Oracle
Monthly
Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is possible via a network-accessible HTTP attack against the Security component. The CVSS vector confirms no authentication, no user interaction, and no special conditions are required, placing this squarely in the high-severity, easily exploitable category. Successful exploitation yields complete read access to all data accessible by the application and a partial denial of service, making this a critical risk for financial institutions running the affected build. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover is achievable in Oracle Siebel CRM End User versions 17.0 through 26.6 via the Document Management component over HTTP, exploitable by any low-privileged authenticated user without user interaction. The CVSS 8.8 score reflects complete confidentiality, integrity, and availability impact, consistent with the vendor's characterization of 'takeover' of the End User instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range make this a priority patching target for any organization running affected Siebel deployments.
Full system takeover of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by a network-accessible, high-privileged attacker exploiting a flaw in the Security component via HTTP. The vulnerability carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, amounting to effective product compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and complete CIA triad impact warrant prompt remediation attention.
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileged attacker with network HTTP access, affecting versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation is straightforward - no elevated privileges, no user interaction, and low complexity - resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation makes this a high-priority patching target for organizations running affected Siebel deployments.
Full takeover of Oracle Purchasing within Oracle E-Business Suite is achievable by any low-privileged, network-authenticated attacker exploiting this unspecified flaw in versions 12.2.3 through 12.2.15. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms exploitation requires no special conditions beyond a valid low-privilege account and HTTP access, with resulting impacts across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full-impact triad make this a credible priority for any Oracle EBS deployment.
Unauthenticated HTTP access to Oracle Purchasing (a component of Oracle E-Business Suite versions 12.2.3-12.2.15) enables remote attackers to read critical or complete procurement data with no credentials, user interaction, or elevated attack complexity. Tagged as an authentication bypass by EUVD (EUVD-2026-61894) and disclosed through Oracle's August 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.5, reflecting a fully network-exposed, zero-prerequisite attack path. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker targeting the Security component over HTTP, resulting in complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 7.5 (High) reflects this total impact, though high attack complexity (AC:H) constrains opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS data was supplied in the source intelligence.
Unauthorized data exposure in Oracle Payroll (E-Business Suite component: Internal Operations) allows a low-privileged, network-authenticated attacker to gain complete read access to all Oracle Payroll-accessible data via HTTP, with confirmed scope change that may cascade into impact on additional EBS components. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the currently supported 12.2.x release line. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is tagged as an authentication bypass and rated easily exploitable with low attack complexity.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker via TCP, with no user interaction required. The vulnerability resides in the Security component and results in complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible lateral-movement risk in enterprise financial environments.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 allows unauthenticated, network-adjacent attackers to fully read and manipulate sensitive financial consolidation data without any credentials. The affected component is HFM's Security subsystem, and exploitation requires only adjacency to the physical or logical network segment hosting the application - no user interaction or privileges needed. No public exploit code and no CISA KEV listing exist at time of analysis, though the low attack complexity makes this straightforward to exploit for any attacker achieving network adjacency.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged network attackers to bypass security controls and gain complete access to sensitive financial data via HTTP. Tagged as an Authentication Bypass in EUVD-2026-61889, the flaw carries a CVSS scope change indicator meaning successful exploitation can extend confidentiality impacts to additional Oracle Hyperion products sharing the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle's own designation of this as 'easily exploitable' and the low attack complexity are meaningful risk signals for organizations running this financial consolidation platform.
Local privilege escalation in Oracle Payroll (E-Business Suite 12.2.3 through 12.2.15) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the payroll application, achieving complete confidentiality, integrity, and availability impact including full takeover. The vulnerability carries a confirmed scope change (S:C), meaning successful exploitation can cascade to affect additional products co-hosted on the same infrastructure - a significant blast-radius amplifier in shared EBS environments. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is assessed as a targeted insider or post-breach scenario rather than opportunistic remote attack.
Full system takeover is achievable in Oracle Hyperion Financial Management 11.2.25.0.000 through a flaw in its Security component, exploitable over HTTP by any low-privileged attacker with network access and no required user interaction. The CVSS 3.1 score of 8.8 reflects complete high-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Hyperion Financial Management 11.2.25.0.000 contains a flaw in its Security component that allows a high-privileged, network-authenticated attacker to achieve full system takeover via HTTP, impacting confidentiality, integrity, and availability. Disclosed via Oracle's August 2026 Critical Security Patch Update (CSPU) and corroborated by EUVD-2026-61886, the attack requires no user interaction and has low complexity once privileged credentials are available. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, network-authenticated attacker exploiting a flaw in its Security component via HTTP. The vulnerability demands high attack complexity - indicating specific conditions must align - but successful exploitation yields complete compromise of confidentiality, integrity, and availability, consistent with a privilege escalation or security bypass in the access-control subsystem. No public exploit code or active exploitation has been identified at time of analysis; Oracle addressed this through the August 2026 Critical Patch Update.
Local authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged attacker with infrastructure logon to read and modify all application-accessible financial data. The CVSS 7.1 score reflects high confidentiality and integrity impact with no availability disruption, constrained entirely to the local attack surface. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data exfiltration and partial service disruption in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per the 'Authentication Bypass' tag, likely involves improper enforcement of access controls that permits a low-privileged user to read data far beyond their authorization level, achieving complete access to all Financial Management accessible data (C:H). No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to leverage for any authenticated user of the application.
Unauthorized data access and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 are achievable by any low-privileged, network-connected attacker via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per vendor-assigned tags, involves an authentication bypass mechanism that elevates effective access beyond the attacker's granted privileges, enabling exposure of critical financial data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog; however, the low attack complexity and broad network exposure make it a high-priority remediation target for organizations running the affected release.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all financial data accessible within the application and degrade service availability via HTTP. The 'Authentication Bypass' tag suggests the Security component vulnerability enables privilege escalation beyond the attacker's granted role, exposing sensitive financial consolidation data. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, network accessibility, and high confidentiality impact against enterprise financial data makes this a meaningful priority for affected organizations.
Oracle Order Management's Product Diagnostic Tools component exposes a local privilege-dependent flaw affecting versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, allowing a high-privileged local attacker to achieve unauthorized read and write access to critical data with scope impact extending beyond the Order Management module itself. The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) confirms that exploitation is constrained to infrastructure-level access, requiring both physical or logical logon to the host system and an elevated account, but successful exploitation yields complete confidentiality and integrity compromise. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed.
Oracle Workflow's Notification Mailer component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised by a low-privileged network attacker over HTTP, enabling unauthorized creation, deletion, or modification of critical workflow data and triggering a complete denial of service. The CVSS 3.1 score of 8.1 reflects high integrity and availability impacts with no confidentiality exposure, exploitable with low complexity and no user interaction. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Oracle Order Management's Product Diagnostic Tools component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 can be fully compromised by a low-privileged attacker over HTTP, resulting in complete system takeover with high confidentiality, integrity, and availability impact. The attack requires low privileges and high complexity to execute, reducing the immediacy of the threat but not its severity if conditions are met. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Hyperion Financial Management 11.2.25.0.000 contains an authentication bypass in its Security component that allows a low-privileged authenticated attacker to exceed their authorized access over HTTP, resulting in full confidentiality and integrity compromise of all application data. The flaw enables unauthorized read access to sensitive corporate financial records as well as creation, deletion, or modification of critical data across the entire HFM instance. No public exploit has been identified at time of analysis, and Oracle addressed this vulnerability in the Critical Patch Update for August 2026.
Full system takeover is possible in Oracle Hyperion Financial Management 11.2.25.0.000 through the Security component, exploitable via SQL by a low-privileged network attacker with no user interaction required. Oracle classifies this as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and full-takeover impact elevate real-world risk for any organization running the affected version.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an unauthenticated HTTP endpoint vulnerable to a complete denial-of-service condition. Attackers with network access can cause the Workflow service to hang or crash repeatedly with no authentication required and low attack complexity, as confirmed by Oracle's August 2026 CPU advisory. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Full compromise of Oracle Workflow (Workflow Notification Mailer component) in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by an unauthenticated attacker who can reach the product over SMTP, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) reflects an easily exploitable network flaw resulting in complete takeover of Oracle Workflow. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided.
SQL-layer exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged network attacker to fully compromise data confidentiality and integrity across all accessible financial data. The flaw resides in the Security component, and successful exploitation permits unauthorized read, creation, deletion, and modification of critical data - a particularly severe outcome for an EPM platform handling sensitive financial consolidation records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a high-priority patch target for any Oracle EPM deployment.
Full takeover of Oracle Web Services Manager is achievable by unauthenticated remote attackers via HTTPS in versions 12.2.1.4.0 and 14.1.2.0.0 of the Oracle Fusion Middleware product line. The vulnerability resides in the Web Services Security component and carries a CVSS 3.1 base score of 8.1, with complete confidentiality, integrity, and availability impacts confirmed by Oracle's August 2026 Critical Patch Update advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover of Oracle Financial Services Enterprise Case Management versions 8.0.8.2 and 8.1.2.11 is achievable by low-privileged, network-authenticated attackers targeting the Web UI component over HTTP. Oracle rates this as easily exploitable with a CVSS 3.1 score of 8.8, reflecting full confidentiality, integrity, and availability impact - consistent with complete application compromise. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthenticated attacker reach the application over TLS and read or alter all data the product can access, with a scope-changing blast radius into adjacent Oracle products. Rated CVSS 10.0, it is trivially exploitable (AV:N/AC:L/PR:N/UI:N) and delivers full confidentiality and integrity compromise while leaving availability untouched. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the perfect score and unauthenticated network reach make it a top-priority patch.
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a low-privileged attacker with network access, operating over the SQL layer, fully compromise the application and - because of a scope change - significantly impact other connected products. Oracle rates it CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact. No public exploit code has been identified and it is not on CISA KEV, but the low complexity and low privilege bar make it a top-priority patch item.
Oracle Product Hub versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes a full system takeover path via a network-accessible flaw in its Outbound Data component, exploitable by any low-privileged authenticated user over HTTP with no user interaction required. Oracle classifies this as 'easily exploitable' and confirms complete confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, but the low attack complexity warrants urgent remediation for all affected deployments.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local-access vulnerability in its Security component that allows an unauthenticated local attacker to achieve full system takeover - compromising confidentiality, integrity, and availability - when combined with required interaction from a separate legitimate user. The attack is constrained to actors with logon access to the infrastructure hosting HFM and requires high complexity to execute, limiting the realistic threat population to insiders or those who have already established a foothold on the target server. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Unauthenticated remote data exposure in Oracle Siebel CRM Integration's REST component allows network attackers to read all CRM-accessible data without credentials across versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable with no authentication and minimal attack complexity, yielding complete confidentiality loss. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Unauthenticated remote exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 exposes the Security component to authentication bypass via HTTP, enabling attackers to read critical or all accessible financial data and inflict a partial denial of service. The vulnerability is rated CVSS 8.2 (High) with a low-complexity, network-accessible attack vector requiring no privileges or user interaction. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the authentication bypass tag and unauthenticated attack surface make this a meaningful priority for any organization running the affected version.
Remote unauthenticated denial-of-service in Oracle Helidon 3.2.18 allows network-reachable attackers to trigger a hang or repeatably crash the Imperative Web Server component via crafted HTTP requests, fully disrupting availability. The vulnerability carries a CVSS 3.1 score of 7.5, is described by Oracle as easily exploitable, and requires no authentication, no user interaction, and only standard HTTP network access. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity makes opportunistic probing straightforward against any internet-exposed Helidon instance.
Remote denial-of-service in Oracle Java SE's 2D component allows unauthenticated network attackers to hang or crash the JVM across versions 25.0.4 and 26.0.2 via multiple protocols. The attack surface spans both server-side Java deployments exposing 2D-related APIs through web services and client-side environments running sandboxed Java Web Start applications or applets processing untrusted code. Oracle characterizes this as easily exploitable with no public exploit identified at time of analysis; no KEV listing is present.
SAML-based authentication bypass and full product takeover affects Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware's Agent infrastructure component. A remote attacker with no credentials can reach the SAML processing surface over the network and, per Oracle's own rating, easily compromise the identity broker outright - CVSS 9.8 with full confidentiality, integrity, and availability impact. Because Oracle Access Manager is a single-sign-on and access-enforcement gatekeeper, its takeover cascades to every downstream application it protects. No public exploit identified at time of analysis; not listed in CISA KEV.
Unauthenticated adjacent-network exploitation of Oracle Hyperion Data Relationship Management 11.2.25.0.000 enables complete read and write access to all master data managed by the platform. The vulnerability resides in the Access and Security component and is tagged as an authentication bypass, allowing an attacker positioned on the same physical communication segment to exfiltrate sensitive hierarchical reference data and silently manipulate or delete critical records without credentials or user interaction. No public exploit has been identified at time of analysis and no CISA KEV listing has been observed, but the low attack complexity and absence of any authentication requirement make this a meaningful priority for organizations co-locating DRM with other internal systems on shared network segments.
Oracle Hyperion Data Relationship Management (DRM) 11.2.25.0.000 exposes a high-severity access control flaw that allows a low-privileged, network-authenticated attacker to fully compromise confidentiality and integrity of critical DRM data, with scope change extending impact to additional Oracle Hyperion products. Exploitation requires human interaction from a victim user, consistent with a cross-site or cross-context attack pattern (the 'Authentication Bypass' tag suggests privilege escalation beyond the attacker's initial access tier). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access and integrity compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a local attacker holding low-privilege infrastructure credentials to fully circumvent application-level access controls, yielding complete read and write access to all DRM-managed master data. The vulnerability resides in the Access and security component and is tagged as an Authentication Bypass, suggesting internal authorization enforcement fails once basic OS-level access to the host is obtained. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes critical master data to unauthenticated remote attackers over HTTP. Exploitation requires human interaction from a victim user - consistent with a reflected or client-side attack vector - allowing an attacker to read or tamper with all data accessible within the DRM platform, including sensitive master data governance records. No public exploit or CISA KEV listing has been identified at time of analysis, though the Oracle August 2026 Critical Patch Update addresses this issue.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes the Access and Security component to unauthenticated remote attackers over HTTP, enabling full read and write access to critical master data hierarchies. The CVSS 3.1 score of 8.7 reflects a scope change (S:C), meaning successful exploitation can cascade to additional Oracle Hyperion EPM products beyond the initial target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero authentication requirement and cross-component impact warrants prompt remediation.
Full system takeover in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged authenticated network attackers via HTTP, targeting the Access and Security component. Oracle's own advisory characterizes this as 'easily exploitable,' with successful exploitation resulting in complete compromise across confidentiality, integrity, and availability - consistent with an authorization bypass or privilege escalation flaw within the access control layer. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes critical data assets to unauthenticated network attackers via HTTP, enabling both full read access to all application-accessible data and unauthorized creation, deletion, or modification of critical records. The vulnerability resides in the Access and security component and is tagged as an authentication bypass by Oracle. No active exploitation (KEV) or public proof-of-concept code has been identified at time of analysis, but the high confidentiality and integrity impact with no authentication prerequisite elevates its priority for affected deployments.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all DRM-managed master data to unauthenticated remote attackers over HTTPS. The flaw resides in the Access and Security component - the gatekeeper for the application - and permits complete read access to critical DRM data alongside limited unauthorized write capability. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS vector (PR:N, AC:L) confirms trivial unauthenticated exploitability from any network-adjacent position with HTTPS reachability.
Unauthorized data exposure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows unauthenticated network attackers to access the complete dataset managed by the platform via HTTP, without requiring credentials or user interaction. The vulnerability resides in the Access and Security component and has been tagged as an Authentication Bypass, indicating a fundamental failure in access control rather than a logic edge case. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the low attack complexity and absence of authentication prerequisites make this an attractive reconnaissance target.
Improper access control in Oracle Hyperion Data Relationship Management 11.2.25.0.000 enables a local attacker to bypass application-level authentication and gain full read and write access to all DRM-managed data. The affected component is the Access and Security module (CWE-284), meaning the flaw sits at the authorization enforcement layer rather than in data processing logic. No public exploit or active exploitation is confirmed; SSVC rates technical impact as total, making successful compromise highly damaging despite the local attack vector requirement.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a low-privileged, network-based attacker to bypass access controls via a crafted SQL interaction, resulting in full confidentiality and integrity compromise of critical DRM data. The scope change (S:C) in the CVSS vector indicates successful exploitation can significantly impact additional Oracle products beyond DRM itself. No public exploit code or CISA KEV listing is identified at time of analysis, though the 'Authentication Bypass' tag signals the vulnerability undermines a core security control.
Oracle Hyperion Data Relationship Management version 11.2.25.0.000 exposes a network-exploitable flaw in its Access and Security component that allows low-privileged authenticated attackers to achieve full read and write access to critical master data and propagate impact across additional Oracle Hyperion components via a scope change. Oracle assigned a CVSS 8.2 base score and tagged the issue as an authentication bypass, indicating a breakdown in authorization enforcement rather than a trivial credential attack. No public exploit code or CISA KEV listing exists at time of analysis, but the scope change and high confidentiality and integrity impacts make this a priority patch target for organizations running integrated Hyperion environments.
Unauthenticated remote data exposure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a network-adjacent or internet-facing attacker to read critical data or achieve complete unauthorized read access to all DRM-accessible data via HTTP, with no credentials or user interaction required. The vulnerability resides in the Access and Security component and is classified as an authentication bypass by the reporting source. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes opportunistic exploitation realistic against any exposed instance.
Unauthorized data disclosure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible financial hierarchy and metadata to unauthenticated remote attackers over HTTP, with no user interaction required. The flaw resides in the Access and Security component and is classified as an authentication bypass, enabling complete confidentiality compromise of the DRM platform's data assets without any credential requirement. No public exploit has been identified at time of analysis, but the absence of authentication barriers and low attack complexity make this a credible remote threat against any network-exposed deployment.
Unauthenticated remote access to all data in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible via a network-reachable HTTP endpoint due to an authentication bypass in the Access and Security component. An unauthenticated attacker with network access can exploit this to obtain complete read access to all data managed by the affected DRM instance, including potentially sensitive master data such as financial hierarchies, organizational structures, and governance metadata. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible master data to unauthenticated remote attackers over HTTP, with additional limited write capability (insert, update, delete). The flaw resides in the Access and Security component, and Oracle's own advisory classifies it as 'easily exploitable' with a PR:N/AC:L attack vector - meaning any network-reachable instance requires no credentials or special conditions to exploit. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a high-priority patch target for enterprises running Oracle Hyperion.
Full system takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged authenticated attackers over HTTP, with no interaction required beyond initial access. The vulnerability resides in the Access and Security component and results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad network accessibility make this a credible internal threat vector for any organization running the affected version.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a low-privileged attacker over HTTP, with confirmed scope change affecting additional Oracle ecosystem products. The vulnerability resides in the Access and Security component, and successful exploitation results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high CVSS base score of 8.5 and scope-change designation make this a priority for organizations running Oracle Hyperion environments.
Unauthenticated data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a remote attacker to read, create, delete, or modify all data accessible to the application via its SOAP interface. The flaw sits in the Access and security component and is tagged as an authentication bypass, meaning an attacker needs no credentials to reach critical master-data records. No public exploit identified at time of analysis, but the CVSS 9.1 rating and unauthenticated network vector make this a high-priority patch.
Unauthorized data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) lets a remote, unauthenticated attacker read, create, delete, or modify any DRM-accessible data over HTTP. The vendor tags this as an authentication bypass, and its CVSS 3.1 score of 9.1 reflects complete confidentiality and integrity loss with no availability impact. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and no-privileges vector make it a high-priority patching target.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 permits a low-privileged, network-adjacent attacker to achieve full confidentiality and integrity compromise of critical master data, with a confirmed scope change that can propagate impact to additional Oracle Hyperion components. Exploitation via HTTP requires a victim to take some form of interactive action, placing this in a phishing or session-hijacking attack pattern. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has published a Critical Security Patch Update advisory for August 2026 addressing this flaw.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged, network-adjacent attackers over HTTP, with no user interaction required. The vulnerability resides in the Access and Security component and is tagged as an authentication bypass, enabling an attacker who holds minimal credentials to escalate their effective access to critical or all DRM-accessible data - achieving both full confidentiality and full integrity compromise without triggering availability disruption. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and lack of user interaction make exploitation straightforward for any authenticated user.
Complete takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by remote, unauthenticated attackers over TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Access and security component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can reach beyond DRM into additional connected products. No public exploit code has been identified at time of analysis, but the trivial exploitability (no authentication, low complexity) makes this a top-priority patch.
Local privilege escalation in Oracle Hyperion Data Relationship Management (DRM) version 11.2.25.0.000 allows a low-privileged attacker with established local infrastructure access to fully compromise the DRM system, with confirmed potential for scope change affecting additional Oracle Hyperion products. The CVSS vector (AV:L/AC:H/PR:L/S:C/C:H/I:H/A:H) reflects both the restricted attack surface - requiring local logon - and the significant blast radius if successfully exploited. No public exploit identified at time of analysis, and the high attack complexity further constrains real-world exploitation.
Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes an access control bypass in its 'Access and security' component that permits low-privileged authenticated users, reachable over HTTP, to gain unauthorized read access to all application data and unauthorized write access enabling creation, deletion, or modification of critical data. Tagged as an Authentication Bypass by the advisory, the flaw delivers CVSS 3.1 High severity (8.1) with combined confidentiality and integrity impact against an enterprise master data management platform. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a low-privileged network attacker via HTTP, with confirmed impacts across confidentiality, integrity, and availability. The flaw resides in the Access and Security component, pointing to an authorization defect - likely privilege escalation or access control bypass - that allows any authenticated user to compromise the entire application. No public exploit has been identified at time of analysis, but the CVSS 8.8 score, low attack complexity, and Oracle's 'takeover' impact language make this a high-priority remediation target for organizations running financial master data management environments.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible when an attacker who already holds high application privileges sends crafted requests over the network via HTTPS to the Access and security component. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond DRM itself, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 9.1). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full system takeover is possible in Oracle Hyperion Data Relationship Management version 11.2.25.0.000 via a network-exploitable flaw in the Access and Security component. A low-privileged authenticated attacker with HTTP access can, under high-complexity conditions, achieve complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the product is not listed in the CISA KEV catalog; the high attack complexity (AC:H) meaningfully reduces the realistic exploitation probability despite the severe potential impact.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by any low-privileged, network-accessible attacker via HTTP, with high impact across confidentiality, integrity, and availability. The vulnerability resides in the Access and Security component and carries a vendor-assigned CVSS 3.1 base score of 8.8, reflecting low attack complexity and no required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full remote takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by an unauthenticated attacker who can reach the service over the network via TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Access and security component and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch.
Unauthenticated remote compromise of Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) allows network attackers to read, create, modify, or delete all data accessible to the application over HTTP without any credentials. Oracle rates it CVSS 3.1 9.1 and tags it as an authentication bypass, meaning an attacker who can reach the web interface gains full confidentiality and integrity impact over master-data governance records. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Full product takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over TCP, per Oracle's Critical Patch Update advisory (CSPU August 2026). The flaw resides in the Access and security component and yields complete confidentiality, integrity, and availability compromise (CVSS 3.1 base 9.8). No public exploit identified at time of analysis, and it is not currently listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch item.
Oracle Hyperion Data Relationship Management (DRM) version 11.2.23.0.000 exposes its Web Client - Unicode component to unauthenticated remote attackers over HTTP. Exploitation allows complete read access to all DRM-accessible data - which in a master data management context often includes sensitive financial hierarchies and organizational structures - plus the ability to induce a partial denial of service. No public exploit has been identified at time of analysis, but the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivially low attack complexity with no authentication barrier.
Full system takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by an unauthenticated remote attacker over HTTP, with successful exploitation resulting in complete compromise of confidentiality, integrity, and availability. The vendor-assigned CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network reachability without authentication, though the high attack complexity rating indicates non-trivial exploitation conditions that reduce the likelihood of opportunistic mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Oracle Application Testing Suite 13.3.0.1 exposes an authentication bypass that allows an unauthenticated attacker on the same physical network segment to read critical data and perform limited data manipulation. The adjacency requirement (AV:A) constrains the attack surface to attackers who have physical or logical access to the local network segment hosting the affected system, but no credentials or user interaction are needed once that foothold exists. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero privilege requirement make this straightforward to exploit by any actor already on the adjacent network.
Local privilege escalation in Oracle Application Testing Suite 13.3.0.1 enables a low-privileged attacker with the 'Load Testing for Web Apps' application privilege to achieve full system takeover, resulting in complete loss of confidentiality, integrity, and availability. Oracle classifies this as 'easily exploitable' with CVSS 7.8 (High), reflecting low attack complexity and no user interaction requirement once local access is established. No public exploit has been identified at time of analysis, and Oracle issued a fix through the August 2026 Critical Patch Update.
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by a network-adjacent, low-privileged attacker holding the 'Load Testing for Web Apps' privilege over HTTPS. The CVSS 3.1 score of 7.5 (High) reflects total compromise of confidentiality, integrity, and availability, though Oracle classifies this as 'difficult to exploit' (AC:H), implying specific conditions must align for successful attack. No public exploit code and no CISA KEV listing have been identified at time of analysis, and EPSS data was not available in the provided intelligence.
Oracle Application Testing Suite 13.3.0.1 exposes a network-accessible vulnerability allowing low-privileged attackers holding the Load Testing for Web Apps role to achieve unauthorized complete read access to critical data and limited write access through HTTP-based exploitation that requires victim interaction. The attack carries a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle products beyond the testing suite itself. No public exploit code has been identified and CISA KEV listing is absent, though the low attack complexity and network accessibility make this a credible targeted threat for any environment running this specific version.
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by any low-privileged attacker holding the 'Load Testing for Web Apps' role via a network-accessible HTTPS vector. Oracle's own advisory classifies this as 'easily exploitable,' with complete confidentiality, integrity, and availability impact resulting in system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and broad CIA impact make this a credible priority for affected deployments.
Unauthenticated remote compromise of Oracle Application Testing Suite 13.3.0.1 allows a network attacker to read, create, modify, or delete all data accessible to the application over HTTP with no credentials or user interaction. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact (no availability impact), and tagged as an authentication bypass, this is a pre-auth flaw fixed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of PeopleSoft Enterprise FIN Common Objects Brazil 9.1 is achievable by a high-privileged attacker with network access using Oracle's T3 or IIOP protocols. The vulnerability carries a CVSS 3.1 score of 7.2, reflecting complete confidentiality, integrity, and availability impact despite the PR:H prerequisite. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though Oracle's August 2026 Critical Patch Update advisory addresses it.
Full takeover of Oracle Siebel CRM Integration (versions 17.0-26.6) is achievable by a low-privileged authenticated attacker over HTTP, exploiting a flaw in the REST component. The CVSS scope change (S:C) means successful exploitation can pivot beyond the directly targeted service, potentially compromising additional Oracle or backend systems. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog; however, the C:H/I:H/A:H impact triad warrants prioritized patching for organizations running Siebel in enterprise environments.
Remote exploitation of Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to compromise confidentiality, integrity, and availability of the platform when a victim user interacts with a malicious payload delivered over HTTP. Both actively supported versions - 12.2.1.4.0 and 14.1.2.0.0 - are affected, and successful exploitation produces a scope change, meaning impacts can propagate beyond the directly targeted WebCenter Content instance to adjacent products within the Fusion Middleware stack. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a credible threat in internet-exposed deployments.
Oracle Siebel CRM End User versions 17.0 through 26.6 expose a network-exploitable flaw in the Open UI component that, when triggered via a crafted HTTPS interaction, grants a low-privileged attacker full read and write access to critical CRM data - including complete confidentiality and integrity compromise with a documented scope change to additional products. The 'Authentication Bypass' tag reported by Oracle's security team suggests the Open UI layer can be manipulated to circumvent access controls in the context of an authenticated victim's session. No exploit code is publicly available and the vulnerability is not listed in the CISA KEV catalog at the time of analysis.
Full system takeover of Oracle Siebel CRM Deployment (versions 17.0 through 26.6) is achievable by unauthenticated remote attackers via HTTP, targeting the Migration component. The attack requires human interaction from a victim - a social engineering or luring condition that constrains opportunistic exploitation - but successful exploitation results in complete compromise of confidentiality, integrity, and availability of the Siebel CRM Deployment instance. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.
Cross-boundary compromise in Oracle Siebel CRM's Siebel Apps - Self Service module (Helpdesk/Training component, versions 17.0 through 26.6) lets an unauthenticated remote attacker fully read and modify all data accessible to the application after luring a legitimate user into interacting with a crafted HTTP request. Because the CVSS vector carries a scope change (S:C), successful exploitation can significantly impact products beyond Siebel itself, and the vendor/analyst tagging as an 'Authentication Bypass' reinforces the high confidentiality and integrity risk. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.3 base score and network-facing, unauthenticated nature make it a top-tier patch priority.
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allow a remote, unauthenticated attacker to reach the application over HTTP and create, modify, or delete critical data as well as trigger a complete, repeatable crash. Oracle rates this CVSS 9.1 (I:H/A:H, no confidentiality impact), reflecting an easily exploitable network-facing flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch item.
Remote unauthorized data access in Oracle Demand Planning versions 12.1 and 12.2 enables unauthenticated network attackers over HTTP to read all data accessible to the application and perform limited unauthorized write operations, with no authentication, elevated privileges, or user interaction required. Tagged as an authentication bypass by Oracle's own security team, this flaw carries a CVSS 3.1 base score of 8.2, reflecting high confidentiality and low integrity impact with no availability component. No public exploit code has been identified at the time of analysis, though the low attack complexity and complete absence of authentication barriers make this a straightforward target for automated or opportunistic exploitation once a proof-of-concept surfaces.
Privilege-leveraging compromise of Oracle Demand Planning (Internal Operations component) in Oracle Supply Chain / E-Business Suite versions 12.1 and 12.2 lets a low-privileged attacker with HTTP network access read and modify all data reachable by the module. Because the CVSS scope is Changed (S:C), successful attacks can extend impact beyond Demand Planning to additional connected products. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the 9.6 base score and low attack complexity make it a high-priority patch.
Oracle Loans 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes its Internal Operations component to network-based exploitation by low-privileged authenticated attackers over HTTP. Successful exploitation grants unauthorized ability to create, delete, or modify critical data across all Oracle Loans accessible records, and can induce a partial denial of service against the application. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and broad affected version range (12.2.3-12.2.15) make this a notable priority for Oracle EBS deployments.
Oracle Loans within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes all loan records to network-authenticated low-privileged users through an authorization control failure in the Internal Operations component. A low-privileged attacker with HTTP network access can read the complete Oracle Loans dataset and perform unauthorized inserts or updates on a subset of that data, without requiring elevated credentials or any victim interaction. No public exploit code has been identified at time of analysis, and Oracle has addressed this vulnerability in the August 2026 Critical Patch Update.
Local privilege escalation with scope change in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged authenticated user on the host system to bypass security controls within the Security component, achieving complete unauthorized read and write access to all application data. The CVSS scope change (S:C) means successful exploitation can cascade into additional Oracle products sharing the same infrastructure, amplifying the blast radius beyond the immediate application. No public exploit code or CISA KEV listing exists at time of analysis; the vulnerability was disclosed through Oracle's Critical Security Patch Update for August 2026.
Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is possible via a network-accessible HTTP attack against the Security component. The CVSS vector confirms no authentication, no user interaction, and no special conditions are required, placing this squarely in the high-severity, easily exploitable category. Successful exploitation yields complete read access to all data accessible by the application and a partial denial of service, making this a critical risk for financial institutions running the affected build. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover is achievable in Oracle Siebel CRM End User versions 17.0 through 26.6 via the Document Management component over HTTP, exploitable by any low-privileged authenticated user without user interaction. The CVSS 8.8 score reflects complete confidentiality, integrity, and availability impact, consistent with the vendor's characterization of 'takeover' of the End User instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range make this a priority patching target for any organization running affected Siebel deployments.
Full system takeover of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by a network-accessible, high-privileged attacker exploiting a flaw in the Security component via HTTP. The vulnerability carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, amounting to effective product compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and complete CIA triad impact warrant prompt remediation attention.
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileged attacker with network HTTP access, affecting versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation is straightforward - no elevated privileges, no user interaction, and low complexity - resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation makes this a high-priority patching target for organizations running affected Siebel deployments.
Full takeover of Oracle Purchasing within Oracle E-Business Suite is achievable by any low-privileged, network-authenticated attacker exploiting this unspecified flaw in versions 12.2.3 through 12.2.15. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms exploitation requires no special conditions beyond a valid low-privilege account and HTTP access, with resulting impacts across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full-impact triad make this a credible priority for any Oracle EBS deployment.
Unauthenticated HTTP access to Oracle Purchasing (a component of Oracle E-Business Suite versions 12.2.3-12.2.15) enables remote attackers to read critical or complete procurement data with no credentials, user interaction, or elevated attack complexity. Tagged as an authentication bypass by EUVD (EUVD-2026-61894) and disclosed through Oracle's August 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.5, reflecting a fully network-exposed, zero-prerequisite attack path. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker targeting the Security component over HTTP, resulting in complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 7.5 (High) reflects this total impact, though high attack complexity (AC:H) constrains opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS data was supplied in the source intelligence.
Unauthorized data exposure in Oracle Payroll (E-Business Suite component: Internal Operations) allows a low-privileged, network-authenticated attacker to gain complete read access to all Oracle Payroll-accessible data via HTTP, with confirmed scope change that may cascade into impact on additional EBS components. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the currently supported 12.2.x release line. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is tagged as an authentication bypass and rated easily exploitable with low attack complexity.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker via TCP, with no user interaction required. The vulnerability resides in the Security component and results in complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible lateral-movement risk in enterprise financial environments.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 allows unauthenticated, network-adjacent attackers to fully read and manipulate sensitive financial consolidation data without any credentials. The affected component is HFM's Security subsystem, and exploitation requires only adjacency to the physical or logical network segment hosting the application - no user interaction or privileges needed. No public exploit code and no CISA KEV listing exist at time of analysis, though the low attack complexity makes this straightforward to exploit for any attacker achieving network adjacency.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged network attackers to bypass security controls and gain complete access to sensitive financial data via HTTP. Tagged as an Authentication Bypass in EUVD-2026-61889, the flaw carries a CVSS scope change indicator meaning successful exploitation can extend confidentiality impacts to additional Oracle Hyperion products sharing the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle's own designation of this as 'easily exploitable' and the low attack complexity are meaningful risk signals for organizations running this financial consolidation platform.
Local privilege escalation in Oracle Payroll (E-Business Suite 12.2.3 through 12.2.15) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the payroll application, achieving complete confidentiality, integrity, and availability impact including full takeover. The vulnerability carries a confirmed scope change (S:C), meaning successful exploitation can cascade to affect additional products co-hosted on the same infrastructure - a significant blast-radius amplifier in shared EBS environments. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is assessed as a targeted insider or post-breach scenario rather than opportunistic remote attack.
Full system takeover is achievable in Oracle Hyperion Financial Management 11.2.25.0.000 through a flaw in its Security component, exploitable over HTTP by any low-privileged attacker with network access and no required user interaction. The CVSS 3.1 score of 8.8 reflects complete high-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Hyperion Financial Management 11.2.25.0.000 contains a flaw in its Security component that allows a high-privileged, network-authenticated attacker to achieve full system takeover via HTTP, impacting confidentiality, integrity, and availability. Disclosed via Oracle's August 2026 Critical Security Patch Update (CSPU) and corroborated by EUVD-2026-61886, the attack requires no user interaction and has low complexity once privileged credentials are available. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, network-authenticated attacker exploiting a flaw in its Security component via HTTP. The vulnerability demands high attack complexity - indicating specific conditions must align - but successful exploitation yields complete compromise of confidentiality, integrity, and availability, consistent with a privilege escalation or security bypass in the access-control subsystem. No public exploit code or active exploitation has been identified at time of analysis; Oracle addressed this through the August 2026 Critical Patch Update.
Local authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged attacker with infrastructure logon to read and modify all application-accessible financial data. The CVSS 7.1 score reflects high confidentiality and integrity impact with no availability disruption, constrained entirely to the local attack surface. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data exfiltration and partial service disruption in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per the 'Authentication Bypass' tag, likely involves improper enforcement of access controls that permits a low-privileged user to read data far beyond their authorization level, achieving complete access to all Financial Management accessible data (C:H). No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to leverage for any authenticated user of the application.
Unauthorized data access and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 are achievable by any low-privileged, network-connected attacker via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per vendor-assigned tags, involves an authentication bypass mechanism that elevates effective access beyond the attacker's granted privileges, enabling exposure of critical financial data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog; however, the low attack complexity and broad network exposure make it a high-priority remediation target for organizations running the affected release.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all financial data accessible within the application and degrade service availability via HTTP. The 'Authentication Bypass' tag suggests the Security component vulnerability enables privilege escalation beyond the attacker's granted role, exposing sensitive financial consolidation data. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, network accessibility, and high confidentiality impact against enterprise financial data makes this a meaningful priority for affected organizations.
Oracle Order Management's Product Diagnostic Tools component exposes a local privilege-dependent flaw affecting versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, allowing a high-privileged local attacker to achieve unauthorized read and write access to critical data with scope impact extending beyond the Order Management module itself. The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) confirms that exploitation is constrained to infrastructure-level access, requiring both physical or logical logon to the host system and an elevated account, but successful exploitation yields complete confidentiality and integrity compromise. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed.
Oracle Workflow's Notification Mailer component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised by a low-privileged network attacker over HTTP, enabling unauthorized creation, deletion, or modification of critical workflow data and triggering a complete denial of service. The CVSS 3.1 score of 8.1 reflects high integrity and availability impacts with no confidentiality exposure, exploitable with low complexity and no user interaction. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Oracle Order Management's Product Diagnostic Tools component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 can be fully compromised by a low-privileged attacker over HTTP, resulting in complete system takeover with high confidentiality, integrity, and availability impact. The attack requires low privileges and high complexity to execute, reducing the immediacy of the threat but not its severity if conditions are met. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Hyperion Financial Management 11.2.25.0.000 contains an authentication bypass in its Security component that allows a low-privileged authenticated attacker to exceed their authorized access over HTTP, resulting in full confidentiality and integrity compromise of all application data. The flaw enables unauthorized read access to sensitive corporate financial records as well as creation, deletion, or modification of critical data across the entire HFM instance. No public exploit has been identified at time of analysis, and Oracle addressed this vulnerability in the Critical Patch Update for August 2026.
Full system takeover is possible in Oracle Hyperion Financial Management 11.2.25.0.000 through the Security component, exploitable via SQL by a low-privileged network attacker with no user interaction required. Oracle classifies this as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and full-takeover impact elevate real-world risk for any organization running the affected version.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an unauthenticated HTTP endpoint vulnerable to a complete denial-of-service condition. Attackers with network access can cause the Workflow service to hang or crash repeatedly with no authentication required and low attack complexity, as confirmed by Oracle's August 2026 CPU advisory. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Full compromise of Oracle Workflow (Workflow Notification Mailer component) in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by an unauthenticated attacker who can reach the product over SMTP, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) reflects an easily exploitable network flaw resulting in complete takeover of Oracle Workflow. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided.
SQL-layer exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged network attacker to fully compromise data confidentiality and integrity across all accessible financial data. The flaw resides in the Security component, and successful exploitation permits unauthorized read, creation, deletion, and modification of critical data - a particularly severe outcome for an EPM platform handling sensitive financial consolidation records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a high-priority patch target for any Oracle EPM deployment.
Full takeover of Oracle Web Services Manager is achievable by unauthenticated remote attackers via HTTPS in versions 12.2.1.4.0 and 14.1.2.0.0 of the Oracle Fusion Middleware product line. The vulnerability resides in the Web Services Security component and carries a CVSS 3.1 base score of 8.1, with complete confidentiality, integrity, and availability impacts confirmed by Oracle's August 2026 Critical Patch Update advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover of Oracle Financial Services Enterprise Case Management versions 8.0.8.2 and 8.1.2.11 is achievable by low-privileged, network-authenticated attackers targeting the Web UI component over HTTP. Oracle rates this as easily exploitable with a CVSS 3.1 score of 8.8, reflecting full confidentiality, integrity, and availability impact - consistent with complete application compromise. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthenticated attacker reach the application over TLS and read or alter all data the product can access, with a scope-changing blast radius into adjacent Oracle products. Rated CVSS 10.0, it is trivially exploitable (AV:N/AC:L/PR:N/UI:N) and delivers full confidentiality and integrity compromise while leaving availability untouched. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the perfect score and unauthenticated network reach make it a top-priority patch.
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a low-privileged attacker with network access, operating over the SQL layer, fully compromise the application and - because of a scope change - significantly impact other connected products. Oracle rates it CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact. No public exploit code has been identified and it is not on CISA KEV, but the low complexity and low privilege bar make it a top-priority patch item.
Oracle Product Hub versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes a full system takeover path via a network-accessible flaw in its Outbound Data component, exploitable by any low-privileged authenticated user over HTTP with no user interaction required. Oracle classifies this as 'easily exploitable' and confirms complete confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, but the low attack complexity warrants urgent remediation for all affected deployments.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local-access vulnerability in its Security component that allows an unauthenticated local attacker to achieve full system takeover - compromising confidentiality, integrity, and availability - when combined with required interaction from a separate legitimate user. The attack is constrained to actors with logon access to the infrastructure hosting HFM and requires high complexity to execute, limiting the realistic threat population to insiders or those who have already established a foothold on the target server. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Unauthenticated remote data exposure in Oracle Siebel CRM Integration's REST component allows network attackers to read all CRM-accessible data without credentials across versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable with no authentication and minimal attack complexity, yielding complete confidentiality loss. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Unauthenticated remote exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 exposes the Security component to authentication bypass via HTTP, enabling attackers to read critical or all accessible financial data and inflict a partial denial of service. The vulnerability is rated CVSS 8.2 (High) with a low-complexity, network-accessible attack vector requiring no privileges or user interaction. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the authentication bypass tag and unauthenticated attack surface make this a meaningful priority for any organization running the affected version.
Remote unauthenticated denial-of-service in Oracle Helidon 3.2.18 allows network-reachable attackers to trigger a hang or repeatably crash the Imperative Web Server component via crafted HTTP requests, fully disrupting availability. The vulnerability carries a CVSS 3.1 score of 7.5, is described by Oracle as easily exploitable, and requires no authentication, no user interaction, and only standard HTTP network access. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity makes opportunistic probing straightforward against any internet-exposed Helidon instance.
Remote denial-of-service in Oracle Java SE's 2D component allows unauthenticated network attackers to hang or crash the JVM across versions 25.0.4 and 26.0.2 via multiple protocols. The attack surface spans both server-side Java deployments exposing 2D-related APIs through web services and client-side environments running sandboxed Java Web Start applications or applets processing untrusted code. Oracle characterizes this as easily exploitable with no public exploit identified at time of analysis; no KEV listing is present.
SAML-based authentication bypass and full product takeover affects Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware's Agent infrastructure component. A remote attacker with no credentials can reach the SAML processing surface over the network and, per Oracle's own rating, easily compromise the identity broker outright - CVSS 9.8 with full confidentiality, integrity, and availability impact. Because Oracle Access Manager is a single-sign-on and access-enforcement gatekeeper, its takeover cascades to every downstream application it protects. No public exploit identified at time of analysis; not listed in CISA KEV.
Unauthenticated adjacent-network exploitation of Oracle Hyperion Data Relationship Management 11.2.25.0.000 enables complete read and write access to all master data managed by the platform. The vulnerability resides in the Access and Security component and is tagged as an authentication bypass, allowing an attacker positioned on the same physical communication segment to exfiltrate sensitive hierarchical reference data and silently manipulate or delete critical records without credentials or user interaction. No public exploit has been identified at time of analysis and no CISA KEV listing has been observed, but the low attack complexity and absence of any authentication requirement make this a meaningful priority for organizations co-locating DRM with other internal systems on shared network segments.
Oracle Hyperion Data Relationship Management (DRM) 11.2.25.0.000 exposes a high-severity access control flaw that allows a low-privileged, network-authenticated attacker to fully compromise confidentiality and integrity of critical DRM data, with scope change extending impact to additional Oracle Hyperion products. Exploitation requires human interaction from a victim user, consistent with a cross-site or cross-context attack pattern (the 'Authentication Bypass' tag suggests privilege escalation beyond the attacker's initial access tier). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access and integrity compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a local attacker holding low-privilege infrastructure credentials to fully circumvent application-level access controls, yielding complete read and write access to all DRM-managed master data. The vulnerability resides in the Access and security component and is tagged as an Authentication Bypass, suggesting internal authorization enforcement fails once basic OS-level access to the host is obtained. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes critical master data to unauthenticated remote attackers over HTTP. Exploitation requires human interaction from a victim user - consistent with a reflected or client-side attack vector - allowing an attacker to read or tamper with all data accessible within the DRM platform, including sensitive master data governance records. No public exploit or CISA KEV listing has been identified at time of analysis, though the Oracle August 2026 Critical Patch Update addresses this issue.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes the Access and Security component to unauthenticated remote attackers over HTTP, enabling full read and write access to critical master data hierarchies. The CVSS 3.1 score of 8.7 reflects a scope change (S:C), meaning successful exploitation can cascade to additional Oracle Hyperion EPM products beyond the initial target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero authentication requirement and cross-component impact warrants prompt remediation.
Full system takeover in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged authenticated network attackers via HTTP, targeting the Access and Security component. Oracle's own advisory characterizes this as 'easily exploitable,' with successful exploitation resulting in complete compromise across confidentiality, integrity, and availability - consistent with an authorization bypass or privilege escalation flaw within the access control layer. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes critical data assets to unauthenticated network attackers via HTTP, enabling both full read access to all application-accessible data and unauthorized creation, deletion, or modification of critical records. The vulnerability resides in the Access and security component and is tagged as an authentication bypass by Oracle. No active exploitation (KEV) or public proof-of-concept code has been identified at time of analysis, but the high confidentiality and integrity impact with no authentication prerequisite elevates its priority for affected deployments.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all DRM-managed master data to unauthenticated remote attackers over HTTPS. The flaw resides in the Access and Security component - the gatekeeper for the application - and permits complete read access to critical DRM data alongside limited unauthorized write capability. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS vector (PR:N, AC:L) confirms trivial unauthenticated exploitability from any network-adjacent position with HTTPS reachability.
Unauthorized data exposure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows unauthenticated network attackers to access the complete dataset managed by the platform via HTTP, without requiring credentials or user interaction. The vulnerability resides in the Access and Security component and has been tagged as an Authentication Bypass, indicating a fundamental failure in access control rather than a logic edge case. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the low attack complexity and absence of authentication prerequisites make this an attractive reconnaissance target.
Improper access control in Oracle Hyperion Data Relationship Management 11.2.25.0.000 enables a local attacker to bypass application-level authentication and gain full read and write access to all DRM-managed data. The affected component is the Access and Security module (CWE-284), meaning the flaw sits at the authorization enforcement layer rather than in data processing logic. No public exploit or active exploitation is confirmed; SSVC rates technical impact as total, making successful compromise highly damaging despite the local attack vector requirement.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a low-privileged, network-based attacker to bypass access controls via a crafted SQL interaction, resulting in full confidentiality and integrity compromise of critical DRM data. The scope change (S:C) in the CVSS vector indicates successful exploitation can significantly impact additional Oracle products beyond DRM itself. No public exploit code or CISA KEV listing is identified at time of analysis, though the 'Authentication Bypass' tag signals the vulnerability undermines a core security control.
Oracle Hyperion Data Relationship Management version 11.2.25.0.000 exposes a network-exploitable flaw in its Access and Security component that allows low-privileged authenticated attackers to achieve full read and write access to critical master data and propagate impact across additional Oracle Hyperion components via a scope change. Oracle assigned a CVSS 8.2 base score and tagged the issue as an authentication bypass, indicating a breakdown in authorization enforcement rather than a trivial credential attack. No public exploit code or CISA KEV listing exists at time of analysis, but the scope change and high confidentiality and integrity impacts make this a priority patch target for organizations running integrated Hyperion environments.
Unauthenticated remote data exposure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a network-adjacent or internet-facing attacker to read critical data or achieve complete unauthorized read access to all DRM-accessible data via HTTP, with no credentials or user interaction required. The vulnerability resides in the Access and Security component and is classified as an authentication bypass by the reporting source. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes opportunistic exploitation realistic against any exposed instance.
Unauthorized data disclosure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible financial hierarchy and metadata to unauthenticated remote attackers over HTTP, with no user interaction required. The flaw resides in the Access and Security component and is classified as an authentication bypass, enabling complete confidentiality compromise of the DRM platform's data assets without any credential requirement. No public exploit has been identified at time of analysis, but the absence of authentication barriers and low attack complexity make this a credible remote threat against any network-exposed deployment.
Unauthenticated remote access to all data in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible via a network-reachable HTTP endpoint due to an authentication bypass in the Access and Security component. An unauthenticated attacker with network access can exploit this to obtain complete read access to all data managed by the affected DRM instance, including potentially sensitive master data such as financial hierarchies, organizational structures, and governance metadata. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible master data to unauthenticated remote attackers over HTTP, with additional limited write capability (insert, update, delete). The flaw resides in the Access and Security component, and Oracle's own advisory classifies it as 'easily exploitable' with a PR:N/AC:L attack vector - meaning any network-reachable instance requires no credentials or special conditions to exploit. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a high-priority patch target for enterprises running Oracle Hyperion.
Full system takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged authenticated attackers over HTTP, with no interaction required beyond initial access. The vulnerability resides in the Access and Security component and results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad network accessibility make this a credible internal threat vector for any organization running the affected version.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a low-privileged attacker over HTTP, with confirmed scope change affecting additional Oracle ecosystem products. The vulnerability resides in the Access and Security component, and successful exploitation results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high CVSS base score of 8.5 and scope-change designation make this a priority for organizations running Oracle Hyperion environments.
Unauthenticated data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a remote attacker to read, create, delete, or modify all data accessible to the application via its SOAP interface. The flaw sits in the Access and security component and is tagged as an authentication bypass, meaning an attacker needs no credentials to reach critical master-data records. No public exploit identified at time of analysis, but the CVSS 9.1 rating and unauthenticated network vector make this a high-priority patch.
Unauthorized data compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) lets a remote, unauthenticated attacker read, create, delete, or modify any DRM-accessible data over HTTP. The vendor tags this as an authentication bypass, and its CVSS 3.1 score of 9.1 reflects complete confidentiality and integrity loss with no availability impact. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and no-privileges vector make it a high-priority patching target.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 permits a low-privileged, network-adjacent attacker to achieve full confidentiality and integrity compromise of critical master data, with a confirmed scope change that can propagate impact to additional Oracle Hyperion components. Exploitation via HTTP requires a victim to take some form of interactive action, placing this in a phishing or session-hijacking attack pattern. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has published a Critical Security Patch Update advisory for August 2026 addressing this flaw.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged, network-adjacent attackers over HTTP, with no user interaction required. The vulnerability resides in the Access and Security component and is tagged as an authentication bypass, enabling an attacker who holds minimal credentials to escalate their effective access to critical or all DRM-accessible data - achieving both full confidentiality and full integrity compromise without triggering availability disruption. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and lack of user interaction make exploitation straightforward for any authenticated user.
Complete takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by remote, unauthenticated attackers over TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Access and security component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can reach beyond DRM into additional connected products. No public exploit code has been identified at time of analysis, but the trivial exploitability (no authentication, low complexity) makes this a top-priority patch.
Local privilege escalation in Oracle Hyperion Data Relationship Management (DRM) version 11.2.25.0.000 allows a low-privileged attacker with established local infrastructure access to fully compromise the DRM system, with confirmed potential for scope change affecting additional Oracle Hyperion products. The CVSS vector (AV:L/AC:H/PR:L/S:C/C:H/I:H/A:H) reflects both the restricted attack surface - requiring local logon - and the significant blast radius if successfully exploited. No public exploit identified at time of analysis, and the high attack complexity further constrains real-world exploitation.
Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes an access control bypass in its 'Access and security' component that permits low-privileged authenticated users, reachable over HTTP, to gain unauthorized read access to all application data and unauthorized write access enabling creation, deletion, or modification of critical data. Tagged as an Authentication Bypass by the advisory, the flaw delivers CVSS 3.1 High severity (8.1) with combined confidentiality and integrity impact against an enterprise master data management platform. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a low-privileged network attacker via HTTP, with confirmed impacts across confidentiality, integrity, and availability. The flaw resides in the Access and Security component, pointing to an authorization defect - likely privilege escalation or access control bypass - that allows any authenticated user to compromise the entire application. No public exploit has been identified at time of analysis, but the CVSS 8.8 score, low attack complexity, and Oracle's 'takeover' impact language make this a high-priority remediation target for organizations running financial master data management environments.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible when an attacker who already holds high application privileges sends crafted requests over the network via HTTPS to the Access and security component. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond DRM itself, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 9.1). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full system takeover is possible in Oracle Hyperion Data Relationship Management version 11.2.25.0.000 via a network-exploitable flaw in the Access and Security component. A low-privileged authenticated attacker with HTTP access can, under high-complexity conditions, achieve complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the product is not listed in the CISA KEV catalog; the high attack complexity (AC:H) meaningfully reduces the realistic exploitation probability despite the severe potential impact.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by any low-privileged, network-accessible attacker via HTTP, with high impact across confidentiality, integrity, and availability. The vulnerability resides in the Access and Security component and carries a vendor-assigned CVSS 3.1 base score of 8.8, reflecting low attack complexity and no required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full remote takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by an unauthenticated attacker who can reach the service over the network via TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Access and security component and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch.
Unauthenticated remote compromise of Oracle Hyperion Data Relationship Management 11.2.25.0.000 (Access and security component) allows network attackers to read, create, modify, or delete all data accessible to the application over HTTP without any credentials. Oracle rates it CVSS 3.1 9.1 and tags it as an authentication bypass, meaning an attacker who can reach the web interface gains full confidentiality and integrity impact over master-data governance records. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Full product takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over TCP, per Oracle's Critical Patch Update advisory (CSPU August 2026). The flaw resides in the Access and security component and yields complete confidentiality, integrity, and availability compromise (CVSS 3.1 base 9.8). No public exploit identified at time of analysis, and it is not currently listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch item.
Oracle Hyperion Data Relationship Management (DRM) version 11.2.23.0.000 exposes its Web Client - Unicode component to unauthenticated remote attackers over HTTP. Exploitation allows complete read access to all DRM-accessible data - which in a master data management context often includes sensitive financial hierarchies and organizational structures - plus the ability to induce a partial denial of service. No public exploit has been identified at time of analysis, but the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivially low attack complexity with no authentication barrier.
Full system takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by an unauthenticated remote attacker over HTTP, with successful exploitation resulting in complete compromise of confidentiality, integrity, and availability. The vendor-assigned CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network reachability without authentication, though the high attack complexity rating indicates non-trivial exploitation conditions that reduce the likelihood of opportunistic mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Oracle Application Testing Suite 13.3.0.1 exposes an authentication bypass that allows an unauthenticated attacker on the same physical network segment to read critical data and perform limited data manipulation. The adjacency requirement (AV:A) constrains the attack surface to attackers who have physical or logical access to the local network segment hosting the affected system, but no credentials or user interaction are needed once that foothold exists. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero privilege requirement make this straightforward to exploit by any actor already on the adjacent network.
Local privilege escalation in Oracle Application Testing Suite 13.3.0.1 enables a low-privileged attacker with the 'Load Testing for Web Apps' application privilege to achieve full system takeover, resulting in complete loss of confidentiality, integrity, and availability. Oracle classifies this as 'easily exploitable' with CVSS 7.8 (High), reflecting low attack complexity and no user interaction requirement once local access is established. No public exploit has been identified at time of analysis, and Oracle issued a fix through the August 2026 Critical Patch Update.
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by a network-adjacent, low-privileged attacker holding the 'Load Testing for Web Apps' privilege over HTTPS. The CVSS 3.1 score of 7.5 (High) reflects total compromise of confidentiality, integrity, and availability, though Oracle classifies this as 'difficult to exploit' (AC:H), implying specific conditions must align for successful attack. No public exploit code and no CISA KEV listing have been identified at time of analysis, and EPSS data was not available in the provided intelligence.
Oracle Application Testing Suite 13.3.0.1 exposes a network-accessible vulnerability allowing low-privileged attackers holding the Load Testing for Web Apps role to achieve unauthorized complete read access to critical data and limited write access through HTTP-based exploitation that requires victim interaction. The attack carries a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle products beyond the testing suite itself. No public exploit code has been identified and CISA KEV listing is absent, though the low attack complexity and network accessibility make this a credible targeted threat for any environment running this specific version.
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by any low-privileged attacker holding the 'Load Testing for Web Apps' role via a network-accessible HTTPS vector. Oracle's own advisory classifies this as 'easily exploitable,' with complete confidentiality, integrity, and availability impact resulting in system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and broad CIA impact make this a credible priority for affected deployments.
Unauthenticated remote compromise of Oracle Application Testing Suite 13.3.0.1 allows a network attacker to read, create, modify, or delete all data accessible to the application over HTTP with no credentials or user interaction. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact (no availability impact), and tagged as an authentication bypass, this is a pre-auth flaw fixed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of PeopleSoft Enterprise FIN Common Objects Brazil 9.1 is achievable by a high-privileged attacker with network access using Oracle's T3 or IIOP protocols. The vulnerability carries a CVSS 3.1 score of 7.2, reflecting complete confidentiality, integrity, and availability impact despite the PR:H prerequisite. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though Oracle's August 2026 Critical Patch Update advisory addresses it.
Full takeover of Oracle Siebel CRM Integration (versions 17.0-26.6) is achievable by a low-privileged authenticated attacker over HTTP, exploiting a flaw in the REST component. The CVSS scope change (S:C) means successful exploitation can pivot beyond the directly targeted service, potentially compromising additional Oracle or backend systems. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog; however, the C:H/I:H/A:H impact triad warrants prioritized patching for organizations running Siebel in enterprise environments.
Remote exploitation of Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to compromise confidentiality, integrity, and availability of the platform when a victim user interacts with a malicious payload delivered over HTTP. Both actively supported versions - 12.2.1.4.0 and 14.1.2.0.0 - are affected, and successful exploitation produces a scope change, meaning impacts can propagate beyond the directly targeted WebCenter Content instance to adjacent products within the Fusion Middleware stack. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a credible threat in internet-exposed deployments.
Oracle Siebel CRM End User versions 17.0 through 26.6 expose a network-exploitable flaw in the Open UI component that, when triggered via a crafted HTTPS interaction, grants a low-privileged attacker full read and write access to critical CRM data - including complete confidentiality and integrity compromise with a documented scope change to additional products. The 'Authentication Bypass' tag reported by Oracle's security team suggests the Open UI layer can be manipulated to circumvent access controls in the context of an authenticated victim's session. No exploit code is publicly available and the vulnerability is not listed in the CISA KEV catalog at the time of analysis.
Full system takeover of Oracle Siebel CRM Deployment (versions 17.0 through 26.6) is achievable by unauthenticated remote attackers via HTTP, targeting the Migration component. The attack requires human interaction from a victim - a social engineering or luring condition that constrains opportunistic exploitation - but successful exploitation results in complete compromise of confidentiality, integrity, and availability of the Siebel CRM Deployment instance. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.
Cross-boundary compromise in Oracle Siebel CRM's Siebel Apps - Self Service module (Helpdesk/Training component, versions 17.0 through 26.6) lets an unauthenticated remote attacker fully read and modify all data accessible to the application after luring a legitimate user into interacting with a crafted HTTP request. Because the CVSS vector carries a scope change (S:C), successful exploitation can significantly impact products beyond Siebel itself, and the vendor/analyst tagging as an 'Authentication Bypass' reinforces the high confidentiality and integrity risk. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.3 base score and network-facing, unauthenticated nature make it a top-tier patch priority.
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allow a remote, unauthenticated attacker to reach the application over HTTP and create, modify, or delete critical data as well as trigger a complete, repeatable crash. Oracle rates this CVSS 9.1 (I:H/A:H, no confidentiality impact), reflecting an easily exploitable network-facing flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch item.
Remote unauthorized data access in Oracle Demand Planning versions 12.1 and 12.2 enables unauthenticated network attackers over HTTP to read all data accessible to the application and perform limited unauthorized write operations, with no authentication, elevated privileges, or user interaction required. Tagged as an authentication bypass by Oracle's own security team, this flaw carries a CVSS 3.1 base score of 8.2, reflecting high confidentiality and low integrity impact with no availability component. No public exploit code has been identified at the time of analysis, though the low attack complexity and complete absence of authentication barriers make this a straightforward target for automated or opportunistic exploitation once a proof-of-concept surfaces.
Privilege-leveraging compromise of Oracle Demand Planning (Internal Operations component) in Oracle Supply Chain / E-Business Suite versions 12.1 and 12.2 lets a low-privileged attacker with HTTP network access read and modify all data reachable by the module. Because the CVSS scope is Changed (S:C), successful attacks can extend impact beyond Demand Planning to additional connected products. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the 9.6 base score and low attack complexity make it a high-priority patch.
Oracle Loans 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes its Internal Operations component to network-based exploitation by low-privileged authenticated attackers over HTTP. Successful exploitation grants unauthorized ability to create, delete, or modify critical data across all Oracle Loans accessible records, and can induce a partial denial of service against the application. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and broad affected version range (12.2.3-12.2.15) make this a notable priority for Oracle EBS deployments.
Oracle Loans within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes all loan records to network-authenticated low-privileged users through an authorization control failure in the Internal Operations component. A low-privileged attacker with HTTP network access can read the complete Oracle Loans dataset and perform unauthorized inserts or updates on a subset of that data, without requiring elevated credentials or any victim interaction. No public exploit code has been identified at time of analysis, and Oracle has addressed this vulnerability in the August 2026 Critical Patch Update.
Local privilege escalation with scope change in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged authenticated user on the host system to bypass security controls within the Security component, achieving complete unauthorized read and write access to all application data. The CVSS scope change (S:C) means successful exploitation can cascade into additional Oracle products sharing the same infrastructure, amplifying the blast radius beyond the immediate application. No public exploit code or CISA KEV listing exists at time of analysis; the vulnerability was disclosed through Oracle's Critical Security Patch Update for August 2026.