Oracle
Monthly
Authenticated low-privileged network attackers can exploit Oracle SOA Suite's Fabric Layer to bypass access controls and gain read/write access to critical SOA data, with potential impact spreading to integrated products through scope change. The issue affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). No public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated remote attackers can read sensitive data from Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer over HTTP, with scope change potentially exposing data in connected Oracle products. The flaw is easily exploitable (CVSS 3.1 8.6, AV:N/AC:L/PR:N/UI:N/S:C/C:H) and is limited to confidentiality impact; no public exploit was identified in the provided intelligence at time of analysis.
Unauthenticated remote takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Fabric Layer over T3 or IIOP, with a maximum CVSS 3.1 score of 10.0 and a scope change indicating impact beyond the SOA Suite host. Any attacker who can reach the T3/IIOP listener needs no credentials or user interaction, so exposure is primarily governed by network reachability. The provided intelligence shows no KEV listing and no public exploit identified at time of analysis, but the assessed risk remains top-priority because successful exploitation can fully compromise confidentiality, integrity, and availability.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised by an authenticated low-privileged attacker who reaches the Fabric Layer over HTTP; successful exploitation affects confidentiality, integrity, and availability and can lead to takeover of the SOA Suite deployment (CVSS 8.8). The flaw is easily exploitable once a valid low-privileged account exists, so exposure is bounded by credential possession rather than anonymity. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Unauthenticated remote takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Fabric Layer component exposed over HTTP. The CVSS 3.1 score is 9.8 with network access, no privileges, and no user interaction, yielding high confidentiality, integrity, and availability impact; Oracle's October 2026 Critical Patch Update advisory is the reference. No public exploit code or CISA KEV entry was identified at time of analysis, but this is a genuine high-priority exposure because default configurations are affected and the only practical barrier is network reachability to the SOA Suite HTTP interface.
Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 ship a flaw in the BPM Composer component that lets any low-privileged, network-reachable account over HTTP take full control of the BPM Suite instance, with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The gating factor is authentication: exploitation requires a valid low-privilege credential and no user interaction, so exposure is concentrated in deployments that broadly issue accounts or where credentials can be phished or reused. No public exploit code was identified at time of analysis, and the issue is fixed in Oracle's October 2026 Critical Patch Update; risk is elevated because the barrier to entry is a single ordinary user session rather than administrative access.
Unauthenticated network access to the Generic REST interface in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can expose critical data, with a CVSS 3.1 score of 8.6 and a scope change that may extend disclosed access to additional integrated products. The flaw is remotely exploitable over HTTP without credentials or user interaction, but impact is limited to confidentiality, with no integrity or availability effect. No public exploit code was identified at time of analysis; the main exposure driver is whether the connector's REST endpoint is reachable by an attacker.
High-privileged SOAP access to Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can be abused to read and modify critical connector data, with scope change extending impact to additional Oracle Fusion Middleware products. The flaw is easily exploitable once an attacker already holds high privileges in the product (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, 8.7) and requires network reachability to the Connectors and Connector Server component; no public exploit was identified at time of analysis.
Oracle Solaris 11.4's Image Packaging System (IPS) can be induced to act on attacker-influenced package content delivered over HTTP, giving a network-positioned, unauthenticated attacker high confidentiality impact and limited integrity impact (CVSS 3.1: 7.1 High, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N). The attacker must either control or compromise the repository the host queries, or intercept cleartext HTTP package traffic, and exploitation still requires a Solaris operator to perform a package operation against that content - the UI:R condition is the decisive exposure limiter. Only Solaris 11.4 is listed as affected per Oracle's October 2026 CPU and ENISA EUVD; no public exploit code was identified in the provided intelligence at time of analysis.
Authenticated low-privileged attackers can take over Oracle Service Bus 14.1.2.0.0 by reaching its HTTP interface, with high confidentiality, integrity, and availability impact (CVSS 8.8). Only the 14.1.2.0.0 Core component is listed as affected, and Oracle characterizes the flaw as easily exploitable; no public exploit identified at time of analysis and no CISA KEV entry was provided. The authentication requirement is the main barrier, so exposure is greatest where Service Bus HTTP endpoints are reachable by users who can obtain even minimal valid credentials.
Low-privileged authenticated attackers with network HTTP access can exploit the Oracle Service Bus Core component to achieve takeover of the service, with high confidentiality, integrity, and availability impact (CVSS 8.8). Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 are affected, and exploitation requires a valid account but no user interaction; no public exploit code was identified at time of analysis. The authentication prerequisite limits exposure compared with unauthenticated flaws, but default deployments reachable over HTTP remain at risk from any low-privilege user.
Information disclosure in Oracle Solaris 11.4's Image Packaging System (IPS) allows unauthenticated remote attackers with HTTP network access to read critical data or all data accessible to the system; CVSS 3.1 is 7.5 with confidentiality-only impact. Oracle's October 2026 CPU identifies the affected component and version, but no public exploit code or CISA KEV entry is present in the supplied intelligence, so there is no public exploit identified at time of analysis. Exposure is limited to deployments where the IPS/pkg HTTP interface is reachable by untrusted networks.
Stored content injection in Oracle Applications Framework's Personalization component (Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to place malicious content that executes when another user opens the personalized page, causing high confidentiality and integrity impact and possible scope change into other products. The attacker must hold valid credentials and convince a second user to interact with the page, so exploitation is neither self-contained nor unauthenticated. No public exploit code or CISA KEV entry was identified at time of analysis.
Takeover of the Pasta Printing Engine component within Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a low-privileged authenticated user who can reach the component over HTTP, with full impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.5). Oracle characterizes the flaw as difficult to exploit, and the AC:H metric indicates an additional precondition the attacker does not fully control - such as a specific timing window, race condition, or particular printing-component state - so reliable, single-shot exploitation is not implied; no public exploit code and no active exploitation (CISA KEV) were identified at time of analysis. This is a serious but not top-tier priority issue: exploitation is gated behind valid EBS credentials and applies only to 12.2.x deployments running the Pasta component, and no user interaction is required (UI:N).
Local low-privileged users with logon access to hosts running Oracle E-Business Suite Applications DBA 12.2.3 through 12.2.15 can abuse the AD Utilities component to read, create, delete, or modify critical application data. The assessed CVSS 3.1 score is 7.1 High with AV:L/PR:L/UI:N and high confidentiality and integrity impact, while availability is unaffected; exploitation requires an existing local account and no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.
Takeover of the Oracle E-Business Suite Applications DBA (AD Utilities) component is achievable by a low-privileged attacker who already holds a logon on the application-tier host running those utilities, in supported versions 12.2.3 through 12.2.15. The attacker cannot reach the flaw remotely or unauthenticated (AV:L/PR:L), and successful exploitation additionally depends on a different, higher-privileged person performing an action - typically a DBA or operator running an affected AD Utilities operation against attacker-influenced input (UI:R). Oracle rates the impact on confidentiality, integrity and availability as high (CVSS 3.1 base 7.3); no public exploit code or confirmed active exploitation was identified at time of analysis, and the practical risk is gated by shared access to the application tier and by privileged-operator behavior rather than being a drop-everything emergency.
Denial of service in Oracle Outside In Technology 8.5.8 allows unauthenticated, network-accessible attackers to hang or repeatedly crash the Outside In Core document parsing/conversion path, producing complete availability loss for applications that expose those functions over HTTP. The flaw is an embedded SDK issue, so real-world exposure is limited to products that pass untrusted files into Outside In for preview or conversion; confidentiality and integrity are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis.
Crafted-document processing in Oracle Outside In Technology 8.5.8 (Outside In Core) can be exploited by an unauthenticated network attacker to take over the affected application, with high confidentiality, integrity, and availability impact. The attacker delivers a malicious file over HTTP and succeeds only if a person or automated pipeline opens it (UI:R), so real-world exposure is bounded by whether the deploying product ingests untrusted documents through Outside In. No CISA KEV listing appears in the supplied intelligence and no public exploit was identified at time of analysis; the 8.8 score reflects potential impact rather than demonstrated exploitation.
Unauthenticated remote attackers can hang or repeatedly crash services that embed Oracle Outside In Technology 8.5.8 (Outside In Core) by delivering a crafted malformed document to its file-parsing engine, producing a CVSS 7.5 availability-only denial of service (AV:N/AC:L/PR:N/UI:N/A:H, no confidentiality or integrity impact). Because Outside In is a parsing SDK rather than a network service, real exposure is limited to applications that expose its document-conversion/filtering functionality to attacker-supplied files over HTTP; deployments that only process trusted internal documents are not practically reachable. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied in the feed data, so the practical risk is bounded to availability disruption of document-processing pipelines.
Unauthenticated remote attackers can read critical data and cause a partial denial of service in Oracle Outside In Technology 8.5.8 by supplying crafted files to applications that embed the Outside In Core parser. The CVSS 3.1 score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L), reflecting high confidentiality impact, low availability impact, and no integrity impact. No public exploit was identified at time of analysis, and exploitation depends on a host application exposing file-processing paths to untrusted input.
Unauthenticated attackers able to reach an Oracle Service Bus HTTP listener can hang or repeatedly crash the Core component in versions 12.2.1.4.0 and 14.1.2.0.0, producing a complete denial of service (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Triggering it demands no credentials, no user interaction and little complexity, so the real gating factor is network exposure - internet-facing or partner-reachable Service Bus instances are the ones at risk, while segmented internal deployments are materially harder to hit. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; Oracle ships fixes through its October 2026 Critical Patch Update.
Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 expose a high-severity flaw in the Core component that lets a low-privileged, network-positioned attacker take over the service bus, with full impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). Exploitation is straightforward once credentials exist - no user interaction, low attack complexity, HTTP-reachable - but it is not unauthenticated: the attacker must already hold a valid low-privilege account on the target (PR:L). At time of analysis there is no CISA KEV listing and no public exploit code identified, so this is a credible high-priority patch target rather than an emergency, and the practical risk is dominated by how freely low-privilege accounts can be obtained and how exposed the HTTP interface is.
Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 can be compromised by a low-privileged attacker with network access via HTTP, potentially resulting in takeover of the Payroll component with high confidentiality, integrity, and availability impact. The flaw resides in the Internal Operations component and has high attack complexity, so exploitation requires a valid low-privileged account plus conditions outside the attacker's control; no public exploit was identified at time of analysis. With a CVSS 3.1 score of 7.5, the risk is High but constrained by the authentication and complexity prerequisites.
Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 allows an authenticated low-privileged attacker with network access to its HTTP interface to take over the service, with high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires valid low-privileged credentials and reachability to a Service Bus HTTP endpoint, but no user interaction and low attack complexity; default supported configurations appear affected. No public exploit identified at time of analysis.
Oracle General Ledger 12.2.3 through 12.2.15 allows an authenticated low-privileged attacker with HTTP network access to create, delete, or modify critical ledger data, read a subset of data, and cause a hang or repeated crash. Exploitation is constrained by high attack complexity and the need for a valid E-Business Suite account, so it is not reliably repeatable against default deployments. No public exploit code or confirmed active exploitation was identified at time of analysis.
Order Capture in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a high-privileged attacker who already holds a valid EBS account and can reach the Internal Operations component over HTTP, yielding full confidentiality, integrity, and availability impact (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is straightforward once the privileged account exists - no user interaction is required and attack complexity is low - but the PR:H prerequisite means anonymous external attackers cannot reach the flaw, making this a conditional rather than top-tier risk. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so the practical exposure depends on how widely privileged EBS accounts are distributed in the environment.
Takeover of the Applications Platform Engineering component in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for an attacker who already holds a low-privileged local logon on the EBS host. The flaw sits in the 'Valid Session' component, is low-complexity with no user interaction, and yields high confidentiality, integrity, and availability impact (CVSS 7.8). Exploitation is gated by the AV:L/PR:L prerequisites, and no public exploit code was identified at time of analysis.
Takeover of Oracle GoldenGate is possible through its Admin Server Executable, where a low-privileged authenticated attacker with HTTPS network access can achieve high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments are GoldenGate 19.1.0.0.0 through 19.32.0.0, 21.3 through 21.23, and 23.4 through 23.26.3.0.0, while instances patched to the October 2026 CPU fix level are not exposed. No public exploit code has been identified at time of analysis, but low attack complexity and network reachability make timely patching important.
Authenticated low-privileged attackers who can reach the OSSL module of Oracle HTTP Server over HTTP can read and modify critical data, with a scope change that lets the impact extend into other Fusion Middleware products reachable through or proxied by the server. The flaw carries a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N; no availability impact) and affects only Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0. No public exploit code or CISA KEV entry was identified at time of analysis, but the low attack complexity and the front-end position of OHS make this a high-priority patch target.
Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 can be compromised by unauthenticated, remote attackers through the WebLogic Server Proxy Plug-in component, yielding high confidentiality and integrity impact and - because the CVSS vector carries a scope change (S:C) - potential knock-on impact to systems the plug-in fronts. Oracle rates the attack complexity as high ('difficult to exploit'), so the bug is not reliably repeatable against arbitrary targets and depends on conditions outside the attacker's control, but no authentication (PR:N) or user interaction (UI:N) is required once those conditions are met. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the source data.
Unauthenticated remote attackers can compromise Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 through the Authentication Engine, obtaining high-impact confidentiality and integrity access and potentially affecting other products because the CVSS scope is changed. The CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), with no availability impact; no public exploit identified at time of analysis. Exposure depends on reachability of the OAM authentication endpoint, and default deployments appear exploitable because the description calls out no special configuration prerequisite.
Takeover of Oracle VM VirtualBox 7.2.20 is possible by a high-privileged attacker with access to the physical communication segment attached to the hardware running VirtualBox, per Oracle's October 2026 CPU. The Core component flaw has a CVSS 3.1 score of 8.4 (AV:A/AC:L/PR:H/UI:N/S:C) and can cross a scope boundary to affect additional products. No public exploit or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied.
Takeover of Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) is possible for an attacker who already holds a low-privileged authenticated logon on the host running the product, affecting versions 9.2.0.0 through 9.2.26.5. The flaw is local rather than network-reachable (AV:L), needs no user interaction, and has low attack complexity, so once the prerequisite account access exists the attacker can reliably gain high confidentiality, integrity, and availability impact, yielding a CVSS 3.1 base score of 7.8. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical gating factor is possession of local credentials on the EnterpriseOne server tier.
Unauthenticated remote attackers with HTTP access to the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools (releases 9.2.0.0 through 9.2.26.5) can tamper with application data, based on the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5). The flaw is scored for high integrity impact only - attackers cannot read confidential data or disrupt availability - but no privileges or user interaction are required, making the integrity of EnterpriseOne business records the sole but significant exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and the primary practical limit on exposure is whether the EnterpriseOne Tools HTTP interface is reachable from untrusted networks.
Unauthenticated network attackers who can reach the Interoperability SEC component of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 over TLS can read and modify critical business data, although Oracle rates the attack as difficult (AC:H) because an unspecified precondition must be satisfied. No public exploit code or confirmed active exploitation has been identified at time of analysis. Oracle's October 2026 Critical Patch Update advisory is the reference for remediation.
Takeover of JD Edwards EnterpriseOne Tools is possible for low-privileged attackers who can reach the JDENET service on affected versions 9.2.0.0 through 9.2.26.5. The flaw is in the Interoperability SEC component and has a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring a valid low-level account or an existing authenticated foothold rather than anonymous access. No public exploit identified at time of analysis; Oracle's October 2026 Critical Patch Update advisory is the reference source.
A high-complexity privilege-escalation flaw in Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component, versions 9.2.0.0 through 9.2.26.5) lets a low-privileged, already-authenticated attacker reach the JDENET service over the network and take over the EnterpriseOne Tools environment, with full confidentiality, integrity, and availability impact (CVSS 7.5). Exploitation is explicitly difficult (AC:H) because success depends on timing, configuration, or environmental conditions outside the attacker's control, and it requires pre-existing low-privilege credentials plus network reachability to JDENET. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV signal was supplied; Oracle addresses it in its October 2026 Critical Patch Update.
Low-privileged users who can reach the JDENET service on Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can escalate to full takeover of the EnterpriseOne Tools instance, affecting confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the Database and Comm SEC component, requires only network reachability plus a valid low-privilege account, and needs no user interaction or elevated rights, making attack complexity low. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible high-priority issue but not a drop-everything emergency; the practical constraint on attackers is possession of credentials and exposure of JDENET.
Authenticated low-privileged users of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can abuse the Package Build SEC component over HTTP to create, delete, or modify critical application data and to hang or repeatedly crash the Tools service, yielding a combined integrity and availability impact rated CVSS 8.1. Exploitation requires only a valid low-tier account (PR:L), with low attack complexity, no user interaction, and no elevated privileges, so the practical barrier is account provisioning plus reachability of the EnterpriseOne Tools web layer rather than any exploit precondition. At the time of analysis no public exploit code or confirmed active exploitation was identified, and no CISA KEV listing exists for this CVE.
A local privilege-escalation weakness in the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools (9.2.0.0 through 9.2.26.5) lets an attacker who already holds a valid low-privileged logon on the host where the Tools run read and modify critical application data, delivering a high confidentiality and integrity impact with no availability effect (CVSS 3.1 base 7.1). Because exploitation is local (AV:L) and requires authenticated low-privileged access (PR:L), it is primarily a post-compromise or insider-abuse risk rather than an internet-facing one; no public exploit code and no confirmed active exploitation were identified at time of analysis. The vendor notes the issue is easily exploitable once such access exists, so any shared or multi-tenant host running an unpatched Tools version should be treated as exposed to its own low-privileged users.
Authenticated low-privileged users with HTTP access to the Interoperability SEC component of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can read critical application data beyond their intended authorization scope and trigger a partial denial of service, as addressed in Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) reflects high confidentiality impact and low availability impact, gated only by the need for a valid low-privilege account and reachable integration endpoints. No public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis, and the tag 'Authentication Bypass' indicates the weakness is an authorization/access-control gap rather than a pre-auth entry point.
Oracle JD Edwards EnterpriseOne Tools (Interoperability SEC) versions 9.2.0.0 through 9.2.26.5 allows a low-privileged authenticated attacker with network access to JDENET to create, delete, or modify critical data and read all data accessible to the application. The CVSS 3.1 score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N); no public exploit code or CISA KEV confirmation was identified at time of analysis. Despite an 'Authentication Bypass' tag, the assessed vector requires valid low-privileged credentials, making this a credible high-priority patch target but not a confirmed emergency.
Unauthenticated network attackers can achieve full takeover of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) by reaching the SMTP mail-handling path of the Enterprise Infrastructure SEC component, as disclosed in Oracle's October 2026 Critical Patch Update. Oracle rates the flaw 8.1 with high confidentiality, integrity, and availability impact, but attack complexity is high (AC:H), meaning success depends on message-processing state or timing the attacker does not fully control, so reliable exploitation is non-trivial. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a serious-but-not-emergency patching priority rather than an active incident.
High-severity confidentiality exposure in Oracle Outside In Technology 8.5.8, a document-parsing library embedded in third-party applications, lets unauthenticated remote attackers read critical data through HTTP requests. The CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting low attack complexity, no user interaction, scope change, and high confidentiality impact with no integrity or availability effect. Exploitation realistically requires that the library's Outside In Core parsing path be reachable and fed attacker-supplied documents by the embedding product; no public exploit code or CISA KEV entry is identified at time of analysis.
Unauthenticated network attackers can read, create, delete, or modify critical data in Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 through the Core component's HTTP interface. The 9.1 CVSS score reflects high confidentiality and integrity impact with no availability impact, low complexity, and no user interaction. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided; exposure is primarily determined by whether WebLogic HTTP/T3 listeners are reachable from untrusted networks.
Oracle VM VirtualBox 7.2.16 carries a flaw in its Core component that lets a low-privileged user with local logon to the host read critical data accessible to VirtualBox and reliably hang or repeatedly crash the hypervisor, with a scope change (S:C) that points to a guest-to-host boundary escape rather than a mere guest-local bug. The vector (AV:L/AC:L/PR:L/UI:N) means exploitation is local and requires only a low-privileged account, no user interaction, and low attack complexity, so risk concentrates in multi-tenant hosts, VDI estates and developer machines where semi-trusted users can log on or drive a guest VM. No public exploit code has been identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV entry), no EPSS score was supplied, and the exact fixed build is not specified in the provided data - the Oracle Critical Patch Update (October 2026) advisory is the authoritative patch source.
Unauthenticated attackers with HTTP network access to a third-party web server (Apache HTTP Server, Microsoft IIS, or Oracle iPlanet) running the Oracle WebLogic Server Proxy Plug-in can bypass authentication and obtain read/write access to critical data reachable through the proxied WebLogic backend. The flaw affects plug-in versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 and carries a CVSS 3.1 score of 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). Oracle rates exploitation as difficult (AC:H), and no public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis; EPSS was not supplied.
Unauthenticated remote attackers can disclose critical data from Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 by reaching the Authentication Engine over HTTP; the issue is rated CVSS 7.5 with high confidentiality impact and no integrity or availability effect. Exploitation requires only network reachability to the OAM authentication endpoint, making internet-exposed or broadly reachable deployments the priority. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied.
Authenticated low-privileged attackers with HTTP access to the Oracle BI EE Analytics Server can take over affected 8.2.0.0.0 and 26.01.0.0.0 installations, with high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires a valid low-privilege account (PR:L) but no user interaction and low complexity; no public exploit was identified at time of analysis.
Unauthenticated remote takeover of Oracle Access Manager is possible through its SAML-facing Authentication Engine, affecting builds 12.2.1.4.0 and 14.1.2.1.0 of the Oracle Fusion Middleware component. With a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), Oracle characterizes the flaw as easily exploitable by an attacker who can reach the SAML authentication interface over the network, with full confidentiality, integrity, and availability impact and potential full compromise of the OAM service. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation has not been confirmed in the wild, but the combination of unauthenticated network access, low attack complexity, and complete impact makes this a top-tier patching priority for any internet- or partner-facing OAM deployment.
Unauthenticated attackers with HTTP network access can abuse Oracle Access Manager's Authentication Engine (versions 12.2.1.4.0 and 14.1.2.1.0) to achieve full confidentiality and integrity compromise of OAM-accessible data, with scope change extending impact to federated downstream products. Oracle rates the issue 'difficult to exploit' (AC:H), meaning success hinges on non-trivial environmental or flow-specific conditions rather than a simple request, so this is a serious but conditional risk rather than a point-and-click exploit. No public exploit code or confirmed active exploitation was identified at time of analysis, and no CVE-level patch version is stated beyond Oracle's October 2026 Critical Patch Update advisory. EPSS: not provided.
Unauthenticated network attackers can potentially take over Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 through crafted SAML authentication exchanges, yielding high confidentiality, integrity, and availability impact. The flaw is rated CVSS 3.1 8.1 with AC:H, indicating exploitation is difficult and depends on specialized conditions in the SAML flow; no public exploit or CISA KEV status is identified in the provided data, and SAML must be configured and reachable for exposure.
Unauthenticated network attackers can compromise the Authentication Engine component of Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 over HTTP, gaining high-confidentiality read access to data managed by the identity server plus limited ability to modify it and to degrade availability (CVSS 3.1 base 8.6, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, no credentials, session, or victim interaction are needed - only network reachability to a vulnerable OAM deployment. No public exploit code or confirmed active exploitation was identified at time of analysis, so risk is driven by exposure: internet-facing or broadly reachable OAM instances should be treated as high priority and patched via Oracle's October 2026 Critical Patch Update, while internal-only deployments behind filtering proxies have materially lower reachability.
Unauthenticated network attackers can obtain unauthorized read access to critical data accessible through Oracle MySQL Connector/Python 26.7.0, the only affected release. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), the flaw is remotely reachable at low complexity without privileges or user interaction, but impact is bounded to data disclosure and to deployments where the connector is network-exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; Oracle's October 2026 Critical Patch Update is the reference advisory.
Low-privileged authenticated users can achieve full takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 through the OIM Legacy UI component, which is reachable over HTTP and requires no victim interaction. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects complete loss of confidentiality, integrity and availability, but exploitation is gated on an attacker already holding a valid low-privilege OIM account plus network reachability to the deployed Legacy UI - unauthenticated external exploitation is not indicated by the assessed vector. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so the practical risk is highest for environments where the Legacy UI is exposed to broad network segments or where low-privilege accounts are weakly governed.
Authenticated takeover of Oracle Identity Manager is achievable through the OIM Legacy UI component: a holder of any low-privileged account who can reach the instance over HTTPS can escalate to full control of confidentiality, integrity, and availability (CVSS 8.8). Only versions 12.2.1.4.0 and 14.1.2.1.0 of the Fusion Middleware product are listed as affected, and no user interaction or special attack conditions are required beyond that minimal foothold. Oracle resolves the issue with the October 2026 Critical Patch Update; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, but the low complexity and high payoff make unpatched, lower-trust-accessible deployments a priority.
Complete compromise of Oracle WebLogic Server is possible for unauthenticated, network-positioned attackers targeting the T3 or IIOP listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), meaning no credentials or user interaction are required and confidentiality, integrity, and availability are all fully impacted. No CISA KEV entry or public exploit code is identified in the provided intelligence at time of analysis, but the lack of exploit reporting does not reduce the priority for internet-exposed T3/IIOP endpoints.
Unauthenticated HTTP access to the Data Transforms component in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 can be abused to read critical ODI data and perform limited unauthorized data changes. The flaw is rated CVSS 8.2 with high confidentiality and low integrity impact and requires no credentials or user interaction, making reachable ODI endpoints a high-priority exposure. No public exploit code was identified at time of analysis.
Unauthenticated remote takeover of Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 is possible through the ODI Console / Repository Explorer over HTTP, as addressed in Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score is 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no authentication, no user interaction, and high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV confirmation was identified in the supplied intelligence at time of analysis, but internet-exposed ODI Console instances are high priority because the assessed limiting factor is network reachability rather than any special configuration.
Unauthenticated remote takeover of Oracle Data Integrator is possible through the Console / Repository Explorer RMI interface on versions 12.2.1.4.0 and 14.1.2.0.0, with CVSS 3.1 score 9.8 reflecting high confidentiality, integrity, and availability impact. Attackers with network reachability to the RMI listener need no credentials or user interaction; the primary exposure constraint is whether that listener is reachable across network boundaries. Exploitation status: no public exploit identified at time of analysis.
Authenticated low-privileged attackers with HTTP access to Oracle Product Hub 12.2.3 through 12.2.15 can achieve takeover of the component, with scope change (S:C) extending impact to additional connected Oracle E-Business Suite products. The CVSS 3.1 base score is 8.5, but exploitation is rated difficult (AC:H) and requires a valid low-privileged account (PR:L) with no user interaction (UI:N). No public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Unauthenticated network attackers can potentially bypass authentication and read or modify critical data through the Oracle WebLogic Server Proxy Plug-in in supported 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 deployments, although Oracle rates exploitation as difficult (AC:H) and the impact may extend to systems behind the proxy because of scope change. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided, so internet-facing proxy plug-in installations should still be prioritized for review and patching.
Successful exploitation of Oracle Sourcing 12.2.3 through 12.2.15 can allow a low-privileged authenticated attacker with HTTP network access to take over the Auctions component, causing high confidentiality, integrity, and availability impact. Oracle rates the issue difficult to exploit because attack complexity is high, meaning additional conditions outside the attacker's direct control must be satisfied beyond sending crafted requests. No public exploit code or CISA KEV entry was identified at time of analysis, so the practical risk is constrained by the valid-account prerequisite and the high-complexity barrier.
Unauthenticated attackers with network access to Oracle E-Business Suite's Shipping Execution module can bypass authentication in the Workflow Events component to read and modify critical shipping data. The flaw affects E-Business Suite 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact; the high attack complexity (AC:H) reflects difficult-to-satisfy exploitation preconditions rather than a lack of severity. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated data tampering and disclosure in the Workflow Events component of Oracle Shipping Execution (Oracle E-Business Suite 12.2.3 through 12.2.15) can be triggered by a network attacker over HTTP, yielding full confidentiality and integrity impact on the module's accessible data with a CVSS 3.1 base score of 7.4. Oracle explicitly characterizes the flaw as difficult to exploit (AC:H), so a successful attack depends on conditions outside the attacker's control rather than a single crafted request, and there is no availability impact - the realistic risk is data disclosure and modification, not service disruption. No public exploit code or confirmed active exploitation was identified at time of analysis, and given the high attack complexity this is best treated as a genuine but second-tier priority addressed through the October 2026 Critical Patch Update.
An authenticated low-privileged user who can reach the Oracle Contract Lifecycle Management for Public Sector HTTP endpoints in Oracle E-Business Suite can achieve full takeover of the CLM module's data and functionality - a complete loss of confidentiality, integrity and availability scored at CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only instances running the Award/PO component of CLM for Public Sector on releases 12.2.3 through 12.2.15 are exposed, and the attack requires a valid account (PR:L) with no user interaction and low complexity once that prerequisite is met. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle typically withholds technical detail until customers have patched, so the absence of exploit reporting should not be read as low risk for internet-facing or broadly accessible EBS deployments.
Oracle E-Business Suite 12.2.3 through 12.2.15 ships a Contract Lifecycle Management for Public Sector module whose Award/PO component fails to properly constrain what a logged-in low-privileged user can do, so any account holder with HTTP reach to the application can read and alter contract and purchase-order data they should not touch. The result is a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact and no availability impact; the vector (AV:N/AC:L/PR:L/UI:N/S:U) means exploitation requires prior authentication but no admin rights, no user interaction and no special configuration. Risk is concentrated in EBS deployments with large or loosely governed user populations, or where credentials can be phished or reused; no public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle has published a fix in its October 2026 Critical Patch Update.
Local privilege escalation in Oracle Solaris 11.4 lets an attacker who already holds a low-privileged logon escalate to full control of the host through the Services component, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.8). Exploitation is local only (AV:L) and requires a valid low-privileged account (PR:L), but no user interaction (UI:N) and low complexity (AC:L) mean escalation is reliable once a foothold exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and hosts where untrusted users have no shell access are not exposed.
Full system takeover of Oracle Solaris 11.3 and 11.4 is possible for unauthenticated network attackers who can reach the Image Packaging System (IPS) HTTP service, with high confidentiality, integrity, and availability impact. The 9.8 CVSS score reflects network reachability with low attack complexity, no privileges, and no user interaction, but practical exposure depends on whether the IPS endpoint is accessible from an attacker-reachable network path. No public exploit code or CISA KEV entry was identified at time of analysis.
Oracle Solaris 11.3 and 11.4 can be fully compromised - confidentiality, integrity, and availability - by an authenticated low-privileged attacker who can reach the HTTP-exposed Utility component, per Oracle's October 2026 Critical Patch Update. The CVSS 3.1 base score of 8.8 reflects network reachability (AV:N), low attack complexity (AC:L), and no user interaction (UI:N), gated only by the PR:L requirement for an existing low-privilege account on the host; successful exploitation is described by Oracle as leading to takeover of the operating system. No public exploit code has been identified and there is no CISA KEV listing at time of analysis, but the modest preconditions mean exposed Solaris estates should treat this as a high-priority patching item.
Takeover of Oracle Product Hub is possible for a low-privileged authenticated attacker with HTTP access to the Internal Operations component in Oracle E-Business Suite 12.2.3 through 12.2.15. The flaw carries CVSS 3.1 score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning any valid low-tier session can reach the vulnerable component without user interaction and potentially gain full control of confidentiality, integrity, and availability. No public exploit code or CISA KEV entry was identified at time of analysis, but the low attack complexity and authenticated network vector make it a credible priority for exposed EBS deployments.
Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by an authenticated low-privileged attacker with HTTP network access, enabling high impact to confidentiality, integrity, and availability of the component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) shows low attack complexity and no user interaction once a valid low-privileged account is obtained, making this a genuine high-priority issue. No public exploit identified at time of analysis and no CISA KEV entry or EPSS score was provided in the supplied intelligence, but Oracle has published an October 2026 CPU advisory for remediation.
Any authenticated low-privilege user who can reach the HTTP interface of Oracle Product Hub (the Internal Operations component of Oracle E-Business Suite) can take full control of the module, with high impact on confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U). Deployments of E-Business Suite 12.2.3 through 12.2.15 running Product Hub are in scope, and because attack complexity is low and no user interaction is required, a single valid low-privilege session is sufficient to attempt exploitation - the real barrier is first obtaining EBS credentials and network reachability to the endpoint. No public exploit code and no CISA KEV entry were identified at time of analysis, so this is a credible mid-to-high priority patching item rather than an emergency, but the low bar for a credentialed insider or compromised account keeps it worth scheduling promptly.
Oracle E-Business Suite releases 12.2.3 through 12.2.15 expose Installed Base records to any low-privileged application user who can reach the Data Provider UI component over HTTP, allowing broad reads of critical data plus limited unauthorized inserts, updates, and deletes (CVSS 3.1 base score 7.1, C:H/I:L/A:N). Exploitation requires only a valid EBS account (PR:L) and network reach to the module - no user interaction and no special conditions - so the practical exposure is highest where self-registered, partner, or contractor accounts exist or where the Installed Base UI is internet-facing. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Oracle CPU patches should be scheduled on a normal priority rather than deferred indefinitely, since the weakness is trivially triggerable once credentials are held.
Unauthorized access to and modification of Installed Base data in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a low-privileged authenticated attacker who convinces another user to interact with a crafted request over HTTP. The CVSS 3.1 score is 7.6 with scope change (S:C), high confidentiality impact, and low integrity impact, meaning connected Oracle products beyond Installed Base may also be affected. No public exploit was identified at time of analysis, and the assessed risk is to prioritize patching rather than treat as an emergency.
Takeover of Oracle E-Business Suite's Bills of Material module (versions 12.2.3 through 12.2.15) is possible for a low-privileged attacker who can reach the 'Internal Operations' component over HTTP, but the high attack complexity makes this a genuine second-tier priority rather than an emergency. Exploitation requires a valid EBS account and conditions beyond the attacker's control, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Strategic Network Optimization in Oracle E-Business Suite versions 12.2.3 through 12.2.15 can be taken over through a network-based attack that requires no credentials but does require a victim to interact with attacker-controlled content. The CVSS 3.1 score is 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting high confidentiality, integrity, and availability impact; no public exploit was identified at time of analysis. The limiting prerequisite is user interaction, not authentication, so exposure of the SNO HTTP interface together with successful social engineering is the practical attack path.
Authenticated attackers can achieve broad data tampering and disclosure against Oracle E-Business Suite's Global Order Promising Web Service in versions 12.2.3 through 12.2.15, with CVSS 3.1 scoring 8.2 (C:H/I:H, no availability impact). Exploitation requires a valid low-privilege EBS account (PR:L) plus network HTTP reachability to the affected component and satisfaction of high-complexity, server-side conditions the attacker cannot directly control (AC:H); no user interaction is needed (UI:N), and successful attacks cross a scope boundary (S:C), meaning other products can be significantly impacted. No public exploit code or confirmed in-the-wild activity was identified at time of analysis - no public exploit identified at time of analysis - so risk is real but bounded by the authentication prerequisite and the High attack complexity.
Takeover of Oracle Contract Lifecycle Management for Public Sector (the Award/PO component of Oracle E-Business Suite) is achievable by an attacker who already holds a high-privileged application account, with full loss of confidentiality, integrity and availability (CVSS 3.1 base 7.2). Only versions 12.2.3 through 12.2.15 are affected, and the attack is carried out over the network via HTTP with low complexity and no user interaction, so the practical barrier is the prerequisite of an existing highly privileged session rather than any technical obstacle. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so risk is concentrated on privileged insiders, compromised administrator credentials, and environments where the CLM application is exposed to attackers who have already escalated.
Authenticated denial-of-service with limited data disclosure and modification in Oracle Shipping Execution affects Oracle E-Business Suite deployments running 12.2.3 through 12.2.15. A low-privileged attacker holding a valid EBS account can reach the Workflow Events component over HTTP and, only when specific non-default conditions line up (AC:H), hang or repeatedly crash the Shipping Execution module while reading and modifying a subset of its data; the scope-change flag means integrated EBS products can also be impacted. CVSS 3.1 scores this 7.7 with availability as the dominant impact, and while the flaw is difficult to exploit, no public exploit code or confirmed active exploitation (no CISA KEV listing) has been identified at time of analysis.
Unauthenticated, network-reachable attackers can access critical or all Oracle Shipping Execution data in Oracle E-Business Suite versions 12.2.3 through 12.2.15 by targeting the Workflow Events component over HTTP. The flaw is rated 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with high confidentiality impact and no integrity or availability impact; no public exploit code or CISA KEV entry was identified at time of analysis. Exposure is limited mainly by whether the EBS web tier is reachable from untrusted networks.
Unauthenticated network attackers can potentially take over Oracle Shipping Execution in Oracle E-Business Suite 12.2.3 through 12.2.15 by abusing a high-complexity flaw in the Workflow Events component, rated CVSS 8.1 with full confidentiality, integrity, and availability impact. Oracle characterizes the issue as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control such as precise timing, server state, or a specific configuration rather than reliable reproduction against any default install, and no public exploit code or active exploitation has been identified at time of analysis. Practical risk is further bounded by exposure: the EBS HTTP interface and the Shipping Execution module must be network-reachable to the attacker, which in many deployments means internal-only rather than internet-facing access.
Oracle Shipping Execution, a module of Oracle E-Business Suite, exposes an Internal Operations component that permits a low-privileged authenticated user with HTTP access to read, modify, and partially disrupt shipping data across supported releases 12.2.3 through 12.2.15. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:L/A:L, 7.6) reflects a high confidentiality impact with limited integrity and availability effects, and no public exploit code or confirmed active exploitation was identified at time of analysis. The main barrier to abuse is the requirement for a valid low-privilege EBS session (PR:L), so exposure is greatest where the EBS web tier is broadly reachable or where low-privilege accounts are easy to obtain.
Oracle Quality in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated low-privileged remote attacker to read and modify critical data through the Internal Operations component over HTTP. The flaw is low complexity and requires no user interaction, but valid EBS credentials are required, which limits anonymous exploitation; confidentiality and integrity are fully impacted while availability is not. No public exploit code or CISA KEV entry was identified at time of analysis.
Oracle Project Contracts versions 12.2.3 through 12.2.15 expose critical data to any user holding a valid low-privileged E-Business Suite account, because the Internal Operations component fails to adequately restrict what that account can read over HTTP. Successful exploitation gives high-confidentiality read access to Project Contracts data and, due to a scope change in the assessed vector, can extend to data in other Oracle products reachable from the same suite; integrity and availability are unaffected. Exploitation requires authentication (CVSS PR:L) and no user interaction, making it low-complexity for an insider or anyone who has obtained a mundane EBS credential - no public exploit code and no confirmed active exploitation were identified at time of analysis, and Oracle addresses the flaw through its October 2026 Critical Patch Update.
Unauthenticated network attackers can read and modify critical data in Oracle E-Business Suite's Mobile Application Server (MWA Terminal Server) versions 12.2.3 through 12.2.15, with a CVSS 3.1 score of 7.4. Oracle rates the issue difficult to exploit because of high attack complexity, and no public exploit code or CISA KEV active-exploitation signal was identified at time of analysis. Exposure is greatest where the MWA Terminal Server is reachable beyond trusted internal or warehouse-handheld networks.
Oracle HCM Common Architecture, the shared framework layer within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations component reachable over HTTP that a low-privileged authenticated user can abuse to read and modify critical HCM data and to partially degrade service availability. The defect is rated CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), with the High attack complexity reflecting a precondition or environmental state the attacker does not control, which keeps reliable exploitation difficult even though no victim interaction is needed. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Oracle published the fix in its October 2026 Critical Patch Update, so priority is real but second-tier relative to unauthenticated, low-complexity flaws.
Takeover of the Oracle HCM Common Architecture component is possible in Oracle E-Business Suite releases 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access to the Internal Operations functionality can achieve full compromise of the component with high confidentiality, integrity and availability impact. Exploitation is constrained: the attacker must already hold valid low-privilege EBS credentials (PR:L) and the attack carries high complexity (AC:H), meaning success depends on conditions outside the attacker's direct control such as timing, configuration or application state, and no end-user interaction is required (UI:N). No public exploit code was identified and the issue is not confirmed actively exploited (not in CISA KEV) at time of analysis; EPSS was not provided, so risk is concentrated on internet-exposed EBS deployments where low-privilege or self-service accounts are widely provisioned.
Oracle E-Business Suite's HCM Common Architecture component (Internal Operations) in versions 12.2.3 through 12.2.15 can be compromised by a low-privileged attacker with network HTTP access, allowing full takeover of the component with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.5). Exploitation is gated by high attack complexity - Oracle describes it as 'difficult to exploit' - meaning conditions outside the attacker's direct control (such as a specific application state, configuration, or timing condition) must align, and the attacker must already hold a valid low-privileged EBS account (PR:L, not unauthenticated). There is no public exploit code and no confirmed active exploitation (not in CISA KEV) at time of analysis, but internet-exposed EBS portals enlarge the pool of potential low-privileged attackers who could attempt it.
Unauthorized read and write access to critical data in Oracle E-Business Suite's Document Management and Collaboration (Attachments) component affects versions 12.2.3 through 12.2.15 and, because of a scope change, can extend to data and resources in other EBS products. A low-privileged authenticated attacker with HTTP access can trigger the flaw, but exploitation requires a different user-typically someone with higher privileges-to interact with attacker-supplied attachment content, so this behaves like a stored/second-order access-control or injection issue (CVSS 8.7; C:H/I:H/A:N) rather than a pre-auth remote compromise. No public exploit code or CISA KEV entry was identified in the available intelligence, and no EPSS score was supplied.
Authenticated low-privileged network attackers can exploit Oracle SOA Suite's Fabric Layer to bypass access controls and gain read/write access to critical SOA data, with potential impact spreading to integrated products through scope change. The issue affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). No public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated remote attackers can read sensitive data from Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer over HTTP, with scope change potentially exposing data in connected Oracle products. The flaw is easily exploitable (CVSS 3.1 8.6, AV:N/AC:L/PR:N/UI:N/S:C/C:H) and is limited to confidentiality impact; no public exploit was identified in the provided intelligence at time of analysis.
Unauthenticated remote takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Fabric Layer over T3 or IIOP, with a maximum CVSS 3.1 score of 10.0 and a scope change indicating impact beyond the SOA Suite host. Any attacker who can reach the T3/IIOP listener needs no credentials or user interaction, so exposure is primarily governed by network reachability. The provided intelligence shows no KEV listing and no public exploit identified at time of analysis, but the assessed risk remains top-priority because successful exploitation can fully compromise confidentiality, integrity, and availability.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised by an authenticated low-privileged attacker who reaches the Fabric Layer over HTTP; successful exploitation affects confidentiality, integrity, and availability and can lead to takeover of the SOA Suite deployment (CVSS 8.8). The flaw is easily exploitable once a valid low-privileged account exists, so exposure is bounded by credential possession rather than anonymity. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Unauthenticated remote takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Fabric Layer component exposed over HTTP. The CVSS 3.1 score is 9.8 with network access, no privileges, and no user interaction, yielding high confidentiality, integrity, and availability impact; Oracle's October 2026 Critical Patch Update advisory is the reference. No public exploit code or CISA KEV entry was identified at time of analysis, but this is a genuine high-priority exposure because default configurations are affected and the only practical barrier is network reachability to the SOA Suite HTTP interface.
Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 ship a flaw in the BPM Composer component that lets any low-privileged, network-reachable account over HTTP take full control of the BPM Suite instance, with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The gating factor is authentication: exploitation requires a valid low-privilege credential and no user interaction, so exposure is concentrated in deployments that broadly issue accounts or where credentials can be phished or reused. No public exploit code was identified at time of analysis, and the issue is fixed in Oracle's October 2026 Critical Patch Update; risk is elevated because the barrier to entry is a single ordinary user session rather than administrative access.
Unauthenticated network access to the Generic REST interface in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can expose critical data, with a CVSS 3.1 score of 8.6 and a scope change that may extend disclosed access to additional integrated products. The flaw is remotely exploitable over HTTP without credentials or user interaction, but impact is limited to confidentiality, with no integrity or availability effect. No public exploit code was identified at time of analysis; the main exposure driver is whether the connector's REST endpoint is reachable by an attacker.
High-privileged SOAP access to Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can be abused to read and modify critical connector data, with scope change extending impact to additional Oracle Fusion Middleware products. The flaw is easily exploitable once an attacker already holds high privileges in the product (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, 8.7) and requires network reachability to the Connectors and Connector Server component; no public exploit was identified at time of analysis.
Oracle Solaris 11.4's Image Packaging System (IPS) can be induced to act on attacker-influenced package content delivered over HTTP, giving a network-positioned, unauthenticated attacker high confidentiality impact and limited integrity impact (CVSS 3.1: 7.1 High, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N). The attacker must either control or compromise the repository the host queries, or intercept cleartext HTTP package traffic, and exploitation still requires a Solaris operator to perform a package operation against that content - the UI:R condition is the decisive exposure limiter. Only Solaris 11.4 is listed as affected per Oracle's October 2026 CPU and ENISA EUVD; no public exploit code was identified in the provided intelligence at time of analysis.
Authenticated low-privileged attackers can take over Oracle Service Bus 14.1.2.0.0 by reaching its HTTP interface, with high confidentiality, integrity, and availability impact (CVSS 8.8). Only the 14.1.2.0.0 Core component is listed as affected, and Oracle characterizes the flaw as easily exploitable; no public exploit identified at time of analysis and no CISA KEV entry was provided. The authentication requirement is the main barrier, so exposure is greatest where Service Bus HTTP endpoints are reachable by users who can obtain even minimal valid credentials.
Low-privileged authenticated attackers with network HTTP access can exploit the Oracle Service Bus Core component to achieve takeover of the service, with high confidentiality, integrity, and availability impact (CVSS 8.8). Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 are affected, and exploitation requires a valid account but no user interaction; no public exploit code was identified at time of analysis. The authentication prerequisite limits exposure compared with unauthenticated flaws, but default deployments reachable over HTTP remain at risk from any low-privilege user.
Information disclosure in Oracle Solaris 11.4's Image Packaging System (IPS) allows unauthenticated remote attackers with HTTP network access to read critical data or all data accessible to the system; CVSS 3.1 is 7.5 with confidentiality-only impact. Oracle's October 2026 CPU identifies the affected component and version, but no public exploit code or CISA KEV entry is present in the supplied intelligence, so there is no public exploit identified at time of analysis. Exposure is limited to deployments where the IPS/pkg HTTP interface is reachable by untrusted networks.
Stored content injection in Oracle Applications Framework's Personalization component (Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to place malicious content that executes when another user opens the personalized page, causing high confidentiality and integrity impact and possible scope change into other products. The attacker must hold valid credentials and convince a second user to interact with the page, so exploitation is neither self-contained nor unauthenticated. No public exploit code or CISA KEV entry was identified at time of analysis.
Takeover of the Pasta Printing Engine component within Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a low-privileged authenticated user who can reach the component over HTTP, with full impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.5). Oracle characterizes the flaw as difficult to exploit, and the AC:H metric indicates an additional precondition the attacker does not fully control - such as a specific timing window, race condition, or particular printing-component state - so reliable, single-shot exploitation is not implied; no public exploit code and no active exploitation (CISA KEV) were identified at time of analysis. This is a serious but not top-tier priority issue: exploitation is gated behind valid EBS credentials and applies only to 12.2.x deployments running the Pasta component, and no user interaction is required (UI:N).
Local low-privileged users with logon access to hosts running Oracle E-Business Suite Applications DBA 12.2.3 through 12.2.15 can abuse the AD Utilities component to read, create, delete, or modify critical application data. The assessed CVSS 3.1 score is 7.1 High with AV:L/PR:L/UI:N and high confidentiality and integrity impact, while availability is unaffected; exploitation requires an existing local account and no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.
Takeover of the Oracle E-Business Suite Applications DBA (AD Utilities) component is achievable by a low-privileged attacker who already holds a logon on the application-tier host running those utilities, in supported versions 12.2.3 through 12.2.15. The attacker cannot reach the flaw remotely or unauthenticated (AV:L/PR:L), and successful exploitation additionally depends on a different, higher-privileged person performing an action - typically a DBA or operator running an affected AD Utilities operation against attacker-influenced input (UI:R). Oracle rates the impact on confidentiality, integrity and availability as high (CVSS 3.1 base 7.3); no public exploit code or confirmed active exploitation was identified at time of analysis, and the practical risk is gated by shared access to the application tier and by privileged-operator behavior rather than being a drop-everything emergency.
Denial of service in Oracle Outside In Technology 8.5.8 allows unauthenticated, network-accessible attackers to hang or repeatedly crash the Outside In Core document parsing/conversion path, producing complete availability loss for applications that expose those functions over HTTP. The flaw is an embedded SDK issue, so real-world exposure is limited to products that pass untrusted files into Outside In for preview or conversion; confidentiality and integrity are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis.
Crafted-document processing in Oracle Outside In Technology 8.5.8 (Outside In Core) can be exploited by an unauthenticated network attacker to take over the affected application, with high confidentiality, integrity, and availability impact. The attacker delivers a malicious file over HTTP and succeeds only if a person or automated pipeline opens it (UI:R), so real-world exposure is bounded by whether the deploying product ingests untrusted documents through Outside In. No CISA KEV listing appears in the supplied intelligence and no public exploit was identified at time of analysis; the 8.8 score reflects potential impact rather than demonstrated exploitation.
Unauthenticated remote attackers can hang or repeatedly crash services that embed Oracle Outside In Technology 8.5.8 (Outside In Core) by delivering a crafted malformed document to its file-parsing engine, producing a CVSS 7.5 availability-only denial of service (AV:N/AC:L/PR:N/UI:N/A:H, no confidentiality or integrity impact). Because Outside In is a parsing SDK rather than a network service, real exposure is limited to applications that expose its document-conversion/filtering functionality to attacker-supplied files over HTTP; deployments that only process trusted internal documents are not practically reachable. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied in the feed data, so the practical risk is bounded to availability disruption of document-processing pipelines.
Unauthenticated remote attackers can read critical data and cause a partial denial of service in Oracle Outside In Technology 8.5.8 by supplying crafted files to applications that embed the Outside In Core parser. The CVSS 3.1 score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L), reflecting high confidentiality impact, low availability impact, and no integrity impact. No public exploit was identified at time of analysis, and exploitation depends on a host application exposing file-processing paths to untrusted input.
Unauthenticated attackers able to reach an Oracle Service Bus HTTP listener can hang or repeatedly crash the Core component in versions 12.2.1.4.0 and 14.1.2.0.0, producing a complete denial of service (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Triggering it demands no credentials, no user interaction and little complexity, so the real gating factor is network exposure - internet-facing or partner-reachable Service Bus instances are the ones at risk, while segmented internal deployments are materially harder to hit. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; Oracle ships fixes through its October 2026 Critical Patch Update.
Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 expose a high-severity flaw in the Core component that lets a low-privileged, network-positioned attacker take over the service bus, with full impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). Exploitation is straightforward once credentials exist - no user interaction, low attack complexity, HTTP-reachable - but it is not unauthenticated: the attacker must already hold a valid low-privilege account on the target (PR:L). At time of analysis there is no CISA KEV listing and no public exploit code identified, so this is a credible high-priority patch target rather than an emergency, and the practical risk is dominated by how freely low-privilege accounts can be obtained and how exposed the HTTP interface is.
Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 can be compromised by a low-privileged attacker with network access via HTTP, potentially resulting in takeover of the Payroll component with high confidentiality, integrity, and availability impact. The flaw resides in the Internal Operations component and has high attack complexity, so exploitation requires a valid low-privileged account plus conditions outside the attacker's control; no public exploit was identified at time of analysis. With a CVSS 3.1 score of 7.5, the risk is High but constrained by the authentication and complexity prerequisites.
Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 allows an authenticated low-privileged attacker with network access to its HTTP interface to take over the service, with high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires valid low-privileged credentials and reachability to a Service Bus HTTP endpoint, but no user interaction and low attack complexity; default supported configurations appear affected. No public exploit identified at time of analysis.
Oracle General Ledger 12.2.3 through 12.2.15 allows an authenticated low-privileged attacker with HTTP network access to create, delete, or modify critical ledger data, read a subset of data, and cause a hang or repeated crash. Exploitation is constrained by high attack complexity and the need for a valid E-Business Suite account, so it is not reliably repeatable against default deployments. No public exploit code or confirmed active exploitation was identified at time of analysis.
Order Capture in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a high-privileged attacker who already holds a valid EBS account and can reach the Internal Operations component over HTTP, yielding full confidentiality, integrity, and availability impact (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is straightforward once the privileged account exists - no user interaction is required and attack complexity is low - but the PR:H prerequisite means anonymous external attackers cannot reach the flaw, making this a conditional rather than top-tier risk. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so the practical exposure depends on how widely privileged EBS accounts are distributed in the environment.
Takeover of the Applications Platform Engineering component in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for an attacker who already holds a low-privileged local logon on the EBS host. The flaw sits in the 'Valid Session' component, is low-complexity with no user interaction, and yields high confidentiality, integrity, and availability impact (CVSS 7.8). Exploitation is gated by the AV:L/PR:L prerequisites, and no public exploit code was identified at time of analysis.
Takeover of Oracle GoldenGate is possible through its Admin Server Executable, where a low-privileged authenticated attacker with HTTPS network access can achieve high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments are GoldenGate 19.1.0.0.0 through 19.32.0.0, 21.3 through 21.23, and 23.4 through 23.26.3.0.0, while instances patched to the October 2026 CPU fix level are not exposed. No public exploit code has been identified at time of analysis, but low attack complexity and network reachability make timely patching important.
Authenticated low-privileged attackers who can reach the OSSL module of Oracle HTTP Server over HTTP can read and modify critical data, with a scope change that lets the impact extend into other Fusion Middleware products reachable through or proxied by the server. The flaw carries a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N; no availability impact) and affects only Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0. No public exploit code or CISA KEV entry was identified at time of analysis, but the low attack complexity and the front-end position of OHS make this a high-priority patch target.
Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 can be compromised by unauthenticated, remote attackers through the WebLogic Server Proxy Plug-in component, yielding high confidentiality and integrity impact and - because the CVSS vector carries a scope change (S:C) - potential knock-on impact to systems the plug-in fronts. Oracle rates the attack complexity as high ('difficult to exploit'), so the bug is not reliably repeatable against arbitrary targets and depends on conditions outside the attacker's control, but no authentication (PR:N) or user interaction (UI:N) is required once those conditions are met. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the source data.
Unauthenticated remote attackers can compromise Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 through the Authentication Engine, obtaining high-impact confidentiality and integrity access and potentially affecting other products because the CVSS scope is changed. The CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), with no availability impact; no public exploit identified at time of analysis. Exposure depends on reachability of the OAM authentication endpoint, and default deployments appear exploitable because the description calls out no special configuration prerequisite.
Takeover of Oracle VM VirtualBox 7.2.20 is possible by a high-privileged attacker with access to the physical communication segment attached to the hardware running VirtualBox, per Oracle's October 2026 CPU. The Core component flaw has a CVSS 3.1 score of 8.4 (AV:A/AC:L/PR:H/UI:N/S:C) and can cross a scope boundary to affect additional products. No public exploit or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied.
Takeover of Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) is possible for an attacker who already holds a low-privileged authenticated logon on the host running the product, affecting versions 9.2.0.0 through 9.2.26.5. The flaw is local rather than network-reachable (AV:L), needs no user interaction, and has low attack complexity, so once the prerequisite account access exists the attacker can reliably gain high confidentiality, integrity, and availability impact, yielding a CVSS 3.1 base score of 7.8. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical gating factor is possession of local credentials on the EnterpriseOne server tier.
Unauthenticated remote attackers with HTTP access to the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools (releases 9.2.0.0 through 9.2.26.5) can tamper with application data, based on the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5). The flaw is scored for high integrity impact only - attackers cannot read confidential data or disrupt availability - but no privileges or user interaction are required, making the integrity of EnterpriseOne business records the sole but significant exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and the primary practical limit on exposure is whether the EnterpriseOne Tools HTTP interface is reachable from untrusted networks.
Unauthenticated network attackers who can reach the Interoperability SEC component of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 over TLS can read and modify critical business data, although Oracle rates the attack as difficult (AC:H) because an unspecified precondition must be satisfied. No public exploit code or confirmed active exploitation has been identified at time of analysis. Oracle's October 2026 Critical Patch Update advisory is the reference for remediation.
Takeover of JD Edwards EnterpriseOne Tools is possible for low-privileged attackers who can reach the JDENET service on affected versions 9.2.0.0 through 9.2.26.5. The flaw is in the Interoperability SEC component and has a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring a valid low-level account or an existing authenticated foothold rather than anonymous access. No public exploit identified at time of analysis; Oracle's October 2026 Critical Patch Update advisory is the reference source.
A high-complexity privilege-escalation flaw in Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component, versions 9.2.0.0 through 9.2.26.5) lets a low-privileged, already-authenticated attacker reach the JDENET service over the network and take over the EnterpriseOne Tools environment, with full confidentiality, integrity, and availability impact (CVSS 7.5). Exploitation is explicitly difficult (AC:H) because success depends on timing, configuration, or environmental conditions outside the attacker's control, and it requires pre-existing low-privilege credentials plus network reachability to JDENET. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV signal was supplied; Oracle addresses it in its October 2026 Critical Patch Update.
Low-privileged users who can reach the JDENET service on Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can escalate to full takeover of the EnterpriseOne Tools instance, affecting confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the Database and Comm SEC component, requires only network reachability plus a valid low-privilege account, and needs no user interaction or elevated rights, making attack complexity low. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible high-priority issue but not a drop-everything emergency; the practical constraint on attackers is possession of credentials and exposure of JDENET.
Authenticated low-privileged users of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can abuse the Package Build SEC component over HTTP to create, delete, or modify critical application data and to hang or repeatedly crash the Tools service, yielding a combined integrity and availability impact rated CVSS 8.1. Exploitation requires only a valid low-tier account (PR:L), with low attack complexity, no user interaction, and no elevated privileges, so the practical barrier is account provisioning plus reachability of the EnterpriseOne Tools web layer rather than any exploit precondition. At the time of analysis no public exploit code or confirmed active exploitation was identified, and no CISA KEV listing exists for this CVE.
A local privilege-escalation weakness in the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools (9.2.0.0 through 9.2.26.5) lets an attacker who already holds a valid low-privileged logon on the host where the Tools run read and modify critical application data, delivering a high confidentiality and integrity impact with no availability effect (CVSS 3.1 base 7.1). Because exploitation is local (AV:L) and requires authenticated low-privileged access (PR:L), it is primarily a post-compromise or insider-abuse risk rather than an internet-facing one; no public exploit code and no confirmed active exploitation were identified at time of analysis. The vendor notes the issue is easily exploitable once such access exists, so any shared or multi-tenant host running an unpatched Tools version should be treated as exposed to its own low-privileged users.
Authenticated low-privileged users with HTTP access to the Interoperability SEC component of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can read critical application data beyond their intended authorization scope and trigger a partial denial of service, as addressed in Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) reflects high confidentiality impact and low availability impact, gated only by the need for a valid low-privilege account and reachable integration endpoints. No public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis, and the tag 'Authentication Bypass' indicates the weakness is an authorization/access-control gap rather than a pre-auth entry point.
Oracle JD Edwards EnterpriseOne Tools (Interoperability SEC) versions 9.2.0.0 through 9.2.26.5 allows a low-privileged authenticated attacker with network access to JDENET to create, delete, or modify critical data and read all data accessible to the application. The CVSS 3.1 score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N); no public exploit code or CISA KEV confirmation was identified at time of analysis. Despite an 'Authentication Bypass' tag, the assessed vector requires valid low-privileged credentials, making this a credible high-priority patch target but not a confirmed emergency.
Unauthenticated network attackers can achieve full takeover of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) by reaching the SMTP mail-handling path of the Enterprise Infrastructure SEC component, as disclosed in Oracle's October 2026 Critical Patch Update. Oracle rates the flaw 8.1 with high confidentiality, integrity, and availability impact, but attack complexity is high (AC:H), meaning success depends on message-processing state or timing the attacker does not fully control, so reliable exploitation is non-trivial. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a serious-but-not-emergency patching priority rather than an active incident.
High-severity confidentiality exposure in Oracle Outside In Technology 8.5.8, a document-parsing library embedded in third-party applications, lets unauthenticated remote attackers read critical data through HTTP requests. The CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting low attack complexity, no user interaction, scope change, and high confidentiality impact with no integrity or availability effect. Exploitation realistically requires that the library's Outside In Core parsing path be reachable and fed attacker-supplied documents by the embedding product; no public exploit code or CISA KEV entry is identified at time of analysis.
Unauthenticated network attackers can read, create, delete, or modify critical data in Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 through the Core component's HTTP interface. The 9.1 CVSS score reflects high confidentiality and integrity impact with no availability impact, low complexity, and no user interaction. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided; exposure is primarily determined by whether WebLogic HTTP/T3 listeners are reachable from untrusted networks.
Oracle VM VirtualBox 7.2.16 carries a flaw in its Core component that lets a low-privileged user with local logon to the host read critical data accessible to VirtualBox and reliably hang or repeatedly crash the hypervisor, with a scope change (S:C) that points to a guest-to-host boundary escape rather than a mere guest-local bug. The vector (AV:L/AC:L/PR:L/UI:N) means exploitation is local and requires only a low-privileged account, no user interaction, and low attack complexity, so risk concentrates in multi-tenant hosts, VDI estates and developer machines where semi-trusted users can log on or drive a guest VM. No public exploit code has been identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV entry), no EPSS score was supplied, and the exact fixed build is not specified in the provided data - the Oracle Critical Patch Update (October 2026) advisory is the authoritative patch source.
Unauthenticated attackers with HTTP network access to a third-party web server (Apache HTTP Server, Microsoft IIS, or Oracle iPlanet) running the Oracle WebLogic Server Proxy Plug-in can bypass authentication and obtain read/write access to critical data reachable through the proxied WebLogic backend. The flaw affects plug-in versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 and carries a CVSS 3.1 score of 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). Oracle rates exploitation as difficult (AC:H), and no public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis; EPSS was not supplied.
Unauthenticated remote attackers can disclose critical data from Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 by reaching the Authentication Engine over HTTP; the issue is rated CVSS 7.5 with high confidentiality impact and no integrity or availability effect. Exploitation requires only network reachability to the OAM authentication endpoint, making internet-exposed or broadly reachable deployments the priority. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied.
Authenticated low-privileged attackers with HTTP access to the Oracle BI EE Analytics Server can take over affected 8.2.0.0.0 and 26.01.0.0.0 installations, with high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires a valid low-privilege account (PR:L) but no user interaction and low complexity; no public exploit was identified at time of analysis.
Unauthenticated remote takeover of Oracle Access Manager is possible through its SAML-facing Authentication Engine, affecting builds 12.2.1.4.0 and 14.1.2.1.0 of the Oracle Fusion Middleware component. With a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), Oracle characterizes the flaw as easily exploitable by an attacker who can reach the SAML authentication interface over the network, with full confidentiality, integrity, and availability impact and potential full compromise of the OAM service. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation has not been confirmed in the wild, but the combination of unauthenticated network access, low attack complexity, and complete impact makes this a top-tier patching priority for any internet- or partner-facing OAM deployment.
Unauthenticated attackers with HTTP network access can abuse Oracle Access Manager's Authentication Engine (versions 12.2.1.4.0 and 14.1.2.1.0) to achieve full confidentiality and integrity compromise of OAM-accessible data, with scope change extending impact to federated downstream products. Oracle rates the issue 'difficult to exploit' (AC:H), meaning success hinges on non-trivial environmental or flow-specific conditions rather than a simple request, so this is a serious but conditional risk rather than a point-and-click exploit. No public exploit code or confirmed active exploitation was identified at time of analysis, and no CVE-level patch version is stated beyond Oracle's October 2026 Critical Patch Update advisory. EPSS: not provided.
Unauthenticated network attackers can potentially take over Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 through crafted SAML authentication exchanges, yielding high confidentiality, integrity, and availability impact. The flaw is rated CVSS 3.1 8.1 with AC:H, indicating exploitation is difficult and depends on specialized conditions in the SAML flow; no public exploit or CISA KEV status is identified in the provided data, and SAML must be configured and reachable for exposure.
Unauthenticated network attackers can compromise the Authentication Engine component of Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 over HTTP, gaining high-confidentiality read access to data managed by the identity server plus limited ability to modify it and to degrade availability (CVSS 3.1 base 8.6, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, no credentials, session, or victim interaction are needed - only network reachability to a vulnerable OAM deployment. No public exploit code or confirmed active exploitation was identified at time of analysis, so risk is driven by exposure: internet-facing or broadly reachable OAM instances should be treated as high priority and patched via Oracle's October 2026 Critical Patch Update, while internal-only deployments behind filtering proxies have materially lower reachability.
Unauthenticated network attackers can obtain unauthorized read access to critical data accessible through Oracle MySQL Connector/Python 26.7.0, the only affected release. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), the flaw is remotely reachable at low complexity without privileges or user interaction, but impact is bounded to data disclosure and to deployments where the connector is network-exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; Oracle's October 2026 Critical Patch Update is the reference advisory.
Low-privileged authenticated users can achieve full takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 through the OIM Legacy UI component, which is reachable over HTTP and requires no victim interaction. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects complete loss of confidentiality, integrity and availability, but exploitation is gated on an attacker already holding a valid low-privilege OIM account plus network reachability to the deployed Legacy UI - unauthenticated external exploitation is not indicated by the assessed vector. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so the practical risk is highest for environments where the Legacy UI is exposed to broad network segments or where low-privilege accounts are weakly governed.
Authenticated takeover of Oracle Identity Manager is achievable through the OIM Legacy UI component: a holder of any low-privileged account who can reach the instance over HTTPS can escalate to full control of confidentiality, integrity, and availability (CVSS 8.8). Only versions 12.2.1.4.0 and 14.1.2.1.0 of the Fusion Middleware product are listed as affected, and no user interaction or special attack conditions are required beyond that minimal foothold. Oracle resolves the issue with the October 2026 Critical Patch Update; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, but the low complexity and high payoff make unpatched, lower-trust-accessible deployments a priority.
Complete compromise of Oracle WebLogic Server is possible for unauthenticated, network-positioned attackers targeting the T3 or IIOP listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), meaning no credentials or user interaction are required and confidentiality, integrity, and availability are all fully impacted. No CISA KEV entry or public exploit code is identified in the provided intelligence at time of analysis, but the lack of exploit reporting does not reduce the priority for internet-exposed T3/IIOP endpoints.
Unauthenticated HTTP access to the Data Transforms component in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 can be abused to read critical ODI data and perform limited unauthorized data changes. The flaw is rated CVSS 8.2 with high confidentiality and low integrity impact and requires no credentials or user interaction, making reachable ODI endpoints a high-priority exposure. No public exploit code was identified at time of analysis.
Unauthenticated remote takeover of Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 is possible through the ODI Console / Repository Explorer over HTTP, as addressed in Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score is 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no authentication, no user interaction, and high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV confirmation was identified in the supplied intelligence at time of analysis, but internet-exposed ODI Console instances are high priority because the assessed limiting factor is network reachability rather than any special configuration.
Unauthenticated remote takeover of Oracle Data Integrator is possible through the Console / Repository Explorer RMI interface on versions 12.2.1.4.0 and 14.1.2.0.0, with CVSS 3.1 score 9.8 reflecting high confidentiality, integrity, and availability impact. Attackers with network reachability to the RMI listener need no credentials or user interaction; the primary exposure constraint is whether that listener is reachable across network boundaries. Exploitation status: no public exploit identified at time of analysis.
Authenticated low-privileged attackers with HTTP access to Oracle Product Hub 12.2.3 through 12.2.15 can achieve takeover of the component, with scope change (S:C) extending impact to additional connected Oracle E-Business Suite products. The CVSS 3.1 base score is 8.5, but exploitation is rated difficult (AC:H) and requires a valid low-privileged account (PR:L) with no user interaction (UI:N). No public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Unauthenticated network attackers can potentially bypass authentication and read or modify critical data through the Oracle WebLogic Server Proxy Plug-in in supported 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 deployments, although Oracle rates exploitation as difficult (AC:H) and the impact may extend to systems behind the proxy because of scope change. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided, so internet-facing proxy plug-in installations should still be prioritized for review and patching.
Successful exploitation of Oracle Sourcing 12.2.3 through 12.2.15 can allow a low-privileged authenticated attacker with HTTP network access to take over the Auctions component, causing high confidentiality, integrity, and availability impact. Oracle rates the issue difficult to exploit because attack complexity is high, meaning additional conditions outside the attacker's direct control must be satisfied beyond sending crafted requests. No public exploit code or CISA KEV entry was identified at time of analysis, so the practical risk is constrained by the valid-account prerequisite and the high-complexity barrier.
Unauthenticated attackers with network access to Oracle E-Business Suite's Shipping Execution module can bypass authentication in the Workflow Events component to read and modify critical shipping data. The flaw affects E-Business Suite 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact; the high attack complexity (AC:H) reflects difficult-to-satisfy exploitation preconditions rather than a lack of severity. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated data tampering and disclosure in the Workflow Events component of Oracle Shipping Execution (Oracle E-Business Suite 12.2.3 through 12.2.15) can be triggered by a network attacker over HTTP, yielding full confidentiality and integrity impact on the module's accessible data with a CVSS 3.1 base score of 7.4. Oracle explicitly characterizes the flaw as difficult to exploit (AC:H), so a successful attack depends on conditions outside the attacker's control rather than a single crafted request, and there is no availability impact - the realistic risk is data disclosure and modification, not service disruption. No public exploit code or confirmed active exploitation was identified at time of analysis, and given the high attack complexity this is best treated as a genuine but second-tier priority addressed through the October 2026 Critical Patch Update.
An authenticated low-privileged user who can reach the Oracle Contract Lifecycle Management for Public Sector HTTP endpoints in Oracle E-Business Suite can achieve full takeover of the CLM module's data and functionality - a complete loss of confidentiality, integrity and availability scored at CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only instances running the Award/PO component of CLM for Public Sector on releases 12.2.3 through 12.2.15 are exposed, and the attack requires a valid account (PR:L) with no user interaction and low complexity once that prerequisite is met. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle typically withholds technical detail until customers have patched, so the absence of exploit reporting should not be read as low risk for internet-facing or broadly accessible EBS deployments.
Oracle E-Business Suite 12.2.3 through 12.2.15 ships a Contract Lifecycle Management for Public Sector module whose Award/PO component fails to properly constrain what a logged-in low-privileged user can do, so any account holder with HTTP reach to the application can read and alter contract and purchase-order data they should not touch. The result is a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact and no availability impact; the vector (AV:N/AC:L/PR:L/UI:N/S:U) means exploitation requires prior authentication but no admin rights, no user interaction and no special configuration. Risk is concentrated in EBS deployments with large or loosely governed user populations, or where credentials can be phished or reused; no public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle has published a fix in its October 2026 Critical Patch Update.
Local privilege escalation in Oracle Solaris 11.4 lets an attacker who already holds a low-privileged logon escalate to full control of the host through the Services component, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.8). Exploitation is local only (AV:L) and requires a valid low-privileged account (PR:L), but no user interaction (UI:N) and low complexity (AC:L) mean escalation is reliable once a foothold exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and hosts where untrusted users have no shell access are not exposed.
Full system takeover of Oracle Solaris 11.3 and 11.4 is possible for unauthenticated network attackers who can reach the Image Packaging System (IPS) HTTP service, with high confidentiality, integrity, and availability impact. The 9.8 CVSS score reflects network reachability with low attack complexity, no privileges, and no user interaction, but practical exposure depends on whether the IPS endpoint is accessible from an attacker-reachable network path. No public exploit code or CISA KEV entry was identified at time of analysis.
Oracle Solaris 11.3 and 11.4 can be fully compromised - confidentiality, integrity, and availability - by an authenticated low-privileged attacker who can reach the HTTP-exposed Utility component, per Oracle's October 2026 Critical Patch Update. The CVSS 3.1 base score of 8.8 reflects network reachability (AV:N), low attack complexity (AC:L), and no user interaction (UI:N), gated only by the PR:L requirement for an existing low-privilege account on the host; successful exploitation is described by Oracle as leading to takeover of the operating system. No public exploit code has been identified and there is no CISA KEV listing at time of analysis, but the modest preconditions mean exposed Solaris estates should treat this as a high-priority patching item.
Takeover of Oracle Product Hub is possible for a low-privileged authenticated attacker with HTTP access to the Internal Operations component in Oracle E-Business Suite 12.2.3 through 12.2.15. The flaw carries CVSS 3.1 score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning any valid low-tier session can reach the vulnerable component without user interaction and potentially gain full control of confidentiality, integrity, and availability. No public exploit code or CISA KEV entry was identified at time of analysis, but the low attack complexity and authenticated network vector make it a credible priority for exposed EBS deployments.
Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by an authenticated low-privileged attacker with HTTP network access, enabling high impact to confidentiality, integrity, and availability of the component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) shows low attack complexity and no user interaction once a valid low-privileged account is obtained, making this a genuine high-priority issue. No public exploit identified at time of analysis and no CISA KEV entry or EPSS score was provided in the supplied intelligence, but Oracle has published an October 2026 CPU advisory for remediation.
Any authenticated low-privilege user who can reach the HTTP interface of Oracle Product Hub (the Internal Operations component of Oracle E-Business Suite) can take full control of the module, with high impact on confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U). Deployments of E-Business Suite 12.2.3 through 12.2.15 running Product Hub are in scope, and because attack complexity is low and no user interaction is required, a single valid low-privilege session is sufficient to attempt exploitation - the real barrier is first obtaining EBS credentials and network reachability to the endpoint. No public exploit code and no CISA KEV entry were identified at time of analysis, so this is a credible mid-to-high priority patching item rather than an emergency, but the low bar for a credentialed insider or compromised account keeps it worth scheduling promptly.
Oracle E-Business Suite releases 12.2.3 through 12.2.15 expose Installed Base records to any low-privileged application user who can reach the Data Provider UI component over HTTP, allowing broad reads of critical data plus limited unauthorized inserts, updates, and deletes (CVSS 3.1 base score 7.1, C:H/I:L/A:N). Exploitation requires only a valid EBS account (PR:L) and network reach to the module - no user interaction and no special conditions - so the practical exposure is highest where self-registered, partner, or contractor accounts exist or where the Installed Base UI is internet-facing. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Oracle CPU patches should be scheduled on a normal priority rather than deferred indefinitely, since the weakness is trivially triggerable once credentials are held.
Unauthorized access to and modification of Installed Base data in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a low-privileged authenticated attacker who convinces another user to interact with a crafted request over HTTP. The CVSS 3.1 score is 7.6 with scope change (S:C), high confidentiality impact, and low integrity impact, meaning connected Oracle products beyond Installed Base may also be affected. No public exploit was identified at time of analysis, and the assessed risk is to prioritize patching rather than treat as an emergency.
Takeover of Oracle E-Business Suite's Bills of Material module (versions 12.2.3 through 12.2.15) is possible for a low-privileged attacker who can reach the 'Internal Operations' component over HTTP, but the high attack complexity makes this a genuine second-tier priority rather than an emergency. Exploitation requires a valid EBS account and conditions beyond the attacker's control, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Strategic Network Optimization in Oracle E-Business Suite versions 12.2.3 through 12.2.15 can be taken over through a network-based attack that requires no credentials but does require a victim to interact with attacker-controlled content. The CVSS 3.1 score is 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting high confidentiality, integrity, and availability impact; no public exploit was identified at time of analysis. The limiting prerequisite is user interaction, not authentication, so exposure of the SNO HTTP interface together with successful social engineering is the practical attack path.
Authenticated attackers can achieve broad data tampering and disclosure against Oracle E-Business Suite's Global Order Promising Web Service in versions 12.2.3 through 12.2.15, with CVSS 3.1 scoring 8.2 (C:H/I:H, no availability impact). Exploitation requires a valid low-privilege EBS account (PR:L) plus network HTTP reachability to the affected component and satisfaction of high-complexity, server-side conditions the attacker cannot directly control (AC:H); no user interaction is needed (UI:N), and successful attacks cross a scope boundary (S:C), meaning other products can be significantly impacted. No public exploit code or confirmed in-the-wild activity was identified at time of analysis - no public exploit identified at time of analysis - so risk is real but bounded by the authentication prerequisite and the High attack complexity.
Takeover of Oracle Contract Lifecycle Management for Public Sector (the Award/PO component of Oracle E-Business Suite) is achievable by an attacker who already holds a high-privileged application account, with full loss of confidentiality, integrity and availability (CVSS 3.1 base 7.2). Only versions 12.2.3 through 12.2.15 are affected, and the attack is carried out over the network via HTTP with low complexity and no user interaction, so the practical barrier is the prerequisite of an existing highly privileged session rather than any technical obstacle. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so risk is concentrated on privileged insiders, compromised administrator credentials, and environments where the CLM application is exposed to attackers who have already escalated.
Authenticated denial-of-service with limited data disclosure and modification in Oracle Shipping Execution affects Oracle E-Business Suite deployments running 12.2.3 through 12.2.15. A low-privileged attacker holding a valid EBS account can reach the Workflow Events component over HTTP and, only when specific non-default conditions line up (AC:H), hang or repeatedly crash the Shipping Execution module while reading and modifying a subset of its data; the scope-change flag means integrated EBS products can also be impacted. CVSS 3.1 scores this 7.7 with availability as the dominant impact, and while the flaw is difficult to exploit, no public exploit code or confirmed active exploitation (no CISA KEV listing) has been identified at time of analysis.
Unauthenticated, network-reachable attackers can access critical or all Oracle Shipping Execution data in Oracle E-Business Suite versions 12.2.3 through 12.2.15 by targeting the Workflow Events component over HTTP. The flaw is rated 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with high confidentiality impact and no integrity or availability impact; no public exploit code or CISA KEV entry was identified at time of analysis. Exposure is limited mainly by whether the EBS web tier is reachable from untrusted networks.
Unauthenticated network attackers can potentially take over Oracle Shipping Execution in Oracle E-Business Suite 12.2.3 through 12.2.15 by abusing a high-complexity flaw in the Workflow Events component, rated CVSS 8.1 with full confidentiality, integrity, and availability impact. Oracle characterizes the issue as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control such as precise timing, server state, or a specific configuration rather than reliable reproduction against any default install, and no public exploit code or active exploitation has been identified at time of analysis. Practical risk is further bounded by exposure: the EBS HTTP interface and the Shipping Execution module must be network-reachable to the attacker, which in many deployments means internal-only rather than internet-facing access.
Oracle Shipping Execution, a module of Oracle E-Business Suite, exposes an Internal Operations component that permits a low-privileged authenticated user with HTTP access to read, modify, and partially disrupt shipping data across supported releases 12.2.3 through 12.2.15. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:L/A:L, 7.6) reflects a high confidentiality impact with limited integrity and availability effects, and no public exploit code or confirmed active exploitation was identified at time of analysis. The main barrier to abuse is the requirement for a valid low-privilege EBS session (PR:L), so exposure is greatest where the EBS web tier is broadly reachable or where low-privilege accounts are easy to obtain.
Oracle Quality in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated low-privileged remote attacker to read and modify critical data through the Internal Operations component over HTTP. The flaw is low complexity and requires no user interaction, but valid EBS credentials are required, which limits anonymous exploitation; confidentiality and integrity are fully impacted while availability is not. No public exploit code or CISA KEV entry was identified at time of analysis.
Oracle Project Contracts versions 12.2.3 through 12.2.15 expose critical data to any user holding a valid low-privileged E-Business Suite account, because the Internal Operations component fails to adequately restrict what that account can read over HTTP. Successful exploitation gives high-confidentiality read access to Project Contracts data and, due to a scope change in the assessed vector, can extend to data in other Oracle products reachable from the same suite; integrity and availability are unaffected. Exploitation requires authentication (CVSS PR:L) and no user interaction, making it low-complexity for an insider or anyone who has obtained a mundane EBS credential - no public exploit code and no confirmed active exploitation were identified at time of analysis, and Oracle addresses the flaw through its October 2026 Critical Patch Update.
Unauthenticated network attackers can read and modify critical data in Oracle E-Business Suite's Mobile Application Server (MWA Terminal Server) versions 12.2.3 through 12.2.15, with a CVSS 3.1 score of 7.4. Oracle rates the issue difficult to exploit because of high attack complexity, and no public exploit code or CISA KEV active-exploitation signal was identified at time of analysis. Exposure is greatest where the MWA Terminal Server is reachable beyond trusted internal or warehouse-handheld networks.
Oracle HCM Common Architecture, the shared framework layer within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations component reachable over HTTP that a low-privileged authenticated user can abuse to read and modify critical HCM data and to partially degrade service availability. The defect is rated CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), with the High attack complexity reflecting a precondition or environmental state the attacker does not control, which keeps reliable exploitation difficult even though no victim interaction is needed. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Oracle published the fix in its October 2026 Critical Patch Update, so priority is real but second-tier relative to unauthenticated, low-complexity flaws.
Takeover of the Oracle HCM Common Architecture component is possible in Oracle E-Business Suite releases 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access to the Internal Operations functionality can achieve full compromise of the component with high confidentiality, integrity and availability impact. Exploitation is constrained: the attacker must already hold valid low-privilege EBS credentials (PR:L) and the attack carries high complexity (AC:H), meaning success depends on conditions outside the attacker's direct control such as timing, configuration or application state, and no end-user interaction is required (UI:N). No public exploit code was identified and the issue is not confirmed actively exploited (not in CISA KEV) at time of analysis; EPSS was not provided, so risk is concentrated on internet-exposed EBS deployments where low-privilege or self-service accounts are widely provisioned.
Oracle E-Business Suite's HCM Common Architecture component (Internal Operations) in versions 12.2.3 through 12.2.15 can be compromised by a low-privileged attacker with network HTTP access, allowing full takeover of the component with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.5). Exploitation is gated by high attack complexity - Oracle describes it as 'difficult to exploit' - meaning conditions outside the attacker's direct control (such as a specific application state, configuration, or timing condition) must align, and the attacker must already hold a valid low-privileged EBS account (PR:L, not unauthenticated). There is no public exploit code and no confirmed active exploitation (not in CISA KEV) at time of analysis, but internet-exposed EBS portals enlarge the pool of potential low-privileged attackers who could attempt it.
Unauthorized read and write access to critical data in Oracle E-Business Suite's Document Management and Collaboration (Attachments) component affects versions 12.2.3 through 12.2.15 and, because of a scope change, can extend to data and resources in other EBS products. A low-privileged authenticated attacker with HTTP access can trigger the flaw, but exploitation requires a different user-typically someone with higher privileges-to interact with attacker-supplied attachment content, so this behaves like a stored/second-order access-control or injection issue (CVSS 8.7; C:H/I:H/A:N) rather than a pre-auth remote compromise. No public exploit code or CISA KEV entry was identified in the available intelligence, and no EPSS score was supplied.