon 4.5.0's Imperative Web Server component enables a low-privileged attacker with infrastructure logon to bypass authentication controls and gain unauthorized access to all data accessible by the Helidon process, with limited write capability. Confirmed by Oracle's Critical Patch Update for August 2026 and corroborated by EUVD-2026-62096, this carries a CVSS 3.1 score of 6.1. No public exploit code or active exploitation has been identified at time of analysis.
Oracle VM VirtualBox 7.2.14 Core component allows a low-privileged local attacker to read critical data, with the impact scope extending beyond the VirtualBox instance itself - potentially exposing host system or cross-VM sensitive data. Exploitation is constrained by high attack complexity and mandatory local access, making mass exploitation impractical; targeted insider or post-compromise scenarios represent the realistic threat model. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the official Oracle CPU advisory for August 2026 is the authoritative source.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a local privilege-assisted attack in its Security component, allowing a low-privileged authenticated user who can log on to the host infrastructure to partially compromise confidentiality, integrity, and availability. The attack demands high complexity and requires interaction from a secondary human actor, placing it firmly in the category of difficult, opportunistic local exploitation. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed by Oracle via the August 2026 Critical Security Patch Update.
Unauthenticated read-access exposure in Oracle Hyperion Financial Management 11.2.25.0.000 allows remote attackers to retrieve a subset of application data via HTTP without any credentials. The flaw resides in the Security component and is tagged as an Authentication Bypass, meaning the component fails to enforce proper access controls on at least one HTTP-accessible endpoint. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the trivial attack conditions (AC:L/PR:N/UI:N) lower the bar for opportunistic reconnaissance.
Partial integrity and availability compromise in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over HTTP, provided high attack complexity conditions are met and a victim user interacts during the attack. Successful exploitation allows unauthorized modification or deletion of a subset of accessible data and can cause a partial denial of service. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a local availability vulnerability in its Security component, allowing a high-privileged attacker already logged on to the host infrastructure to cause a partial denial of service. The attack is difficult to execute, requires existing elevated local access, and results only in limited availability degradation with no confidentiality or integrity impact. No public exploit or active exploitation has been identified; CVSS 3.1 Base Score is 1.9, placing this among the lowest-severity tracked vulnerabilities.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a network-accessible vulnerability in its Security component that allows a low-privileged, authenticated attacker to partially compromise data confidentiality and integrity across product boundaries via HTTP. Exploitation requires both high attack complexity and victim interaction, limiting opportunistic exploitation but not eliminating targeted risk in enterprise financial environments. No public exploit code has been identified at time of analysis, and the vulnerability is tagged as an Authentication Bypass by the reporting source, suggesting the Security component may fail to enforce authorization boundaries under specific conditions.
Local privilege abuse in Oracle Hyperion Financial Management 11.2.25.0.000 allows a high-privileged attacker with logon access to the host infrastructure to read a subset of accessible data and perform unauthorized insert, update, or delete operations against that data. The vulnerability resides in the Security component and carries a CVSS 3.1 base score of 3.0, reflecting its constrained local attack vector, high complexity, and high privilege prerequisites. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Oracle VM VirtualBox 7.2.14 (Core component) exposes a low-severity local vulnerability that permits a high-privileged attacker with logon access to the host infrastructure to perform unauthorized read and limited write operations against a subset of VirtualBox-accessible data. Confidentiality and integrity are partially affected; availability is not impacted. No public exploit has been identified at time of analysis, and the combination of local-only attack vector and required high-privilege access significantly narrows the realistic attacker population.
Denial-of-service in Oracle VM VirtualBox 7.2.14 Core component allows a high-privileged local attacker to repeatably crash or hang the hypervisor, taking down all hosted virtual machines. Exploitation requires high-privilege local logon access to the host, and Oracle's August 2026 CPU includes a fix. No public exploit code and no CISA KEV listing have been identified, keeping real-world risk limited despite the "easily exploitable" descriptor used by Oracle.
Oracle VM VirtualBox 7.2.14 contains a local privilege-escalation-to-DoS flaw in the Core component that allows a highly privileged host user to repeatedly crash or hang the hypervisor, with scope change meaning hosted guest VMs are also disrupted. The attack requires local logon and high privileges on the host infrastructure, substantially limiting the attacker pool to insiders or already-compromised privileged accounts. No public exploit code or active exploitation has been identified at time of analysis; EPSS data was not provided.
Oracle VM VirtualBox 7.2.14 Core component allows a high-privileged local attacker to trigger a complete denial-of-service condition - causing a hang or frequently repeatable crash of the hypervisor - with a confirmed scope change that can significantly impact additional products beyond VirtualBox itself, likely the host operating system or co-resident guest VMs. The vulnerability is exploitable by an attacker with administrator-level access already present on the host infrastructure, making it most relevant in multi-tenant or shared virtualization environments where privileged-but-not-hypervisor-owner threat actors are a realistic model. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle VM VirtualBox 7.2.14 contains a locally exploitable flaw in its Core component that grants high-privileged local attackers partial read, write, and denial-of-service capabilities, with a confirmed scope change meaning the impact can extend to products or components beyond VirtualBox itself. The vulnerability is described as 'easily exploitable' by Oracle, though the high privilege and local access requirements substantially constrain the realistic attacker pool. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle VM VirtualBox 7.2.14 Core component exposes a local confidentiality vulnerability enabling a high-privileged attacker with local infrastructure access to read critical data across VM isolation boundaries, with confirmed scope change indicating potential host or cross-VM data exposure. The CVSS vector (AV:L/AC:H/PR:H/S:C/C:H/I:N/A:N) reflects a narrow but impactful attack path constrained by high complexity and privilege prerequisites. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, placing it in a low-urgency tier for most environments despite the high confidentiality impact when scope change is considered.
Oracle VM VirtualBox 7.2.14 Core component allows a high-privileged local attacker to cause a complete denial of service - hang or repeatable crash - with a scope change that can impact additional products beyond VirtualBox itself, such as guest virtual machines sharing the same host. The vulnerability is locally-triggered and requires existing privileged access to the infrastructure, limiting opportunistic exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, and EPSS data was not available in the provided intelligence.
Oracle VM VirtualBox 7.2.14 Core component exposes a locally exploitable denial-of-service condition that can be triggered by a high-privileged attacker with logon access to the host infrastructure. Exploitation results in a complete, repeatably triggerable crash or hang of the VirtualBox process, with scope change indicated - meaning the disruption can cascade to guest virtual machines and other co-hosted workloads. No public exploit code exists and no active exploitation has been identified at time of analysis.
Oracle VM VirtualBox 7.2.14 (Core component) is affected by a locally exploitable vulnerability that allows a low-privileged, unauthenticated local user to cause a complete denial of service - a hang or repeatable crash - of the hypervisor, as well as unauthorized modification of a subset of its accessible data. Exploitation requires physical or logical local access to the host infrastructure and human interaction from a separate user (e.g., a legitimate VirtualBox user performing a VM operation). No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Partial denial-of-service exposure in Oracle Access Manager's Authorization Engine affects supported versions 12.2.1.4.0 and 14.1.2.1.0, reachable by any low-privileged network user over TCP. An authenticated attacker with minimal account privileges can disrupt availability of the Authorization Engine, potentially interrupting access-control decisions for applications federated through OAM. No public exploit code has been identified at time of analysis, and impact is bounded to partial availability degradation with no confidentiality or integrity exposure.
Unauthorized data access and modification in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, contingent on human interaction from a victim. The vulnerability resides in the Security component and is tagged as an Authentication Bypass, enabling partial confidentiality and integrity compromise without attacker credentials. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, but the low attack complexity and zero privilege requirement make social-engineering-assisted attacks practical against exposed instances.
Unauthenticated network exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 enables remote attackers to perform unauthorized data manipulation and cause partial denial of service via HTTP against the Security component. The vulnerability requires no credentials and no user interaction, making it trivially accessible to any attacker with network reach to the application. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis; however, the unauthenticated, network-accessible attack surface warrants prompt patching.
Denial-of-service in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-adjacent attacker to cause the application to hang or crash repeatedly via crafted HTTP requests targeting the Security component. The flaw is rated Medium (CVSS 5.3) due to high attack complexity, meaning exploitation requires specific conditions to be met beyond simply having network access. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged attacker with local logon access to the host infrastructure, exploiting a flaw in the Security component under conditions of high attack complexity. Despite a moderate CVSS base score of 6.4 - dampened by strict access prerequisites - successful exploitation yields complete confidentiality, integrity, and availability compromise of the application. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes an authentication bypass in its Security component that permits unauthenticated network attackers to perform limited unauthorized read and write operations on accessible financial data via HTTP. The attack is classified as difficult to exploit (AC:H), constraining realistic risk despite the absence of any authentication requirement. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed through Oracle's Critical Security Patch Update for August 2026.
Oracle VM VirtualBox 7.2.14 Core component contains a vulnerability that allows a high-privileged local attacker to breach VM isolation boundaries and access all confidential data accessible to VirtualBox, including data from guest virtual machines. The CVSS scope-change metric (S:C) confirms that successful exploitation extends impact beyond the VirtualBox process itself, enabling unauthorized read access to critical data across VM boundaries. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the EUVD 'Authentication Bypass' tag suggests the vulnerability may undermine guest-level authentication or isolation enforcement mechanisms.
Confidentiality compromise in Oracle VM VirtualBox 7.2.14 Core component allows a locally authenticated, high-privileged attacker to access all data reachable by the VirtualBox process and breach isolation boundaries to impact additional products via scope change. The 'Authentication Bypass' tag supplied by the reporter suggests an internal access-control bypass within VirtualBox's security model that extends an attacker's data reach beyond their normally authorized scope. No public exploit code or active exploitation has been confirmed at time of analysis.
Full takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged local attacker targeting the Security component, resulting in complete compromise of confidentiality, integrity, and availability. The attack requires logon access to the infrastructure host where the application runs, limiting exposure to insider threats or attackers who have already established a foothold with elevated privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the local-only attack vector substantially constrains real-world risk despite the full CIA impact.
Confidentiality breach in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible within the application via HTTP, including sensitive financial consolidation records. The vulnerability resides in the Security component and carries an 'Authentication Bypass' classification, suggesting improper enforcement of authorization controls that permits privilege escalation beyond the attacker's intended access level. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high attack complexity requirement indicates exploitation demands specific environmental or application-state conditions.
Local denial-of-service in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged attacker with logon access to the hosting infrastructure to hang or repeatedly crash the application via its Security component. The CVSS vector confirms this is a local, high-complexity attack with no confidentiality or integrity impact - purely an availability concern. No public exploit code and no CISA KEV listing exist at time of analysis, and the combination of local access requirement and high attack complexity substantially limits opportunistic exploitation.
Partial unauthorized data access and service disruption in Oracle Hyperion Financial Management 11.2.25.0.000 can be achieved by low-privileged, network-accessible attackers via HTTP targeting the Security component. Exploitation allows unauthorized read of a subset of application data, unauthorized update or insert of accessible data, and partial denial of service - all without user interaction. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated network exposure in Oracle Database Server's RDBMS component allows remote attackers to read a subset of database-accessible data via Oracle Net without any credentials. Affected across three major release trains - 19c (19.3-19.32), 21c (21.3-21.23), and 23ai (23.4.0-23.26.3) - the flaw is tagged as an authentication bypass, suggesting the Oracle Net listener or a pre-auth code path fails to enforce access controls before returning data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to attempt at scale.
SQL-based exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 enables a high-privileged authenticated attacker to achieve complete read and write access to all financial data within the application. The Security component - the logical gatekeeper for data authorization - is the attack surface, and successful exploitation grants unauthorized creation, deletion, modification, and disclosure of critical financial records. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the 'Authentication Bypass' tag warrants scrutiny given the contradiction with the PR:H CVSS metric (see risk assessment).
Hyperion Financial Management version 11.2.25.0.000 exposes authenticated low-privileged network attackers to a tri-impact vulnerability in its Security component: complete, repeatable denial of service via application hang or crash, limited unauthorized data modification, and partial unauthorized data disclosure. Exploitation requires a valid low-privileged account, HTTP network access, and conditions of high attack complexity - factors that collectively reduce the likelihood of opportunistic or automated attack. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Local information disclosure in Oracle Agile PLM MCAD Connector 3.6 exposes a subset of PLM-accessible data to unauthenticated local attackers exploiting an authentication bypass in the CAX Client component. Exploitation is gated by two significant constraints: the attacker must have local logon access to the infrastructure hosting the connector, and a separate legitimate user must interact with the application during the attack window. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, consistent with the low CVSS 3.1 base score of 3.3.
Unauthorized data disclosure in Oracle Agile PLM MCAD Connector 3.6 allows a low-privileged network attacker to gain complete read access to all data accessible by the CAX Client component via a complex HTTP-based attack requiring victim user interaction. The vulnerability is tagged as an authentication bypass, suggesting the CAX Client component fails to enforce authorization boundaries for a subset of data operations when specific, difficult-to-reproduce conditions are met. No public exploit code or CISA KEV listing exists at time of analysis, and the high attack complexity meaningfully limits opportunistic exploitation.
Unauthorized data read in Oracle Agile PLM MCAD Connector 3.6 exposes a subset of PLM-accessible data to unauthenticated remote attackers via HTTP against the CAX Client component. Tagged explicitly as an Authentication Bypass, the flaw allows any network-reachable attacker to query protected PLM data without credentials, indicating that the CAX Client HTTP interface fails to enforce authentication on at least one data-serving endpoint. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the trivially low attack complexity (AV:N/AC:L/PR:N/UI:N) means exploitation requires no special tooling.
Unauthorized access to all data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged remote attacker exploiting a flaw in the Security component over HTTP. The vulnerability results in complete confidentiality compromise - an attacker can read all data accessible to the application, including sensitive financial consolidation records. No public exploit has been identified at time of analysis, and exploitation is bounded by the requirement for high-privilege credentials, though the 'Authentication Bypass' tag suggests established access may allow security control circumvention beyond the attacker's normal authorization scope.
Local exploitation of MySQL Connector/ODBC 26.7.0 on Oracle MySQL allows any user with OS-level logon to the affected infrastructure to crash or hang the connector process and read a subset of accessible data. The attack requires no authentication to MySQL Connectors itself and no user interaction, making it trivially executable by any local user or process on the host. No public exploit code has been identified at time of analysis, and exploitation is bounded by the requirement for local system access.
Limited confidentiality exposure in Oracle Agile PLM MCAD Connector 3.6 allows a high-privileged local attacker to read a subset of accessible data under constrained conditions. The CVSS 3.1 base score of 1.8 reflects a worst-case scenario requiring local infrastructure access, high privileges, high attack complexity, and mandatory third-party human interaction - a combination rarely satisfied in practice. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world risk is negligible for organizations maintaining least-privilege controls on the host infrastructure.
Local information disclosure in Oracle Agile PLM MCAD Connector version 3.6 allows a low-privileged, locally authenticated attacker to read a subset of data accessible to the CAX Client component under high-complexity exploitation conditions. Reported by Oracle Security (secalert_us@oracle.com) as part of the August 2026 Critical Patch Update and tracked under ENISA EUVD-2026-62027, this vulnerability carries a CVSS 3.1 base score of 2.5, reflecting strictly limited confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed.
Local integrity compromise in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) requires an attacker with high privileges and physical or logical logon access to the host infrastructure, under high-complexity conditions, to perform unauthorized data modification against accessible records. The attack yields only limited integrity impact - no confidentiality or availability loss - and no public exploit code or active exploitation has been identified at time of analysis. Notably, the 'Authentication Bypass' tag applied by the reporter conflicts with the PR:H CVSS vector, and this discrepancy is unresolved by available data.
Limited data exposure in Oracle Agile PLM MCAD Connector version 3.6 allows an unauthenticated attacker with access to the same physical network segment as the target host to partially read and modify application data. Exploitation is constrained by adjacent-only network access, high attack complexity, and a mandatory human-interaction requirement, resulting in a low CVSS 3.1 base score of 3.7. No public exploit code or active exploitation has been identified at time of analysis.
Network-exploitable denial-of-service in Oracle MySQL Connector/ODBC 26.7.0 allows low-privileged authenticated attackers to cause a complete hang or repeatable crash of the connector via multiple protocols. Oracle characterizes this as easily exploitable, consistent with the low-complexity, low-privilege CVSS vector (AV:N/AC:L/PR:L). No public exploit code or active exploitation has been identified at time of analysis, though the availability impact is rated High with no confidentiality or integrity exposure.
Oracle Agile PLM MCAD Connector version 3.6 exposes a local, privilege-dependent attack path through its CAX Client component, enabling a low-privileged authenticated local attacker to partially compromise data confidentiality, integrity, and availability within the PLM environment. Exploitation is constrained by a mandatory human-interaction requirement and high attack complexity, making opportunistic or remote exploitation infeasible. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog; the vendor-assigned CVSS 3.1 score of 4.2 reflects the limited blast radius.
Confidentiality compromise in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) allows an unauthenticated attacker with physical access to the local network segment to gain unauthorized access to all data accessible by the connector. The attack is adjacent-network and high-complexity, limiting realistic exposure to insider threats or attackers with pre-existing physical network presence. No public exploit code exists and no active exploitation has been confirmed; CVSS 5.3 reflects the constrained attack vector. The 'Authentication Bypass' tag suggests the vulnerability circumvents a credential or session-validation mechanism within the CAX Client, enabling direct data exposure without credential theft.
Unauthenticated network access to Oracle Agile PLM MCAD Connector 3.6 exposes a subset of data managed by the CAX Client component over plain HTTP, with no privileges or user interaction required. Classified as an authentication bypass (EUVD-2026-62021) and described as 'easily exploitable' in Oracle's CSPU August 2026 advisory, this vulnerability carries a CVSS 3.1 score of 5.3 with purely confidentiality impact and no integrity or availability risk. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) exposes critical PLM data to unauthenticated attackers who have physical adjacency to the network segment where the connector hardware operates. The vulnerability enables unauthorized read access to all connector-accessible data and limited write access, scored CVSS 5.9 Medium due to the adjacent-network attack vector and high complexity constraints. No public exploit code or CISA KEV listing has been identified at time of analysis.
MySQL Connector/ODBC version 26.7.0 exposes a local denial-of-service condition that allows an unauthenticated attacker with logon access to the host to cause a complete hang or repeatable crash of the connector, disrupting dependent applications. Exploitation requires human interaction from a third party (UI:R), constraining the realistic attack surface to insider threat or socially engineered scenarios on the affected host. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; availability is the sole impact dimension - confidentiality and integrity are unaffected.
Local low-privileged access to Oracle Agile PLM MCAD Connector 3.6 enables an authenticated attacker to partially degrade availability of the CAX Client component. Oracle's August 2026 Critical Patch Update (CPU) documents this as easily exploitable by any user with a logon to the host infrastructure, resulting in partial denial of service with no confidentiality or integrity impact. No public exploit identified at time of analysis, and CISA KEV listing is absent, placing this firmly in the low-urgency category.
Partial authentication bypass in Oracle Agile PLM MCAD Connector 3.6 exposes confidentiality and integrity of accessible PLM data to low-privileged adjacent-network attackers. The CAX Client component fails to properly restrict data operations, allowing an attacker on the same physical network segment with low-level credentials to read a subset of accessible records and perform unauthorized insert, update, or delete operations. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Unauthorized data disclosure in Oracle Agile PLM MCAD Connector 3.6 allows any low-privileged authenticated attacker with HTTP network access to bypass authorization controls in the CAX Client component and read the entire dataset accessible to the connector. The vulnerability is tagged Authentication Bypass, indicating that after obtaining a minimal credential foothold, no additional privilege escalation is needed to access critical PLM data such as engineering designs and product specifications. Oracle's own advisory characterizes the flaw as 'easily exploitable,' and no public exploit code or CISA KEV listing has been identified at time of analysis.
Local exploitation of Oracle Agile PLM MCAD Connector version 3.6 enables an unauthenticated attacker with infrastructure-level logon to partially compromise the CAX Client component, resulting in limited unauthorized read, write, and denial-of-service impact. Exploitation is constrained by both high attack complexity and a mandatory human interaction requirement from a third party, making opportunistic attacks unlikely. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized confidential data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 exposes complete application-accessible data to a network-based attacker already holding high-level privileges, exploiting a flaw within the Security component via HTTP. EUVD metadata tags this as an Authentication Bypass, suggesting an access-control enforcement failure that allows an authenticated high-privileged user to exceed authorized data boundaries rather than a perimeter bypass open to unauthenticated parties. No public exploit code has been identified, and the vulnerability has not appeared in CISA KEV at time of analysis; the high attack complexity further constrains realistic exploitation.
Local confidentiality compromise in Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 allows a low-privileged authenticated local attacker to gain unauthorized read access to all data accessible by the application via the Endeca Application Controller component. Oracle classifies this as easily exploitable with low attack complexity, indicating reliable exploitation without special tooling for any user holding a local logon on the affected host. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Cross-site scripting or injection via the Endeca Application Controller in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows an unauthenticated remote attacker to cause unauthorized read and write access to data by luring a victim user to interact with a malicious HTTP request. The CVSS scope change (S:C) signals that a successful exploit extends impact beyond the vulnerable component itself - consistent with browser-context compromise such as session theft or UI redress, which aligns with the 'Authentication Bypass' tag. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server allows unauthenticated network attackers to bypass authentication over HTTP and gain complete read access to critical data, including data accessible across additional connected products due to a confirmed scope change. The vulnerability is rated CVSS 6.8 with high attack complexity, meaning exploitation requires specific conditions to be met, which limits opportunistic mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Authentication Bypass tag and scope-change impact make this a material risk for Oracle Fusion Middleware deployments running the affected version.
Unauthorized data access in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass by Oracle, the flaw presents a moderate but concrete integrity and confidentiality risk for organizations running this specific microservice framework version. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and no user interaction requirement lower the barrier for exploitation by any authenticated user.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows attackers with HTTP network access to read a subset of application-accessible data and trigger partial denial of service conditions. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L vector confirms low-complexity, zero-authentication exploitation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; this issue was disclosed through Oracle's Critical Security Patch Update for August 2026 (EUVD-2026-62158).
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an Authentication Bypass by Oracle Security, the flaw is rated Medium (CVSS 5.4) with low attack complexity, meaning any attacker holding even minimal credentials can trivially exploit it without user interaction. No public exploit code or CISA KEV listing is associated at time of analysis, though the straightforward exploitation conditions make this a credible threat in multi-tenant or shared-access Helidon deployments.
Unauthorized data access and manipulation in Oracle Helidon 4.5.0's Imperative Web Server allows low-privileged network attackers to read restricted data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass, the flaw enables authenticated users to exceed their intended authorization scope within the Helidon application. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though Oracle's August 2026 Critical Patch Update confirms the issue.
Unauthorized read access to data in Oracle Helidon 4.5.1's Imperative Web Server component is achievable by unauthenticated network attackers via HTTP, exploiting what the vendor tags as an authentication bypass condition. The affected version is precisely 4.5.1 of Oracle's Java microservices framework, and the vulnerability exposes a subset of data accessible to the server without requiring any credentials or user interaction. No public exploit has been identified at time of analysis, and Oracle has disclosed this issue as part of its August 2026 Critical Patch Update.
Authentication bypass in Oracle Helidon 3.2.19 Imperative Web Server exposes critical data to unauthenticated network attackers via HTTP. The flaw, tagged as an Authentication Bypass by the reporter, allows a remote attacker without credentials to gain complete read access to all data accessible by the Helidon server instance. No public exploit code or active exploitation has been identified at time of analysis; however, the high confidentiality impact warrants timely patching in any environment running this specific version.
The Imperative Web Server in Oracle Helidon 4.5.0 exposes an authentication bypass that permits remote unauthenticated HTTP attackers to read a subset of application-accessible data. Tagged by Oracle CSIRT as an authentication bypass and disclosed in the August 2026 Critical Patch Update, the flaw carries a CVSS 5.3 Medium score with network-accessible, zero-complexity exploitation conditions - conditions that may understate practical risk given the complete absence of authentication prerequisites. No active exploitation has been confirmed via CISA KEV, and no public exploit code was identified at time of analysis.
Unauthorized data access and modification is possible in Oracle Helidon 4.5.1 via a flaw in its Imperative Web Server component, classified under the Authentication Bypass tag. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that unauthenticated remote attackers can exploit this over HTTP with no user interaction and low attack complexity. Successful exploitation results in partial confidentiality and integrity compromise of Helidon-accessible data; no patch version has been independently confirmed beyond the Oracle August 2026 CPU advisory.
Unauthorized data access in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated network-based attackers to read a subset of Helidon-accessible data and perform unauthorized insert, update, or delete operations against the same data store. The 'Authentication Bypass' tag in the intelligence feeds indicates the underlying mechanism circumvents expected access controls on HTTP endpoints. With AC:H, exploitation is non-trivial - specific conditions must be met - and no active exploitation has been identified; however, the unauthenticated network vector warrants patching in production deployments.
Unauthorized read access to application data is achievable against Oracle Helidon 4.5.1's Imperative Web Server component via unauthenticated HTTP requests. The vulnerability, tagged as an Authentication Bypass, allows remote attackers with network access to retrieve a subset of data without credentials, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). No public exploit has been identified at time of analysis, and the issue is addressed in Oracle's Critical Patch Update for August 2026.
Unauthorized data read in Oracle Helidon 3.2.19's Imperative Web Server component allows unauthenticated remote attackers to access a subset of protected application data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network-level exploitation with no credentials or user interaction required, consistent with the intelligence tag of Authentication Bypass. Impact is bounded to confidentiality only (C:L, I:N, A:N), suggesting an access control bypass that exposes a partial data view rather than full system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting or client-side injection in Oracle Helidon 4.5.0's Imperative Web Server component enables unauthenticated, network-accessible attacks that produce partial confidentiality and integrity impacts while extending harm to additional products through a scope change. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is the canonical fingerprint of reflected or stored XSS - an attacker delivers a crafted HTTP payload that, once interacted with by a victim user, executes within a different security scope such as a browser session. No public exploit code has been identified and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; Oracle disclosed it through the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Helidon 4.1.0's Imperative Web Server component allows network-accessible attackers to bypass authentication controls via HTTP, resulting in unauthorized partial read and write access to application data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable with no prerequisites beyond network reachability, and the 'Authentication Bypass' tag corroborates an access-control failure in the web server layer. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and zero-authentication requirement make this an attractive target for automated scanning.
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2 permits partial data disclosure and partial denial of service without any credentials or user interaction. Oracle's own advisory characterizes this as 'easily exploitable', and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-prerequisite network reachability. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to partial confidentiality and availability degradation rather than full system compromise.
Unauthorized data exposure in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated network attackers to read a subset of application-accessible data via HTTP. Tagged as an authentication bypass, the vulnerability is trivially exploitable with no complexity barriers - any attacker with HTTP access to the service can trigger it. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and impact is constrained to partial confidentiality loss with no integrity or availability consequences.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows network-adjacent attackers to bypass authentication and perform unauthorized read and write operations on application data over HTTP. Tagged explicitly as an Authentication Bypass by Oracle's security team, this vulnerability exposes a subset of Helidon-accessible data to disclosure and tampering without requiring credentials or user interaction. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the low attack complexity and zero-privilege requirement make it a straightforward target for automated scanning.
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network attackers to read a subset of application-accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability, tagged as an Authentication Bypass by Oracle, is remotely exploitable without credentials or user interaction against the affected version. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and absence of authentication requirements make this straightforward to exploit once a target instance is identified.
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated remote attackers to read a subset of application-accessible data via HTTP. The vulnerability is tagged as an authentication bypass, meaning protections that should gate read access can be circumvented without credentials. No public exploit code has been identified at time of analysis, and it has not been listed in the CISA KEV catalog, though Oracle disclosed this via their August 2026 Critical Patch Update (CPU).
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server enables unauthenticated remote attackers to read a subset of application-accessible data via HTTP, confirmed by Oracle's August 2026 Critical Patch Update. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable, zero-complexity network access requiring no authentication or user interaction. No public exploit has been identified at time of analysis, though the 'Authentication Bypass' tag from multi-source intelligence indicates a structural access control failure in the HTTP request handling pipeline.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component allows a low-privileged, network-adjacent attacker to read unauthorized data subsets and perform unauthorized insert, update, or delete operations via HTTP. Rated CVSS 5.4 Medium with low attack complexity and no user interaction required, this flaw is tagged as an authentication bypass by multi-source intelligence, suggesting a low-privileged user can exceed their authorized scope within the Helidon web layer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local high-privilege information disclosure in Oracle Helidon 4.5.1's Imperative Web Server component allows an attacker with OS-level logon access to the hosting infrastructure to read all data accessible to the Helidon process. The CVSS vector (AV:L/AC:L/PR:H) confirms exploitation is constrained to local infrastructure access with elevated credentials, resulting in complete confidentiality loss (C:H) with no integrity or availability impact. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Authentication bypass in Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to read a subset of data accessible within the Helidon service over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable from any network location against default deployments without credentials. Impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequence, though the 'Authentication Bypass' tag suggests access-control logic failures that may expose protected endpoints. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows a low-privileged, network-authenticated attacker to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability is tagged as an authentication bypass, suggesting that existing access controls within the Imperative Web Server can be circumvented by an attacker who holds any valid low-privilege credential. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized write, insert, or delete operations. Exploitation via HTTP requires high attack complexity and at least low-level authentication, limiting opportunistic mass exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data disclosure in Oracle Helidon 4.5.0 affects the Imperative Web Server component, enabling unauthenticated network attackers to read a subset of accessible application data via HTTP. Tagged as an authentication bypass, the flaw requires no privileges or user interaction, making it trivially reachable from any network vantage point. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, though its zero-authentication, low-complexity profile warrants timely patching in network-exposed deployments.
Unauthorized data read in Oracle Helidon 3.2.18 allows unauthenticated remote attackers to access a subset of data served by the Imperative Web Server component over HTTP, with no credentials or user interaction required. Tagged as an Authentication Bypass by Oracle CERT, the flaw is classified as 'easily exploitable' in Oracle's August 2026 Critical Patch Update advisory. No public exploit code or active exploitation has been identified at time of analysis, but the absence of any authentication prerequisite lowers the bar for opportunistic reconnaissance.
Cross-site scripting or authentication bypass in Oracle Helidon 4.1 Imperative Web Server (version 4.5.0) allows unauthenticated remote attackers to perform unauthorized read and write operations against Helidon-accessible data, with scope change extending impact to additional dependent products. Exploitation requires victim interaction, consistent with a reflected XSS or similar client-side injection pattern in the HTTP server component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this accessible to unsophisticated attackers once a victim is lured.
Cross-site scripting or equivalent client-side injection in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to compromise confidentiality and integrity of Helidon-accessible data when a victim user interacts with attacker-controlled content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is a canonical XSS fingerprint - scope change combined with user interaction and partial C/I impact - despite the 'Authentication Bypass' tag in the intelligence metadata, which may indicate a secondary or misclassified characteristic. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component exposes HTTP endpoints to unauthenticated network attackers, enabling unauthorized read access to a subset of application data and unauthorized write, insert, or delete operations on accessible data. The flaw, tagged as an Authentication Bypass by Oracle and reported via the August 2026 Critical Patch Update, is reachable by any attacker with HTTP connectivity to the service with no complexity barriers. No public exploit code has been identified and the vulnerability is not currently listed in CISA KEV, but the zero-authentication network attack vector warrants prompt patching of affected Helidon 4.5.0 deployments.
Unauthenticated network exploitation of Oracle Helidon 3.2.18's Imperative Web Server component allows remote attackers to bypass authentication controls, gaining unauthorized read access to a subset of application data and unauthorized write/insert/delete capability against some accessible data. Tagged as an authentication bypass by Oracle Security (secalert_us@oracle.com), the vulnerability requires no privileges and no user interaction, making it trivially automatable over HTTP. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle has disclosed this via their August 2026 Critical Patch Update.
Unauthorized data access in Oracle Helidon 3.2.18 (Imperative Web Server component) allows a low-privileged, network-adjacent attacker to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass, the flaw enables privilege escalation beyond the attacker's authorized scope within the web server layer. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in source intelligence.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server component exposes sensitive application data to unauthenticated network attackers over HTTP. Successful exploitation yields complete read access to all Helidon-accessible data and limited write capability (insert, update, delete), with no availability impact. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the high attack complexity rating tempers immediate mass-exploitation risk, though the confidentiality impact warrants prompt patching for internet-exposed deployments.
Helidon 3.2.18's Imperative Web Server component exposes an unauthenticated, network-accessible denial-of-service condition via HTTP that allows remote attackers to partially degrade service availability without any credentials or user interaction. Only the Availability dimension is affected - Confidentiality and Integrity remain intact - classifying this as a medium-severity partial DoS. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower operational priority tier despite its trivial exploitation conditions.
Unauthorized data read in Oracle Helidon 4.5.0's Imperative Web Server component exposes a subset of server-accessible data to unauthenticated remote attackers over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable without credentials, and the 'Authentication Bypass' tag from intelligence sources suggests access controls within the Imperative Web Server are being circumvented rather than simply an information leak. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Unauthenticated remote data modification is possible in Oracle Helidon 3.2.19 via its Imperative Web Server component, exploitable over HTTP with no credentials or user interaction required. Successful exploitation allows an attacker to perform unauthorized insert, update, or delete operations on data accessible to the Helidon instance, with no confidentiality or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Local exploitation of Oracle Helidon 4.5.0's Imperative Web Server component enables a low-privileged attacker with infrastructure logon to bypass authentication controls and gain unauthorized access to all data accessible by the Helidon process, with limited write capability. Confirmed by Oracle's Critical Patch Update for August 2026 and corroborated by EUVD-2026-62096, this carries a CVSS 3.1 score of 6.1. No public exploit code or active exploitation has been identified at time of analysis.
Oracle VM VirtualBox 7.2.14 Core component allows a low-privileged local attacker to read critical data, with the impact scope extending beyond the VirtualBox instance itself - potentially exposing host system or cross-VM sensitive data. Exploitation is constrained by high attack complexity and mandatory local access, making mass exploitation impractical; targeted insider or post-compromise scenarios represent the realistic threat model. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the official Oracle CPU advisory for August 2026 is the authoritative source.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a local privilege-assisted attack in its Security component, allowing a low-privileged authenticated user who can log on to the host infrastructure to partially compromise confidentiality, integrity, and availability. The attack demands high complexity and requires interaction from a secondary human actor, placing it firmly in the category of difficult, opportunistic local exploitation. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed by Oracle via the August 2026 Critical Security Patch Update.
Unauthenticated read-access exposure in Oracle Hyperion Financial Management 11.2.25.0.000 allows remote attackers to retrieve a subset of application data via HTTP without any credentials. The flaw resides in the Security component and is tagged as an Authentication Bypass, meaning the component fails to enforce proper access controls on at least one HTTP-accessible endpoint. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the trivial attack conditions (AC:L/PR:N/UI:N) lower the bar for opportunistic reconnaissance.
Partial integrity and availability compromise in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over HTTP, provided high attack complexity conditions are met and a victim user interacts during the attack. Successful exploitation allows unauthorized modification or deletion of a subset of accessible data and can cause a partial denial of service. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a local availability vulnerability in its Security component, allowing a high-privileged attacker already logged on to the host infrastructure to cause a partial denial of service. The attack is difficult to execute, requires existing elevated local access, and results only in limited availability degradation with no confidentiality or integrity impact. No public exploit or active exploitation has been identified; CVSS 3.1 Base Score is 1.9, placing this among the lowest-severity tracked vulnerabilities.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a network-accessible vulnerability in its Security component that allows a low-privileged, authenticated attacker to partially compromise data confidentiality and integrity across product boundaries via HTTP. Exploitation requires both high attack complexity and victim interaction, limiting opportunistic exploitation but not eliminating targeted risk in enterprise financial environments. No public exploit code has been identified at time of analysis, and the vulnerability is tagged as an Authentication Bypass by the reporting source, suggesting the Security component may fail to enforce authorization boundaries under specific conditions.
Local privilege abuse in Oracle Hyperion Financial Management 11.2.25.0.000 allows a high-privileged attacker with logon access to the host infrastructure to read a subset of accessible data and perform unauthorized insert, update, or delete operations against that data. The vulnerability resides in the Security component and carries a CVSS 3.1 base score of 3.0, reflecting its constrained local attack vector, high complexity, and high privilege prerequisites. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Oracle VM VirtualBox 7.2.14 (Core component) exposes a low-severity local vulnerability that permits a high-privileged attacker with logon access to the host infrastructure to perform unauthorized read and limited write operations against a subset of VirtualBox-accessible data. Confidentiality and integrity are partially affected; availability is not impacted. No public exploit has been identified at time of analysis, and the combination of local-only attack vector and required high-privilege access significantly narrows the realistic attacker population.
Denial-of-service in Oracle VM VirtualBox 7.2.14 Core component allows a high-privileged local attacker to repeatably crash or hang the hypervisor, taking down all hosted virtual machines. Exploitation requires high-privilege local logon access to the host, and Oracle's August 2026 CPU includes a fix. No public exploit code and no CISA KEV listing have been identified, keeping real-world risk limited despite the "easily exploitable" descriptor used by Oracle.
Oracle VM VirtualBox 7.2.14 contains a local privilege-escalation-to-DoS flaw in the Core component that allows a highly privileged host user to repeatedly crash or hang the hypervisor, with scope change meaning hosted guest VMs are also disrupted. The attack requires local logon and high privileges on the host infrastructure, substantially limiting the attacker pool to insiders or already-compromised privileged accounts. No public exploit code or active exploitation has been identified at time of analysis; EPSS data was not provided.
Oracle VM VirtualBox 7.2.14 Core component allows a high-privileged local attacker to trigger a complete denial-of-service condition - causing a hang or frequently repeatable crash of the hypervisor - with a confirmed scope change that can significantly impact additional products beyond VirtualBox itself, likely the host operating system or co-resident guest VMs. The vulnerability is exploitable by an attacker with administrator-level access already present on the host infrastructure, making it most relevant in multi-tenant or shared virtualization environments where privileged-but-not-hypervisor-owner threat actors are a realistic model. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle VM VirtualBox 7.2.14 contains a locally exploitable flaw in its Core component that grants high-privileged local attackers partial read, write, and denial-of-service capabilities, with a confirmed scope change meaning the impact can extend to products or components beyond VirtualBox itself. The vulnerability is described as 'easily exploitable' by Oracle, though the high privilege and local access requirements substantially constrain the realistic attacker pool. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle VM VirtualBox 7.2.14 Core component exposes a local confidentiality vulnerability enabling a high-privileged attacker with local infrastructure access to read critical data across VM isolation boundaries, with confirmed scope change indicating potential host or cross-VM data exposure. The CVSS vector (AV:L/AC:H/PR:H/S:C/C:H/I:N/A:N) reflects a narrow but impactful attack path constrained by high complexity and privilege prerequisites. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, placing it in a low-urgency tier for most environments despite the high confidentiality impact when scope change is considered.
Oracle VM VirtualBox 7.2.14 Core component allows a high-privileged local attacker to cause a complete denial of service - hang or repeatable crash - with a scope change that can impact additional products beyond VirtualBox itself, such as guest virtual machines sharing the same host. The vulnerability is locally-triggered and requires existing privileged access to the infrastructure, limiting opportunistic exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, and EPSS data was not available in the provided intelligence.
Oracle VM VirtualBox 7.2.14 Core component exposes a locally exploitable denial-of-service condition that can be triggered by a high-privileged attacker with logon access to the host infrastructure. Exploitation results in a complete, repeatably triggerable crash or hang of the VirtualBox process, with scope change indicated - meaning the disruption can cascade to guest virtual machines and other co-hosted workloads. No public exploit code exists and no active exploitation has been identified at time of analysis.
Oracle VM VirtualBox 7.2.14 (Core component) is affected by a locally exploitable vulnerability that allows a low-privileged, unauthenticated local user to cause a complete denial of service - a hang or repeatable crash - of the hypervisor, as well as unauthorized modification of a subset of its accessible data. Exploitation requires physical or logical local access to the host infrastructure and human interaction from a separate user (e.g., a legitimate VirtualBox user performing a VM operation). No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Partial denial-of-service exposure in Oracle Access Manager's Authorization Engine affects supported versions 12.2.1.4.0 and 14.1.2.1.0, reachable by any low-privileged network user over TCP. An authenticated attacker with minimal account privileges can disrupt availability of the Authorization Engine, potentially interrupting access-control decisions for applications federated through OAM. No public exploit code has been identified at time of analysis, and impact is bounded to partial availability degradation with no confidentiality or integrity exposure.
Unauthorized data access and modification in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, contingent on human interaction from a victim. The vulnerability resides in the Security component and is tagged as an Authentication Bypass, enabling partial confidentiality and integrity compromise without attacker credentials. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, but the low attack complexity and zero privilege requirement make social-engineering-assisted attacks practical against exposed instances.
Unauthenticated network exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 enables remote attackers to perform unauthorized data manipulation and cause partial denial of service via HTTP against the Security component. The vulnerability requires no credentials and no user interaction, making it trivially accessible to any attacker with network reach to the application. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis; however, the unauthenticated, network-accessible attack surface warrants prompt patching.
Denial-of-service in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-adjacent attacker to cause the application to hang or crash repeatedly via crafted HTTP requests targeting the Security component. The flaw is rated Medium (CVSS 5.3) due to high attack complexity, meaning exploitation requires specific conditions to be met beyond simply having network access. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged attacker with local logon access to the host infrastructure, exploiting a flaw in the Security component under conditions of high attack complexity. Despite a moderate CVSS base score of 6.4 - dampened by strict access prerequisites - successful exploitation yields complete confidentiality, integrity, and availability compromise of the application. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes an authentication bypass in its Security component that permits unauthenticated network attackers to perform limited unauthorized read and write operations on accessible financial data via HTTP. The attack is classified as difficult to exploit (AC:H), constraining realistic risk despite the absence of any authentication requirement. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed through Oracle's Critical Security Patch Update for August 2026.
Oracle VM VirtualBox 7.2.14 Core component contains a vulnerability that allows a high-privileged local attacker to breach VM isolation boundaries and access all confidential data accessible to VirtualBox, including data from guest virtual machines. The CVSS scope-change metric (S:C) confirms that successful exploitation extends impact beyond the VirtualBox process itself, enabling unauthorized read access to critical data across VM boundaries. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the EUVD 'Authentication Bypass' tag suggests the vulnerability may undermine guest-level authentication or isolation enforcement mechanisms.
Confidentiality compromise in Oracle VM VirtualBox 7.2.14 Core component allows a locally authenticated, high-privileged attacker to access all data reachable by the VirtualBox process and breach isolation boundaries to impact additional products via scope change. The 'Authentication Bypass' tag supplied by the reporter suggests an internal access-control bypass within VirtualBox's security model that extends an attacker's data reach beyond their normally authorized scope. No public exploit code or active exploitation has been confirmed at time of analysis.
Full takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged local attacker targeting the Security component, resulting in complete compromise of confidentiality, integrity, and availability. The attack requires logon access to the infrastructure host where the application runs, limiting exposure to insider threats or attackers who have already established a foothold with elevated privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the local-only attack vector substantially constrains real-world risk despite the full CIA impact.
Confidentiality breach in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible within the application via HTTP, including sensitive financial consolidation records. The vulnerability resides in the Security component and carries an 'Authentication Bypass' classification, suggesting improper enforcement of authorization controls that permits privilege escalation beyond the attacker's intended access level. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high attack complexity requirement indicates exploitation demands specific environmental or application-state conditions.
Local denial-of-service in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged attacker with logon access to the hosting infrastructure to hang or repeatedly crash the application via its Security component. The CVSS vector confirms this is a local, high-complexity attack with no confidentiality or integrity impact - purely an availability concern. No public exploit code and no CISA KEV listing exist at time of analysis, and the combination of local access requirement and high attack complexity substantially limits opportunistic exploitation.
Partial unauthorized data access and service disruption in Oracle Hyperion Financial Management 11.2.25.0.000 can be achieved by low-privileged, network-accessible attackers via HTTP targeting the Security component. Exploitation allows unauthorized read of a subset of application data, unauthorized update or insert of accessible data, and partial denial of service - all without user interaction. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated network exposure in Oracle Database Server's RDBMS component allows remote attackers to read a subset of database-accessible data via Oracle Net without any credentials. Affected across three major release trains - 19c (19.3-19.32), 21c (21.3-21.23), and 23ai (23.4.0-23.26.3) - the flaw is tagged as an authentication bypass, suggesting the Oracle Net listener or a pre-auth code path fails to enforce access controls before returning data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to attempt at scale.
SQL-based exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 enables a high-privileged authenticated attacker to achieve complete read and write access to all financial data within the application. The Security component - the logical gatekeeper for data authorization - is the attack surface, and successful exploitation grants unauthorized creation, deletion, modification, and disclosure of critical financial records. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the 'Authentication Bypass' tag warrants scrutiny given the contradiction with the PR:H CVSS metric (see risk assessment).
Hyperion Financial Management version 11.2.25.0.000 exposes authenticated low-privileged network attackers to a tri-impact vulnerability in its Security component: complete, repeatable denial of service via application hang or crash, limited unauthorized data modification, and partial unauthorized data disclosure. Exploitation requires a valid low-privileged account, HTTP network access, and conditions of high attack complexity - factors that collectively reduce the likelihood of opportunistic or automated attack. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Local information disclosure in Oracle Agile PLM MCAD Connector 3.6 exposes a subset of PLM-accessible data to unauthenticated local attackers exploiting an authentication bypass in the CAX Client component. Exploitation is gated by two significant constraints: the attacker must have local logon access to the infrastructure hosting the connector, and a separate legitimate user must interact with the application during the attack window. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, consistent with the low CVSS 3.1 base score of 3.3.
Unauthorized data disclosure in Oracle Agile PLM MCAD Connector 3.6 allows a low-privileged network attacker to gain complete read access to all data accessible by the CAX Client component via a complex HTTP-based attack requiring victim user interaction. The vulnerability is tagged as an authentication bypass, suggesting the CAX Client component fails to enforce authorization boundaries for a subset of data operations when specific, difficult-to-reproduce conditions are met. No public exploit code or CISA KEV listing exists at time of analysis, and the high attack complexity meaningfully limits opportunistic exploitation.
Unauthorized data read in Oracle Agile PLM MCAD Connector 3.6 exposes a subset of PLM-accessible data to unauthenticated remote attackers via HTTP against the CAX Client component. Tagged explicitly as an Authentication Bypass, the flaw allows any network-reachable attacker to query protected PLM data without credentials, indicating that the CAX Client HTTP interface fails to enforce authentication on at least one data-serving endpoint. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the trivially low attack complexity (AV:N/AC:L/PR:N/UI:N) means exploitation requires no special tooling.
Unauthorized access to all data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged remote attacker exploiting a flaw in the Security component over HTTP. The vulnerability results in complete confidentiality compromise - an attacker can read all data accessible to the application, including sensitive financial consolidation records. No public exploit has been identified at time of analysis, and exploitation is bounded by the requirement for high-privilege credentials, though the 'Authentication Bypass' tag suggests established access may allow security control circumvention beyond the attacker's normal authorization scope.
Local exploitation of MySQL Connector/ODBC 26.7.0 on Oracle MySQL allows any user with OS-level logon to the affected infrastructure to crash or hang the connector process and read a subset of accessible data. The attack requires no authentication to MySQL Connectors itself and no user interaction, making it trivially executable by any local user or process on the host. No public exploit code has been identified at time of analysis, and exploitation is bounded by the requirement for local system access.
Limited confidentiality exposure in Oracle Agile PLM MCAD Connector 3.6 allows a high-privileged local attacker to read a subset of accessible data under constrained conditions. The CVSS 3.1 base score of 1.8 reflects a worst-case scenario requiring local infrastructure access, high privileges, high attack complexity, and mandatory third-party human interaction - a combination rarely satisfied in practice. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world risk is negligible for organizations maintaining least-privilege controls on the host infrastructure.
Local information disclosure in Oracle Agile PLM MCAD Connector version 3.6 allows a low-privileged, locally authenticated attacker to read a subset of data accessible to the CAX Client component under high-complexity exploitation conditions. Reported by Oracle Security (secalert_us@oracle.com) as part of the August 2026 Critical Patch Update and tracked under ENISA EUVD-2026-62027, this vulnerability carries a CVSS 3.1 base score of 2.5, reflecting strictly limited confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed.
Local integrity compromise in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) requires an attacker with high privileges and physical or logical logon access to the host infrastructure, under high-complexity conditions, to perform unauthorized data modification against accessible records. The attack yields only limited integrity impact - no confidentiality or availability loss - and no public exploit code or active exploitation has been identified at time of analysis. Notably, the 'Authentication Bypass' tag applied by the reporter conflicts with the PR:H CVSS vector, and this discrepancy is unresolved by available data.
Limited data exposure in Oracle Agile PLM MCAD Connector version 3.6 allows an unauthenticated attacker with access to the same physical network segment as the target host to partially read and modify application data. Exploitation is constrained by adjacent-only network access, high attack complexity, and a mandatory human-interaction requirement, resulting in a low CVSS 3.1 base score of 3.7. No public exploit code or active exploitation has been identified at time of analysis.
Network-exploitable denial-of-service in Oracle MySQL Connector/ODBC 26.7.0 allows low-privileged authenticated attackers to cause a complete hang or repeatable crash of the connector via multiple protocols. Oracle characterizes this as easily exploitable, consistent with the low-complexity, low-privilege CVSS vector (AV:N/AC:L/PR:L). No public exploit code or active exploitation has been identified at time of analysis, though the availability impact is rated High with no confidentiality or integrity exposure.
Oracle Agile PLM MCAD Connector version 3.6 exposes a local, privilege-dependent attack path through its CAX Client component, enabling a low-privileged authenticated local attacker to partially compromise data confidentiality, integrity, and availability within the PLM environment. Exploitation is constrained by a mandatory human-interaction requirement and high attack complexity, making opportunistic or remote exploitation infeasible. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog; the vendor-assigned CVSS 3.1 score of 4.2 reflects the limited blast radius.
Confidentiality compromise in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) allows an unauthenticated attacker with physical access to the local network segment to gain unauthorized access to all data accessible by the connector. The attack is adjacent-network and high-complexity, limiting realistic exposure to insider threats or attackers with pre-existing physical network presence. No public exploit code exists and no active exploitation has been confirmed; CVSS 5.3 reflects the constrained attack vector. The 'Authentication Bypass' tag suggests the vulnerability circumvents a credential or session-validation mechanism within the CAX Client, enabling direct data exposure without credential theft.
Unauthenticated network access to Oracle Agile PLM MCAD Connector 3.6 exposes a subset of data managed by the CAX Client component over plain HTTP, with no privileges or user interaction required. Classified as an authentication bypass (EUVD-2026-62021) and described as 'easily exploitable' in Oracle's CSPU August 2026 advisory, this vulnerability carries a CVSS 3.1 score of 5.3 with purely confidentiality impact and no integrity or availability risk. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) exposes critical PLM data to unauthenticated attackers who have physical adjacency to the network segment where the connector hardware operates. The vulnerability enables unauthorized read access to all connector-accessible data and limited write access, scored CVSS 5.9 Medium due to the adjacent-network attack vector and high complexity constraints. No public exploit code or CISA KEV listing has been identified at time of analysis.
MySQL Connector/ODBC version 26.7.0 exposes a local denial-of-service condition that allows an unauthenticated attacker with logon access to the host to cause a complete hang or repeatable crash of the connector, disrupting dependent applications. Exploitation requires human interaction from a third party (UI:R), constraining the realistic attack surface to insider threat or socially engineered scenarios on the affected host. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; availability is the sole impact dimension - confidentiality and integrity are unaffected.
Local low-privileged access to Oracle Agile PLM MCAD Connector 3.6 enables an authenticated attacker to partially degrade availability of the CAX Client component. Oracle's August 2026 Critical Patch Update (CPU) documents this as easily exploitable by any user with a logon to the host infrastructure, resulting in partial denial of service with no confidentiality or integrity impact. No public exploit identified at time of analysis, and CISA KEV listing is absent, placing this firmly in the low-urgency category.
Partial authentication bypass in Oracle Agile PLM MCAD Connector 3.6 exposes confidentiality and integrity of accessible PLM data to low-privileged adjacent-network attackers. The CAX Client component fails to properly restrict data operations, allowing an attacker on the same physical network segment with low-level credentials to read a subset of accessible records and perform unauthorized insert, update, or delete operations. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Unauthorized data disclosure in Oracle Agile PLM MCAD Connector 3.6 allows any low-privileged authenticated attacker with HTTP network access to bypass authorization controls in the CAX Client component and read the entire dataset accessible to the connector. The vulnerability is tagged Authentication Bypass, indicating that after obtaining a minimal credential foothold, no additional privilege escalation is needed to access critical PLM data such as engineering designs and product specifications. Oracle's own advisory characterizes the flaw as 'easily exploitable,' and no public exploit code or CISA KEV listing has been identified at time of analysis.
Local exploitation of Oracle Agile PLM MCAD Connector version 3.6 enables an unauthenticated attacker with infrastructure-level logon to partially compromise the CAX Client component, resulting in limited unauthorized read, write, and denial-of-service impact. Exploitation is constrained by both high attack complexity and a mandatory human interaction requirement from a third party, making opportunistic attacks unlikely. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized confidential data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 exposes complete application-accessible data to a network-based attacker already holding high-level privileges, exploiting a flaw within the Security component via HTTP. EUVD metadata tags this as an Authentication Bypass, suggesting an access-control enforcement failure that allows an authenticated high-privileged user to exceed authorized data boundaries rather than a perimeter bypass open to unauthenticated parties. No public exploit code has been identified, and the vulnerability has not appeared in CISA KEV at time of analysis; the high attack complexity further constrains realistic exploitation.
Local confidentiality compromise in Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 allows a low-privileged authenticated local attacker to gain unauthorized read access to all data accessible by the application via the Endeca Application Controller component. Oracle classifies this as easily exploitable with low attack complexity, indicating reliable exploitation without special tooling for any user holding a local logon on the affected host. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Cross-site scripting or injection via the Endeca Application Controller in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows an unauthenticated remote attacker to cause unauthorized read and write access to data by luring a victim user to interact with a malicious HTTP request. The CVSS scope change (S:C) signals that a successful exploit extends impact beyond the vulnerable component itself - consistent with browser-context compromise such as session theft or UI redress, which aligns with the 'Authentication Bypass' tag. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server allows unauthenticated network attackers to bypass authentication over HTTP and gain complete read access to critical data, including data accessible across additional connected products due to a confirmed scope change. The vulnerability is rated CVSS 6.8 with high attack complexity, meaning exploitation requires specific conditions to be met, which limits opportunistic mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Authentication Bypass tag and scope-change impact make this a material risk for Oracle Fusion Middleware deployments running the affected version.