Oracle
Monthly
Cross-site scripting (or equivalent client-side injection) in the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows unauthenticated remote attackers to perform unauthorized read and write operations against Commerce data by luring an authenticated user into interacting with a malicious HTTP request. The scope change (S:C) in the CVSS vector confirms that a successful attack can extend impact beyond the targeted component to additional Oracle products or browser contexts. No public exploit identified at time of analysis, and no CISA KEV listing; Oracle disclosed and patched this issue in the August 2026 Critical Patch Update.
Cross-site scripting in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 enables unauthenticated remote attackers to compromise victim sessions via HTTP. The attack requires human interaction - a victim must trigger the malicious request - and exploits the Internal operations component in a way that causes a scope change, meaning successful exploitation can affect resources beyond the vulnerable component itself (consistent with browser-context hijacking). Impact is limited to partial confidentiality and integrity loss: unauthorized read access to a subset of accessible data and unauthorized write/insert/delete on some accessible data; no availability impact is present. No public exploit or CISA KEV listing has been identified at time of analysis.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes critical data and partial denial-of-service risk via the Endeca Application Controller component over HTTP. An unauthenticated network attacker exploiting this vulnerability - tagged as an authentication bypass - can gain complete read access to all data accessible within the Oracle Commerce platform and degrade service availability. No public exploit code has been identified at time of analysis, and the high attack complexity (AC:H) reduces the realistic threat surface, though a successful attacker requires no credentials or user interaction once the exploit conditions are met.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local security-component flaw that grants a high-privileged infrastructure user unauthorized read and write access to all application data, including critical financial records. Despite requiring existing high privileges, the 'Authentication Bypass' tag signals that the Security component likely fails to enforce intra-application authorization boundaries, enabling privilege escalation within the product beyond the attacker's sanctioned scope. No public exploit code has been identified, and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cross-site scripting (XSS) class vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows unauthenticated remote attackers to compromise confidentiality and integrity of data by delivering a crafted HTTP payload that requires victim interaction. The scope change indicator in the CVSS vector (S:C) confirms that successful exploitation impacts resources beyond the directly vulnerable component - consistent with browser-context script execution affecting adjacent systems or sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this accessible to unsophisticated attackers once a suitable delivery mechanism is established.
Confidential data exposure in Oracle Commerce Guided Search / Experience Manager 11.4.0 enables high-privileged network attackers to read critical platform data over HTTP, with a confirmed scope change extending potential impact to adjacent Oracle Commerce components beyond the primary application. The attack requires no user interaction and is characterized as easily exploitable at low complexity, though the high privilege prerequisite narrows the attacker pool. Oracle has addressed this vulnerability in the Critical Security Patch Update for August 2026; no public exploit code has been identified at time of analysis.
Unauthorized critical data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a high-privileged, network-based attacker to read all data accessible to the Experience Manager component, with scope change extending impact to additional Oracle Commerce products. The vulnerability is exploitable over HTTP with no user interaction required. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the 'Authentication Bypass' tag warrants attention - it may indicate a privilege escalation pathway that reduces the effective authentication bar. EPSS data was not provided.
Cross-site scripting (XSS) in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows a remote unauthenticated attacker to inject malicious content into a victim's browser session via a crafted HTTP request, requiring the victim to interact with a manipulated link or page. The scope change in the CVSS vector (S:C) indicates the attack can affect browser context outside the vulnerable component, enabling session token theft or unauthorized data modification within the application. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting or client-side injection in Oracle Commerce Experience Manager 11.4.0 enables unauthenticated remote attackers to compromise confidentiality and integrity of affected deployments through HTTP-delivered attacks requiring victim interaction. The scope change indicator in the CVSS vector confirms that successful exploitation can impact resources beyond the directly vulnerable component, consistent with session theft or content injection affecting downstream users. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle's August 2026 Critical Patch Update addresses this in a quarterly advisory cycle.
Cross-site scripting conditions in Oracle Commerce Guided Search / Experience Manager 11.4.0 allow an unauthenticated remote attacker to compromise victim sessions through a crafted HTTP request that requires human interaction to trigger. The vulnerability carries a scope change, extending impact beyond the directly vulnerable component to data accessible within the victim's authenticated browser context, enabling unauthorized read and limited data modification. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified at the time of analysis.
Unauthorized data disclosure in Oracle Commerce Experience Manager 11.4.0 allows low-privileged authenticated attackers to access critical or complete application data via HTTP. The vulnerability is tagged as an authentication bypass, suggesting that despite requiring a low-privileged account, the flaw circumvents authorization controls that should restrict data access within the Experience Manager component. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit once an attacker has any valid credential.
Oracle Commerce Guided Search and Experience Manager version 11.4.0 exposes a local confidentiality vulnerability in its Content Acquisition System (CAS) component that allows an unauthenticated infrastructure-level attacker to bypass application-layer authentication and obtain complete read access to all Oracle Commerce accessible data, including critical confidential records. The scope change designation in the CVSS vector (S:C) indicates successful exploitation can cascade beyond the Commerce platform itself, impacting additional co-located or integrated products. No public exploit code has been identified at time of analysis, and EPSS data was not provided in the source intelligence.
Unauthorized access to critical commerce data is achievable against Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via a network-accessible authentication bypass in the Content Acquisition System component. The vulnerability carries a CVSS scope change, meaning successful exploitation can spill over to compromise data accessible by additional integrated Oracle Commerce components beyond the directly attacked service. No public exploit has been identified at time of analysis, but the Authentication Bypass tag and unauthenticated network vector make this a meaningful data-exposure risk for any organization running the affected version.
Local data exposure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a low-privileged attacker with OS-level logon access to the hosting infrastructure to compromise the Content Acquisition System (CAS) component and read critical or complete data. The scope change (S:C) in the CVSS vector confirms the attack can propagate beyond the directly vulnerable component to impact other Oracle Commerce products sharing the same environment. No public exploit code and no CISA KEV listing are identified at time of analysis; this issue was disclosed by Oracle via the August 2026 Critical Patch Update.
Unauthenticated network exploitation of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via the Content Acquisition System component enables complete unauthorized read access to all data accessible by the platform, with scope change indicating downstream impact on adjacent Oracle systems. The attack vector is HTTP with high complexity, meaning specific preconditions must be met, but no credentials are required. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog. The tag 'Authentication Bypass' suggests the root cause is a failure in the Content Acquisition System to enforce identity controls on inbound HTTP requests.
Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes all data accessible to the Content Acquisition System component via a network-based authentication bypass over HTTP. Successful exploitation requires no credentials and no user interaction, though high attack complexity limits opportunistic mass exploitation. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog at time of analysis.
Unauthorized access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by any low-privileged, network-authenticated attacker over HTTP. The flaw resides in the Security component and, per the Oracle tag classification, represents an authorization bypass that permits a low-privilege account to read critical or complete HFM data assets well beyond their assigned permissions. No public exploit has been identified at time of analysis, though Oracle's Critical Security Update for August 2026 formally acknowledges and patches the issue.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged attacker with network access via HTTP to bypass security controls and gain complete read access to all data accessible within the application. The vulnerability resides in the Security component and is tagged as an authentication bypass, indicating weaknesses in how the application enforces authorization for authenticated sessions. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the confidentiality impact is rated High, covering critical financial consolidation data.
Unauthorized read and write access to critical financial data in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible via an authentication bypass in the Installation and Configuration component, reachable over HTTP by low-privileged network attackers. Successful exploitation grants complete confidentiality and integrity compromise of all Hyperion-accessible data, though no availability impact is described. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows any low-privileged authenticated attacker with HTTP network access to bypass security controls within the Security component, gaining read access to all financial data accessible by the application. Tagged as an Authentication Bypass, this suggests low-privileged users can circumvent authorization logic to access data sets beyond their permitted scope. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor's 'easily exploitable' designation and low attack complexity make this a practical risk for organizations running HFM in financial consolidation environments.
Unauthorized data exposure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows a low-privileged network attacker to access critical or complete Hyperion data via HTTP. The vulnerability resides in the Installation and Configuration component and is rated CVSS 6.5, with high confidentiality impact and no integrity or availability consequence. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity makes it accessible to any authenticated attacker with network reach.
Unauthorized data access in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged attacker with HTTP network access to read a subset of accessible data and perform unauthorized insert, update, or delete operations against the Installation and Configuration component. Despite the moderate CVSS score of 4.2, the 'Authentication Bypass' tag suggests the vulnerability enables a low-privileged user to circumvent authorization controls beyond their entitlement, though high attack complexity (AC:H) significantly constrains practical exploitation. No public exploit code and no active exploitation have been identified at time of analysis.
Local information disclosure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows a low-privileged local attacker to read a subset of data accessible to the application. The vulnerability resides in the Installation and Configuration component and requires only local logon access with standard user privileges. No active exploitation or public exploit code has been identified at time of analysis.
Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes a network-exploitable flaw in its Installation and Configuration component that allows unauthenticated remote attackers to partially compromise confidentiality and integrity. The scope change (S:C) in the CVSS vector, combined with the UI:R requirement and 'Authentication Bypass' tag, strongly suggests a client-side injection class vulnerability - likely cross-site scripting or request forgery - capable of affecting components beyond the directly targeted product. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 enables low-privileged authenticated users to access critical financial data or all application-accessible data over HTTP. The vulnerability resides in the Security component, and the 'Authentication Bypass' tag in the intelligence data suggests a breakdown in authorization enforcement that allows an authenticated low-privileged user to exceed their intended access scope - effectively escalating read access to sensitive financial records. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and network accessibility make this a practical risk for any organization relying on HFM for financial consolidation.
Unauthorized read and write access to Helidon-accessible data is possible through the Imperative Web Server component in Oracle Helidon 3.2.19 via a network-deliverable HTTP attack that requires victim interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) with scope change is characteristic of a client-side injection vulnerability such as Cross-Site Scripting or CSRF, where the attack crosses a scope boundary to impact resources or systems beyond the Helidon process itself. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV at time of analysis; Oracle disclosed it via the August 2026 Critical Patch Update.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a low-severity integrity flaw in its Security component that permits a local, unauthenticated attacker - one with OS-level logon to the host infrastructure - to perform unauthorized insert, update, or delete operations against a subset of accessible application data. Exploitation is rated difficult (AC:H) and additionally requires human interaction from a party other than the attacker, substantially constraining real-world opportunity. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, consistent with its 2.5 CVSS base score.
Local authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 exposes a subset of sensitive financial data to unauthenticated local attackers via the Security component. The vulnerability is tagged as an authentication bypass and carries a CVSS 3.1 score of 4.0, reflecting limited confidentiality impact with no integrity or availability consequences. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ease-of-exploitation characterization in Oracle's advisory warrants prompt patching in environments where infrastructure access is not tightly controlled.
Hyperion Financial Management version 11.2.25.0.000 contains an authentication bypass in its Security component that allows unauthenticated local attackers to read a subset of application-accessible financial data. The attack vector is strictly local (AV:L), meaning exploitation requires logon access to the host OS infrastructure where Hyperion executes - this is not a remotely triggerable flaw. No public exploit code has been identified at time of analysis, and the CVSS base score of 4.0 reflects limited, confidentiality-only impact with no integrity or availability consequences.
Integrity compromise in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged local attacker - contingent on human interaction from a separate user - to perform unauthorized creation, deletion, or modification of critical financial consolidation data, with potential scope change impact on additional Oracle components. ENISA EUVD-2026-61861 tags this as involving Authentication Bypass within the Security component, though the specific mechanism is not disclosed in Oracle's advisory. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Unauthorized read access to Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by unauthenticated remote attackers over HTTP, exploiting a flaw in the product's Security component tagged as an authentication bypass. The CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, zero-privilege exploitation with no user interaction required, limited to partial confidentiality loss. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, placing this in the moderate-priority remediation category despite the sensitivity of financial consolidation data.
Partial denial-of-service in Oracle Java SE's JSSE component allows unauthenticated remote attackers to degrade availability of applications using TLS APIs across a broad range of supported Java versions. Affected releases span Java SE 8 through 26, GraalVM for JDK 17 and 21, and GraalVM Enterprise Edition 21.3.19, making this a wide-blast-radius availability issue for the Java ecosystem. Exploitation is limited to availability impact only - no confidentiality or integrity compromise is possible - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Local authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a low-privileged attacker with logon access to the hosting infrastructure to read critical or all DRM-accessible data, with scope change indicating spillover exposure to additional integrated Oracle Hyperion components. The CVSS 3.1 score of 6.5 reflects the local attack vector with high confidentiality impact (C:H) and a notable scope change (S:C), meaning data exposure is not confined to the DRM application alone. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full system takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a high-privileged attacker with network access via HTTP, exploiting a flaw in the Access and Security component. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, consistent with a CVSS 3.1 score of 6.6 that is tempered by high attack complexity and high privilege prerequisites. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a low-severity, network-accessible vulnerability in its Security component that allows a high-privileged, authenticated attacker to read a limited subset of application data and cause a partial denial of service via HTTP. The CVSS 3.1 base score of 3.3 (Low) accurately reflects the constrained real-world risk: exploitation demands both elevated privileges and high attack complexity, substantially limiting the attacker population. No public exploit code or active exploitation has been identified at time of analysis.
Partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, authenticated attacker over HTTP, targeting the Security component under high-complexity conditions. Impact is limited exclusively to availability - no confidentiality or integrity compromise is possible - resulting in a partial service disruption rather than full outage. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing it at low real-world priority for most environments.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a low-severity local vulnerability in its Security component, enabling a high-privileged attacker with local infrastructure logon to perform unauthorized data modification and cause partial denial of service. The CVSS vector (AV:L/AC:H/PR:H) confirms that exploitation requires both physical or logical local access and a high-privilege account, with complex attack conditions that must be met. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, consistent with its low base score and restricted attack surface.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a network-exploitable vulnerability in its Security component that allows a high-privileged authenticated attacker to exfiltrate critical financial data or cause a complete denial of service via crafted HTTP requests. Disclosed as part of Oracle's Critical Patch Update for August 2026 (CSPUAUG2026), this flaw carries a CVSS 3.1 base score of 6.5, driven by High confidentiality and High availability impacts with no integrity effect. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the intelligence data introduces a notable ambiguity regarding actual privilege requirements that warrants verification.
Partial confidentiality exposure in Oracle Hyperion Financial Management version 11.2.25.0.000 allows unauthenticated network attackers to read a subset of application data via HTTP under high-complexity conditions. The Security component is tagged as an authentication bypass, though impact is limited to low-severity data disclosure with no integrity or availability consequences. No public exploit code or CISA KEV listing exists at time of analysis.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local privilege escalation via its Security component, enabling a low-privileged infrastructure user to bypass access controls and obtain complete unauthorized access to all financial data the application can reach. The CVSS scope change (S:C) confirms that successful exploitation extends impact beyond HFM itself to additional Oracle ecosystem products sharing the same infrastructure. No public exploit has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 enables an unauthenticated attacker positioned on the same physical network segment to fully compromise confidentiality and integrity of financial data. The vulnerability is tagged as an authentication bypass in the Security component, meaning an adversary can bypass credential checks and gain unauthorized read and write access to all financial data accessible by the application. No public exploit code has been identified at time of analysis, and the adjacent-network vector combined with high attack complexity limits the realistic attacker population to internal network adversaries or those with network proximity to the deployment.
Local confidentiality breach in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged infrastructure user to bypass Security component controls and gain unauthorized access to critical financial data, with potential spillover into additional connected Oracle products due to a confirmed scope change. The CVSS vector (AV:L/AC:H/PR:L/S:C/C:H) indicates the attack requires local system logon and high complexity, but successful exploitation yields complete read access to all data accessible by the application. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world immediate risk moderate despite the authentication bypass tag.
Local access exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 enables authenticated low-privileged users with host logon rights to bypass Security component access controls and gain unauthorized read access to all HFM-accessible financial data, plus limited write capability. The vulnerability is tagged as an Authentication Bypass within the Security component itself - not a peripheral feature - meaning the core authorization enforcement mechanism is circumvented. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and realistic insider-threat scenario make this actionable for organizations running HFM on-premises.
Local confidentiality exposure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged attacker with local system logon to read critical or all accessible financial data within the application. The vulnerability resides in the Security component and is classified as easily exploitable given low attack complexity and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged authenticated network attackers to gain complete read access to all data accessible by the application via HTTP. The vulnerability resides in the Security component and is tagged as an Authentication Bypass, indicating that an attacker with a valid but low-privileged account can circumvent authorization controls to read critical financial data beyond their intended scope. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network attack vector make this straightforward to exploit once credentials are obtained.
Unauthorized data disclosure in Oracle Hyperion Financial Management version 11.2.25.0.000 allows low-privileged, network-based attackers to access critical or complete application data via HTTP. The vulnerability resides in the Security component and is tagged as an authentication bypass, indicating that existing authorization controls can be circumvented by an attacker holding any low-privilege account, exposing all financial data accessible within the application. No public exploit code has been identified at time of analysis, and Oracle has addressed the issue in its Critical Patch Update for August 2026.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged authenticated network attackers to access all data accessible to the application via HTTP, targeting the Security component. The 'Authentication Bypass' tag suggests an authorization control failure permitting privilege escalation within an authenticated session, enabling full confidentiality compromise of sensitive financial consolidation data. No public exploit or active exploitation has been identified; this was disclosed as part of Oracle's Critical Security Patch Update for August 2026.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a network-accessible low-privileged attacker to read all data the application can access via a flaw in its Security component over HTTP. The vulnerability is tagged as an authentication bypass, suggesting that while a low-privilege session is sufficient to initiate the attack, the Security component fails to enforce authorization boundaries that should restrict access to higher-privilege data. No public exploit code has been identified and no active exploitation is confirmed by CISA KEV at the time of analysis.
Integrity compromise in Oracle Hyperion Financial Reporting 11.2.25.0.000 enables a low-privileged attacker with local infrastructure access to create, delete, or modify critical financial data managed by the application. Oracle's August 2026 Critical Security Patch Update addresses the flaw, which is rated Medium severity (CVSS 4.7) and is constrained by a local attack vector and high attack complexity. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.
Oracle Hyperion Financial Reporting version 11.2.25.0.000 exposes its Server component to unauthorized data manipulation and read access via a network-exploitable flaw tagged as an Authentication Bypass by Oracle's security team. A low-privileged attacker with HTTP network access can, under difficult-to-achieve conditions, read a subset of accessible financial data and perform unauthorized insert, update, or delete operations. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the financial data sensitivity of the affected platform elevates organizational risk beyond the moderate CVSS base score.
Oracle Hyperion Financial Reporting version 11.2.25.0.000's Server component contains an authentication bypass flaw exploitable by unauthenticated remote attackers over HTTP, as tagged directly by Oracle in their August 2026 Critical Patch Update. Successful exploitation - which demands both high attack complexity and human interaction from a legitimate user - yields complete read access to all data accessible within the Financial Reporting server, plus limited write capability (insert, update, delete) over some records. No public exploit code has been identified at time of analysis; exploitation complexity and the mandatory victim interaction requirement meaningfully constrain opportunistic or automated campaigns.
Unauthenticated remote compromise of Oracle Hyperion Financial Reporting version 11.2.25.0.000 allows network-accessible attackers to read and tamper with financial reporting data via HTTP without any credentials. The Server component is the affected entry point, and the attack is characterized by Oracle as 'easily exploitable,' meaning no special tooling or chaining is required. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, though the authentication bypass tag and zero-privilege requirement lower the bar for opportunistic targeting.
Unauthorized data exposure in Oracle Hyperion Financial Reporting 11.2.25.0.000 enables unauthenticated remote attackers to read a subset of accessible financial data via HTTP under high-complexity conditions. Tagged as an authentication bypass, the vulnerability is reachable without credentials and without user interaction, yet the AC:H rating signals that reliable exploitation is non-trivial. No public exploit code has been identified and no active exploitation is confirmed; however, the financial sensitivity of data processed by Hyperion EPM elevates the practical significance beyond the raw CVSS 3.7 Low score for affected organizations.
Local privilege escalation in Oracle Hyperion Financial Reporting 11.2.25.0.000 allows a low-privileged attacker with logon access to the host infrastructure to perform unauthorized creation, deletion, or modification of critical data and read a subset of application data - consistent with an application-layer authentication bypass within the Server component. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. The combination of local access requirement and high attack complexity substantially limits opportunistic exploitation, though the integrity impact is rated High by Oracle.
Authentication bypass in Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes critical financial data to unauthenticated attackers who can reach the physical network segment hosting the server. The CVSS vector (AV:A/AC:H/PR:N) indicates that while no credentials are required and no user interaction is needed, exploitation is constrained to adjacent-network attackers and involves high attack complexity. Successful compromise yields full read and write access to all financial reporting data - including unauthorized creation, deletion, and modification of critical records. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized data modification is possible in Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component), exploitable by low-privileged authenticated attackers over HTTP under conditions of high attack complexity and required third-party user interaction. The impact is confined exclusively to limited integrity - partial unauthorized write access to financial reporting data - with no confidentiality or availability exposure. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the vendor-assigned CVSS score of 2.6 reflects the multiple prerequisite conditions that substantially limit real-world exploitability.
Oracle Installed Base within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes its User Interface component to low-privileged authenticated attackers over HTTP, enabling unauthorized read access, data manipulation (insert, update, delete), and partial denial of service. Disclosed via Oracle's August 2026 Critical Patch Update, this vulnerability is easily exploitable with no attack complexity requirements once a valid low-privileged account is obtained. No public exploit code or CISA KEV listing is present at time of analysis, but the low access complexity and broad version range across 13 minor releases increases organizational exposure.
Authentication bypass in Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows unauthenticated remote attackers to obtain complete read access to all financial data accessible to the application, along with limited write capability (insert, update, delete) over HTTP. The vulnerability is classified as difficult to exploit (AC:H), moderately containing real-world risk despite requiring no credentials. No public exploit code or CISA KEV listing exists at time of analysis, but the authentication bypass classification from Oracle's own reporting makes this a meaningful confidentiality risk for organizations using this platform for sensitive financial reporting.
Unauthenticated network exploitation of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows remote attackers to perform unauthorized read and write operations against application data by inducing a victim user to interact with attacker-controlled content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is characteristic of a client-side injection class - most likely Cross-Site Scripting - where the scope change metric indicates that successful exploitation extends impact beyond the immediate Hyperion application to additional products sharing the same session or trust context. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Unauthorized data disclosure in Oracle Hyperion Financial Reporting 11.2.25.0.000 allows a low-privileged authenticated attacker with HTTP network access to read all financial reporting data accessible to the application server. Tagged as an authentication bypass in intelligence metadata, suggesting the Server component fails to enforce authorization boundaries between privilege levels, enabling vertical privilege escalation over data access. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network vector make this straightforward to exploit once any valid account is obtained.
Unauthenticated network exploitation of Oracle Hyperion Financial Reporting version 11.2.25.0.000 allows remote attackers to partially read and manipulate application data via crafted HTTP requests, contingent on human interaction from an authenticated user. The vulnerability resides in the Server component and carries a CVSS 3.1 score of 5.4 (Medium), with confidentiality and integrity impacts but no availability effect. No public exploit identified at time of analysis and it is absent from the CISA KEV catalog, though the Oracle CPU advisory for August 2026 addresses it.
Unauthorized read and write access to Oracle Hyperion Financial Reporting 11.2.25.0.000 data is achievable by unauthenticated remote attackers via HTTP, provided a victim authenticated user interacts with attacker-controlled content. The attack achieves a scope change - impacting components beyond the directly targeted server - yielding limited confidentiality exposure and insert/update/delete capability against accessible Financial Reporting data. No public exploit has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.
Unauthorized data access and modification in Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by unauthenticated remote attackers over HTTP when a legitimate user is socially engineered into interacting with attacker-controlled content. Classified under the Authentication Bypass tag, the flaw enables partial confidentiality exposure and unauthorized write operations against financial reporting data without requiring any attacker credentials, exploiting the victim's active session. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle released a fix in the August 2026 Critical Patch Update.
Integrity compromise and partial data disclosure in Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes financial reporting data to a local low-privileged attacker who can, under high-complexity conditions, create, modify, or delete critical data and read a subset of accessible reporting records. The Server component is the affected entry point, and exploitation requires an established logon to the infrastructure host. No public exploit has been identified at time of analysis, and the CVSS 3.1 score of 5.3 (Medium) appropriately reflects the local access constraint and difficult exploitation conditions.
Unauthorized read access to Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, with no user interaction or special configuration required. The vulnerability is tagged as an authentication bypass in the Server component, allowing exposure of a subset of Financial Reporting data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-authentication attack vector makes it straightforward to leverage opportunistically.
Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes an authentication-related flaw in its Server component that allows a low-privileged, network-authenticated attacker to gain unauthorized read access to critical financial data and limited write access through crafted HTTP requests - provided a separate user interaction is triggered. Tagged by Oracle as an Authentication Bypass, the vulnerability yields High confidentiality impact and Low integrity impact against version 11.2.25.0.000. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes an authentication bypass in its Server component, reachable over HTTP without credentials, that allows full read and write access to sensitive financial data. The attack is tagged as an Authentication Bypass by the reporting source (secalert_us@oracle.com) and yields both C:H and I:H impact, meaning an attacker can exfiltrate all accessible financial data and tamper with or delete critical records. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the high-impact outcome against an enterprise financial platform warrants priority patching.
Unauthorized data disclosure in Oracle Mobile Application Server's MWA Terminal Server component affects all supported E-Business Suite deployments running versions 12.2.3 through 12.2.15. Low-privileged network attackers with HTTP access can exploit an authorization bypass to gain complete read access to all data within the Mobile Application Server's scope - including sensitive warehouse, inventory, and business records. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog, but Oracle's advisory language explicitly flags it as 'easily exploitable,' reducing the practical barrier significantly.
Unauthorized read access to a subset of data is possible in Oracle Helidon 3.2.18's Imperative Web Server component via unauthenticated HTTPS network requests. Tagged as an Authentication Bypass, this flaw allows a remote unauthenticated attacker with network reach to the affected service to circumvent access controls and retrieve restricted information without any credentials or user interaction. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and zero-privilege requirement make it accessible to unsophisticated attackers.
Unauthorized data access and modification in Oracle Cash Management (versions 12.2.3 through 12.2.15) is achievable by a high-privileged attacker with local logon access to the host infrastructure where the application executes. Exploitation allows complete read access and write or delete control over critical Cash Management data, covering both confidentiality and integrity at a High impact level with no availability component. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Oracle Production Scheduling versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes a network-accessible HTTP endpoint in its Internal Operations component that can be abused by a low-privileged authenticated attacker to read all data accessible to the application. The impact is limited to confidentiality - no integrity or availability loss - but the scope covers 'complete access to all Oracle Production Scheduling accessible data,' which may include sensitive operational and supply-chain planning records. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Local information disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables an unauthenticated attacker with logon access to the underlying infrastructure to bypass application-level authentication controls and read a subset of accessible data. The attack vector is local (AV:L), meaning exploitation requires the attacker to already have operating-system-level access to the host running the product, significantly limiting the exposed population. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this vulnerability via its August 2026 Critical Patch Update.
Unauthorized data access and modification in Oracle Autonomous Health Framework's Cluster Health Analyzer component allows a low-privileged attacker with adjacency to the physical communication segment to fully compromise confidentiality and integrity of AHF data, with scope change enabling lateral impact on additional Oracle products. Affected versions span the 26.x release line through 26.5.2, disclosed in Oracle's August 2026 Critical Patch Update. No public exploit code has been identified at time of analysis, and the High attack complexity combined with the adjacent-only attack vector materially constrains real-world exploitability despite the 7.7 base score.
Integrity-bypassing authentication flaw in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated remote attackers to create, delete, or modify critical application data via HTTP, despite requiring high attack complexity to trigger. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms the attack is network-reachable without credentials but is gated behind difficult-to-replicate exploitation conditions. No active exploitation has been confirmed (no CISA KEV listing), and no public exploit code has been identified at time of analysis.
Full takeover of Oracle Autonomous Health Framework is achievable by an unauthenticated attacker positioned on the same physical or logical network segment as the affected host, exploiting a flaw in the Trace File Analyzer (TFA) component. Affected releases span multiple 26.x branches - 26 through 26.1.0, 26.2.0, 26.3.1, 26.5.0, and 26.5.2 - with successful exploitation yielding complete confidentiality, integrity, and availability compromise. No public exploit code has been identified and no CISA KEV listing is present at time of analysis, though the low attack complexity and absence of authentication requirements make exploitation straightforward for any attacker with adjacent network access.
Integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables a high-privileged local attacker to bypass security controls within the application's Security component, resulting in unauthorized creation, deletion, or modification of critical financial or planning data. Exploitation is tightly constrained by local infrastructure access, high privilege requirements, and high attack complexity, placing this vulnerability at meaningful risk only from insider threats or fully compromised privileged accounts. No public exploit or active exploitation has been identified at time of analysis.
Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable by a highly privileged local attacker through a difficult-to-exploit flaw in the Install component. The CVSS vector (AV:L/AC:H/PR:H) confirms that while the impact is severe - achieving complete confidentiality, integrity, and availability compromise - the attack prerequisites are restrictive, limiting realistic exposure. No public exploit code has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.
Local access exploitation in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated attacker with infrastructure logon to partially compromise data confidentiality and integrity, requiring human interaction to succeed. Tagged as an authentication bypass in the Security component, the flaw yields only limited read and write/insert/delete access to a subset of accessible data, with no availability impact. No public exploit or CISA KEV listing exists at time of analysis; the low CVSS score of 3.6 reflects the constrained impact and high exploitation complexity.
Unauthorized data access in Oracle Agile Engineering Data Management 6.2.1 is achievable by unauthenticated network attackers via HTTP through the Engineering Communication Interface component. The flaw - tagged as an authentication bypass - permits limited confidentiality and integrity compromise, allowing unauthorized read of a subset of accessible data and unauthorized update, insert, or delete operations on some data. No active exploitation has been confirmed (no CISA KEV listing), and the high attack complexity (AC:H) materially constrains real-world exploitation.
Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable through a vulnerability in its Install component, exploitable by a high-privileged attacker with local logon access to the host infrastructure. The CVSS 3.1 base score of 6.7 reflects the constrained attack prerequisites - local access and high privileges - yet successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Full system compromise of Oracle Agile Engineering Data Management 6.2.1 is possible through a flaw in the Engineering Communication Interface (ECI) component, but only under a confluence of highly restrictive conditions - local infrastructure access, high privileges, high attack complexity, and mandatory third-party user interaction. The CVSS base score of 6.3 (Medium) reflects these compounding constraints despite a full confidentiality, integrity, and availability impact. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthorized data manipulation in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by unauthenticated network attackers via HTTP, contingent on a victim interacting with attacker-supplied content. The vulnerability resides in the Security component and is tagged as an authentication bypass, consistent with a CSRF-like mechanism where the attacker leverages a victim's session to insert, update, or delete accessible data. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the moderate CVSS score of 4.3 reflects the integrity-only, user-interaction-dependent nature of the attack.
Partial authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated remote attacker to read a limited subset of application data over HTTP without valid credentials. The attack is classified as difficult to exploit (AC:H), meaning specific conditions must be met for reliable success, and impact is confined to low-level confidentiality loss with no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows remote attackers via HTTP to perform unauthorized insert, update, or delete operations on accessible data without credentials. The vulnerability resides in the Security component of this enterprise performance management suite and is classified as easily exploitable per Oracle's advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass tag and PR:N CVSS vector confirm no credential barrier exists for exploitation.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a remote unauthenticated attacker to compromise data confidentiality and integrity via a network-delivered HTTP attack that requires victim interaction. Successful exploitation yields complete read access to all data accessible by the Calculation Manager and limited write capability (insert, update, delete) against a subset of that data. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the tagging of this vulnerability as an Authentication Bypass in the Security component, combined with the high confidentiality impact, makes it a meaningful risk for organizations running Oracle Hyperion environments.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 is achievable by an unauthenticated attacker physically co-located on the same network segment as the affected host. The Security and Authentication component contains an easily exploitable flaw - CVSS AC:L and PR:N confirm no elevated privileges or complexity are required once adjacent network access is established. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the Oracle Reports Developer instance. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 is achievable by an unauthenticated attacker present on the same physical network segment as the host running the software. The vulnerability resides in the Security and Authentication component of this Oracle Fusion Middleware product, meaning the mechanism meant to enforce access control can be bypassed without credentials. With a CVSS 3.1 score of 8.8, the impact spans complete confidentiality, integrity, and availability compromise; no public exploit or CISA KEV listing has been identified at time of analysis.
Full compromise of Oracle Reports Developer 12.2.1.19.0 is achievable by an unauthenticated attacker who has access to the same physical or logical network segment as the host running the software. The flaw resides in the Security and Authentication component of this Oracle Fusion Middleware product, and successful exploitation yields complete confidentiality, integrity, and availability impact - effectively a full system takeover. No public exploit or CISA KEV listing exists at time of analysis, but the combination of no required privileges, no user interaction, and a low-complexity attack makes this a credible threat within the adjacent network boundary.
Partial information disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to read a subset of application data via HTTP under high-complexity conditions. The vulnerability resides in the Security component and is tagged as an authentication bypass, suggesting insufficient authorization enforcement rather than a full credential bypass. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Unauthorized read access to a subset of Oracle Hyperion Calculation Manager 11.2.25.0.000 data is achievable by an unauthenticated attacker who has gained proximity to the physical communication segment on which the software executes, exploiting a flaw in its Security component. The CVSS 3.1 score of 3.1 reflects a tightly constrained impact - confidentiality only, with no integrity or availability effects - combined with an adjacent-only network vector and high attack complexity. No public exploit code and no active exploitation have been identified at time of analysis.
Cross-site scripting (or equivalent client-side injection) in the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows unauthenticated remote attackers to perform unauthorized read and write operations against Commerce data by luring an authenticated user into interacting with a malicious HTTP request. The scope change (S:C) in the CVSS vector confirms that a successful attack can extend impact beyond the targeted component to additional Oracle products or browser contexts. No public exploit identified at time of analysis, and no CISA KEV listing; Oracle disclosed and patched this issue in the August 2026 Critical Patch Update.
Cross-site scripting in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 enables unauthenticated remote attackers to compromise victim sessions via HTTP. The attack requires human interaction - a victim must trigger the malicious request - and exploits the Internal operations component in a way that causes a scope change, meaning successful exploitation can affect resources beyond the vulnerable component itself (consistent with browser-context hijacking). Impact is limited to partial confidentiality and integrity loss: unauthorized read access to a subset of accessible data and unauthorized write/insert/delete on some accessible data; no availability impact is present. No public exploit or CISA KEV listing has been identified at time of analysis.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes critical data and partial denial-of-service risk via the Endeca Application Controller component over HTTP. An unauthenticated network attacker exploiting this vulnerability - tagged as an authentication bypass - can gain complete read access to all data accessible within the Oracle Commerce platform and degrade service availability. No public exploit code has been identified at time of analysis, and the high attack complexity (AC:H) reduces the realistic threat surface, though a successful attacker requires no credentials or user interaction once the exploit conditions are met.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local security-component flaw that grants a high-privileged infrastructure user unauthorized read and write access to all application data, including critical financial records. Despite requiring existing high privileges, the 'Authentication Bypass' tag signals that the Security component likely fails to enforce intra-application authorization boundaries, enabling privilege escalation within the product beyond the attacker's sanctioned scope. No public exploit code has been identified, and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cross-site scripting (XSS) class vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows unauthenticated remote attackers to compromise confidentiality and integrity of data by delivering a crafted HTTP payload that requires victim interaction. The scope change indicator in the CVSS vector (S:C) confirms that successful exploitation impacts resources beyond the directly vulnerable component - consistent with browser-context script execution affecting adjacent systems or sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this accessible to unsophisticated attackers once a suitable delivery mechanism is established.
Confidential data exposure in Oracle Commerce Guided Search / Experience Manager 11.4.0 enables high-privileged network attackers to read critical platform data over HTTP, with a confirmed scope change extending potential impact to adjacent Oracle Commerce components beyond the primary application. The attack requires no user interaction and is characterized as easily exploitable at low complexity, though the high privilege prerequisite narrows the attacker pool. Oracle has addressed this vulnerability in the Critical Security Patch Update for August 2026; no public exploit code has been identified at time of analysis.
Unauthorized critical data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a high-privileged, network-based attacker to read all data accessible to the Experience Manager component, with scope change extending impact to additional Oracle Commerce products. The vulnerability is exploitable over HTTP with no user interaction required. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the 'Authentication Bypass' tag warrants attention - it may indicate a privilege escalation pathway that reduces the effective authentication bar. EPSS data was not provided.
Cross-site scripting (XSS) in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows a remote unauthenticated attacker to inject malicious content into a victim's browser session via a crafted HTTP request, requiring the victim to interact with a manipulated link or page. The scope change in the CVSS vector (S:C) indicates the attack can affect browser context outside the vulnerable component, enabling session token theft or unauthorized data modification within the application. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting or client-side injection in Oracle Commerce Experience Manager 11.4.0 enables unauthenticated remote attackers to compromise confidentiality and integrity of affected deployments through HTTP-delivered attacks requiring victim interaction. The scope change indicator in the CVSS vector confirms that successful exploitation can impact resources beyond the directly vulnerable component, consistent with session theft or content injection affecting downstream users. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle's August 2026 Critical Patch Update addresses this in a quarterly advisory cycle.
Cross-site scripting conditions in Oracle Commerce Guided Search / Experience Manager 11.4.0 allow an unauthenticated remote attacker to compromise victim sessions through a crafted HTTP request that requires human interaction to trigger. The vulnerability carries a scope change, extending impact beyond the directly vulnerable component to data accessible within the victim's authenticated browser context, enabling unauthorized read and limited data modification. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified at the time of analysis.
Unauthorized data disclosure in Oracle Commerce Experience Manager 11.4.0 allows low-privileged authenticated attackers to access critical or complete application data via HTTP. The vulnerability is tagged as an authentication bypass, suggesting that despite requiring a low-privileged account, the flaw circumvents authorization controls that should restrict data access within the Experience Manager component. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit once an attacker has any valid credential.
Oracle Commerce Guided Search and Experience Manager version 11.4.0 exposes a local confidentiality vulnerability in its Content Acquisition System (CAS) component that allows an unauthenticated infrastructure-level attacker to bypass application-layer authentication and obtain complete read access to all Oracle Commerce accessible data, including critical confidential records. The scope change designation in the CVSS vector (S:C) indicates successful exploitation can cascade beyond the Commerce platform itself, impacting additional co-located or integrated products. No public exploit code has been identified at time of analysis, and EPSS data was not provided in the source intelligence.
Unauthorized access to critical commerce data is achievable against Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via a network-accessible authentication bypass in the Content Acquisition System component. The vulnerability carries a CVSS scope change, meaning successful exploitation can spill over to compromise data accessible by additional integrated Oracle Commerce components beyond the directly attacked service. No public exploit has been identified at time of analysis, but the Authentication Bypass tag and unauthenticated network vector make this a meaningful data-exposure risk for any organization running the affected version.
Local data exposure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a low-privileged attacker with OS-level logon access to the hosting infrastructure to compromise the Content Acquisition System (CAS) component and read critical or complete data. The scope change (S:C) in the CVSS vector confirms the attack can propagate beyond the directly vulnerable component to impact other Oracle Commerce products sharing the same environment. No public exploit code and no CISA KEV listing are identified at time of analysis; this issue was disclosed by Oracle via the August 2026 Critical Patch Update.
Unauthenticated network exploitation of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via the Content Acquisition System component enables complete unauthorized read access to all data accessible by the platform, with scope change indicating downstream impact on adjacent Oracle systems. The attack vector is HTTP with high complexity, meaning specific preconditions must be met, but no credentials are required. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog. The tag 'Authentication Bypass' suggests the root cause is a failure in the Content Acquisition System to enforce identity controls on inbound HTTP requests.
Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes all data accessible to the Content Acquisition System component via a network-based authentication bypass over HTTP. Successful exploitation requires no credentials and no user interaction, though high attack complexity limits opportunistic mass exploitation. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog at time of analysis.
Unauthorized access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by any low-privileged, network-authenticated attacker over HTTP. The flaw resides in the Security component and, per the Oracle tag classification, represents an authorization bypass that permits a low-privilege account to read critical or complete HFM data assets well beyond their assigned permissions. No public exploit has been identified at time of analysis, though Oracle's Critical Security Update for August 2026 formally acknowledges and patches the issue.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged attacker with network access via HTTP to bypass security controls and gain complete read access to all data accessible within the application. The vulnerability resides in the Security component and is tagged as an authentication bypass, indicating weaknesses in how the application enforces authorization for authenticated sessions. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the confidentiality impact is rated High, covering critical financial consolidation data.
Unauthorized read and write access to critical financial data in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible via an authentication bypass in the Installation and Configuration component, reachable over HTTP by low-privileged network attackers. Successful exploitation grants complete confidentiality and integrity compromise of all Hyperion-accessible data, though no availability impact is described. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows any low-privileged authenticated attacker with HTTP network access to bypass security controls within the Security component, gaining read access to all financial data accessible by the application. Tagged as an Authentication Bypass, this suggests low-privileged users can circumvent authorization logic to access data sets beyond their permitted scope. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor's 'easily exploitable' designation and low attack complexity make this a practical risk for organizations running HFM in financial consolidation environments.
Unauthorized data exposure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows a low-privileged network attacker to access critical or complete Hyperion data via HTTP. The vulnerability resides in the Installation and Configuration component and is rated CVSS 6.5, with high confidentiality impact and no integrity or availability consequence. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity makes it accessible to any authenticated attacker with network reach.
Unauthorized data access in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged attacker with HTTP network access to read a subset of accessible data and perform unauthorized insert, update, or delete operations against the Installation and Configuration component. Despite the moderate CVSS score of 4.2, the 'Authentication Bypass' tag suggests the vulnerability enables a low-privileged user to circumvent authorization controls beyond their entitlement, though high attack complexity (AC:H) significantly constrains practical exploitation. No public exploit code and no active exploitation have been identified at time of analysis.
Local information disclosure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows a low-privileged local attacker to read a subset of data accessible to the application. The vulnerability resides in the Installation and Configuration component and requires only local logon access with standard user privileges. No active exploitation or public exploit code has been identified at time of analysis.
Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes a network-exploitable flaw in its Installation and Configuration component that allows unauthenticated remote attackers to partially compromise confidentiality and integrity. The scope change (S:C) in the CVSS vector, combined with the UI:R requirement and 'Authentication Bypass' tag, strongly suggests a client-side injection class vulnerability - likely cross-site scripting or request forgery - capable of affecting components beyond the directly targeted product. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 enables low-privileged authenticated users to access critical financial data or all application-accessible data over HTTP. The vulnerability resides in the Security component, and the 'Authentication Bypass' tag in the intelligence data suggests a breakdown in authorization enforcement that allows an authenticated low-privileged user to exceed their intended access scope - effectively escalating read access to sensitive financial records. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and network accessibility make this a practical risk for any organization relying on HFM for financial consolidation.
Unauthorized read and write access to Helidon-accessible data is possible through the Imperative Web Server component in Oracle Helidon 3.2.19 via a network-deliverable HTTP attack that requires victim interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) with scope change is characteristic of a client-side injection vulnerability such as Cross-Site Scripting or CSRF, where the attack crosses a scope boundary to impact resources or systems beyond the Helidon process itself. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV at time of analysis; Oracle disclosed it via the August 2026 Critical Patch Update.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a low-severity integrity flaw in its Security component that permits a local, unauthenticated attacker - one with OS-level logon to the host infrastructure - to perform unauthorized insert, update, or delete operations against a subset of accessible application data. Exploitation is rated difficult (AC:H) and additionally requires human interaction from a party other than the attacker, substantially constraining real-world opportunity. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, consistent with its 2.5 CVSS base score.
Local authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 exposes a subset of sensitive financial data to unauthenticated local attackers via the Security component. The vulnerability is tagged as an authentication bypass and carries a CVSS 3.1 score of 4.0, reflecting limited confidentiality impact with no integrity or availability consequences. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ease-of-exploitation characterization in Oracle's advisory warrants prompt patching in environments where infrastructure access is not tightly controlled.
Hyperion Financial Management version 11.2.25.0.000 contains an authentication bypass in its Security component that allows unauthenticated local attackers to read a subset of application-accessible financial data. The attack vector is strictly local (AV:L), meaning exploitation requires logon access to the host OS infrastructure where Hyperion executes - this is not a remotely triggerable flaw. No public exploit code has been identified at time of analysis, and the CVSS base score of 4.0 reflects limited, confidentiality-only impact with no integrity or availability consequences.
Integrity compromise in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged local attacker - contingent on human interaction from a separate user - to perform unauthorized creation, deletion, or modification of critical financial consolidation data, with potential scope change impact on additional Oracle components. ENISA EUVD-2026-61861 tags this as involving Authentication Bypass within the Security component, though the specific mechanism is not disclosed in Oracle's advisory. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Unauthorized read access to Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by unauthenticated remote attackers over HTTP, exploiting a flaw in the product's Security component tagged as an authentication bypass. The CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, zero-privilege exploitation with no user interaction required, limited to partial confidentiality loss. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, placing this in the moderate-priority remediation category despite the sensitivity of financial consolidation data.
Partial denial-of-service in Oracle Java SE's JSSE component allows unauthenticated remote attackers to degrade availability of applications using TLS APIs across a broad range of supported Java versions. Affected releases span Java SE 8 through 26, GraalVM for JDK 17 and 21, and GraalVM Enterprise Edition 21.3.19, making this a wide-blast-radius availability issue for the Java ecosystem. Exploitation is limited to availability impact only - no confidentiality or integrity compromise is possible - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Local authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a low-privileged attacker with logon access to the hosting infrastructure to read critical or all DRM-accessible data, with scope change indicating spillover exposure to additional integrated Oracle Hyperion components. The CVSS 3.1 score of 6.5 reflects the local attack vector with high confidentiality impact (C:H) and a notable scope change (S:C), meaning data exposure is not confined to the DRM application alone. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full system takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a high-privileged attacker with network access via HTTP, exploiting a flaw in the Access and Security component. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, consistent with a CVSS 3.1 score of 6.6 that is tempered by high attack complexity and high privilege prerequisites. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a low-severity, network-accessible vulnerability in its Security component that allows a high-privileged, authenticated attacker to read a limited subset of application data and cause a partial denial of service via HTTP. The CVSS 3.1 base score of 3.3 (Low) accurately reflects the constrained real-world risk: exploitation demands both elevated privileges and high attack complexity, substantially limiting the attacker population. No public exploit code or active exploitation has been identified at time of analysis.
Partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, authenticated attacker over HTTP, targeting the Security component under high-complexity conditions. Impact is limited exclusively to availability - no confidentiality or integrity compromise is possible - resulting in a partial service disruption rather than full outage. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing it at low real-world priority for most environments.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a low-severity local vulnerability in its Security component, enabling a high-privileged attacker with local infrastructure logon to perform unauthorized data modification and cause partial denial of service. The CVSS vector (AV:L/AC:H/PR:H) confirms that exploitation requires both physical or logical local access and a high-privilege account, with complex attack conditions that must be met. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, consistent with its low base score and restricted attack surface.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a network-exploitable vulnerability in its Security component that allows a high-privileged authenticated attacker to exfiltrate critical financial data or cause a complete denial of service via crafted HTTP requests. Disclosed as part of Oracle's Critical Patch Update for August 2026 (CSPUAUG2026), this flaw carries a CVSS 3.1 base score of 6.5, driven by High confidentiality and High availability impacts with no integrity effect. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the intelligence data introduces a notable ambiguity regarding actual privilege requirements that warrants verification.
Partial confidentiality exposure in Oracle Hyperion Financial Management version 11.2.25.0.000 allows unauthenticated network attackers to read a subset of application data via HTTP under high-complexity conditions. The Security component is tagged as an authentication bypass, though impact is limited to low-severity data disclosure with no integrity or availability consequences. No public exploit code or CISA KEV listing exists at time of analysis.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local privilege escalation via its Security component, enabling a low-privileged infrastructure user to bypass access controls and obtain complete unauthorized access to all financial data the application can reach. The CVSS scope change (S:C) confirms that successful exploitation extends impact beyond HFM itself to additional Oracle ecosystem products sharing the same infrastructure. No public exploit has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 enables an unauthenticated attacker positioned on the same physical network segment to fully compromise confidentiality and integrity of financial data. The vulnerability is tagged as an authentication bypass in the Security component, meaning an adversary can bypass credential checks and gain unauthorized read and write access to all financial data accessible by the application. No public exploit code has been identified at time of analysis, and the adjacent-network vector combined with high attack complexity limits the realistic attacker population to internal network adversaries or those with network proximity to the deployment.
Local confidentiality breach in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged infrastructure user to bypass Security component controls and gain unauthorized access to critical financial data, with potential spillover into additional connected Oracle products due to a confirmed scope change. The CVSS vector (AV:L/AC:H/PR:L/S:C/C:H) indicates the attack requires local system logon and high complexity, but successful exploitation yields complete read access to all data accessible by the application. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world immediate risk moderate despite the authentication bypass tag.
Local access exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 enables authenticated low-privileged users with host logon rights to bypass Security component access controls and gain unauthorized read access to all HFM-accessible financial data, plus limited write capability. The vulnerability is tagged as an Authentication Bypass within the Security component itself - not a peripheral feature - meaning the core authorization enforcement mechanism is circumvented. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and realistic insider-threat scenario make this actionable for organizations running HFM on-premises.
Local confidentiality exposure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged attacker with local system logon to read critical or all accessible financial data within the application. The vulnerability resides in the Security component and is classified as easily exploitable given low attack complexity and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged authenticated network attackers to gain complete read access to all data accessible by the application via HTTP. The vulnerability resides in the Security component and is tagged as an Authentication Bypass, indicating that an attacker with a valid but low-privileged account can circumvent authorization controls to read critical financial data beyond their intended scope. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network attack vector make this straightforward to exploit once credentials are obtained.
Unauthorized data disclosure in Oracle Hyperion Financial Management version 11.2.25.0.000 allows low-privileged, network-based attackers to access critical or complete application data via HTTP. The vulnerability resides in the Security component and is tagged as an authentication bypass, indicating that existing authorization controls can be circumvented by an attacker holding any low-privilege account, exposing all financial data accessible within the application. No public exploit code has been identified at time of analysis, and Oracle has addressed the issue in its Critical Patch Update for August 2026.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged authenticated network attackers to access all data accessible to the application via HTTP, targeting the Security component. The 'Authentication Bypass' tag suggests an authorization control failure permitting privilege escalation within an authenticated session, enabling full confidentiality compromise of sensitive financial consolidation data. No public exploit or active exploitation has been identified; this was disclosed as part of Oracle's Critical Security Patch Update for August 2026.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a network-accessible low-privileged attacker to read all data the application can access via a flaw in its Security component over HTTP. The vulnerability is tagged as an authentication bypass, suggesting that while a low-privilege session is sufficient to initiate the attack, the Security component fails to enforce authorization boundaries that should restrict access to higher-privilege data. No public exploit code has been identified and no active exploitation is confirmed by CISA KEV at the time of analysis.
Integrity compromise in Oracle Hyperion Financial Reporting 11.2.25.0.000 enables a low-privileged attacker with local infrastructure access to create, delete, or modify critical financial data managed by the application. Oracle's August 2026 Critical Security Patch Update addresses the flaw, which is rated Medium severity (CVSS 4.7) and is constrained by a local attack vector and high attack complexity. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.
Oracle Hyperion Financial Reporting version 11.2.25.0.000 exposes its Server component to unauthorized data manipulation and read access via a network-exploitable flaw tagged as an Authentication Bypass by Oracle's security team. A low-privileged attacker with HTTP network access can, under difficult-to-achieve conditions, read a subset of accessible financial data and perform unauthorized insert, update, or delete operations. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the financial data sensitivity of the affected platform elevates organizational risk beyond the moderate CVSS base score.
Oracle Hyperion Financial Reporting version 11.2.25.0.000's Server component contains an authentication bypass flaw exploitable by unauthenticated remote attackers over HTTP, as tagged directly by Oracle in their August 2026 Critical Patch Update. Successful exploitation - which demands both high attack complexity and human interaction from a legitimate user - yields complete read access to all data accessible within the Financial Reporting server, plus limited write capability (insert, update, delete) over some records. No public exploit code has been identified at time of analysis; exploitation complexity and the mandatory victim interaction requirement meaningfully constrain opportunistic or automated campaigns.
Unauthenticated remote compromise of Oracle Hyperion Financial Reporting version 11.2.25.0.000 allows network-accessible attackers to read and tamper with financial reporting data via HTTP without any credentials. The Server component is the affected entry point, and the attack is characterized by Oracle as 'easily exploitable,' meaning no special tooling or chaining is required. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, though the authentication bypass tag and zero-privilege requirement lower the bar for opportunistic targeting.
Unauthorized data exposure in Oracle Hyperion Financial Reporting 11.2.25.0.000 enables unauthenticated remote attackers to read a subset of accessible financial data via HTTP under high-complexity conditions. Tagged as an authentication bypass, the vulnerability is reachable without credentials and without user interaction, yet the AC:H rating signals that reliable exploitation is non-trivial. No public exploit code has been identified and no active exploitation is confirmed; however, the financial sensitivity of data processed by Hyperion EPM elevates the practical significance beyond the raw CVSS 3.7 Low score for affected organizations.
Local privilege escalation in Oracle Hyperion Financial Reporting 11.2.25.0.000 allows a low-privileged attacker with logon access to the host infrastructure to perform unauthorized creation, deletion, or modification of critical data and read a subset of application data - consistent with an application-layer authentication bypass within the Server component. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. The combination of local access requirement and high attack complexity substantially limits opportunistic exploitation, though the integrity impact is rated High by Oracle.
Authentication bypass in Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes critical financial data to unauthenticated attackers who can reach the physical network segment hosting the server. The CVSS vector (AV:A/AC:H/PR:N) indicates that while no credentials are required and no user interaction is needed, exploitation is constrained to adjacent-network attackers and involves high attack complexity. Successful compromise yields full read and write access to all financial reporting data - including unauthorized creation, deletion, and modification of critical records. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized data modification is possible in Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component), exploitable by low-privileged authenticated attackers over HTTP under conditions of high attack complexity and required third-party user interaction. The impact is confined exclusively to limited integrity - partial unauthorized write access to financial reporting data - with no confidentiality or availability exposure. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the vendor-assigned CVSS score of 2.6 reflects the multiple prerequisite conditions that substantially limit real-world exploitability.
Oracle Installed Base within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes its User Interface component to low-privileged authenticated attackers over HTTP, enabling unauthorized read access, data manipulation (insert, update, delete), and partial denial of service. Disclosed via Oracle's August 2026 Critical Patch Update, this vulnerability is easily exploitable with no attack complexity requirements once a valid low-privileged account is obtained. No public exploit code or CISA KEV listing is present at time of analysis, but the low access complexity and broad version range across 13 minor releases increases organizational exposure.
Authentication bypass in Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows unauthenticated remote attackers to obtain complete read access to all financial data accessible to the application, along with limited write capability (insert, update, delete) over HTTP. The vulnerability is classified as difficult to exploit (AC:H), moderately containing real-world risk despite requiring no credentials. No public exploit code or CISA KEV listing exists at time of analysis, but the authentication bypass classification from Oracle's own reporting makes this a meaningful confidentiality risk for organizations using this platform for sensitive financial reporting.
Unauthenticated network exploitation of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows remote attackers to perform unauthorized read and write operations against application data by inducing a victim user to interact with attacker-controlled content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is characteristic of a client-side injection class - most likely Cross-Site Scripting - where the scope change metric indicates that successful exploitation extends impact beyond the immediate Hyperion application to additional products sharing the same session or trust context. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Unauthorized data disclosure in Oracle Hyperion Financial Reporting 11.2.25.0.000 allows a low-privileged authenticated attacker with HTTP network access to read all financial reporting data accessible to the application server. Tagged as an authentication bypass in intelligence metadata, suggesting the Server component fails to enforce authorization boundaries between privilege levels, enabling vertical privilege escalation over data access. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network vector make this straightforward to exploit once any valid account is obtained.
Unauthenticated network exploitation of Oracle Hyperion Financial Reporting version 11.2.25.0.000 allows remote attackers to partially read and manipulate application data via crafted HTTP requests, contingent on human interaction from an authenticated user. The vulnerability resides in the Server component and carries a CVSS 3.1 score of 5.4 (Medium), with confidentiality and integrity impacts but no availability effect. No public exploit identified at time of analysis and it is absent from the CISA KEV catalog, though the Oracle CPU advisory for August 2026 addresses it.
Unauthorized read and write access to Oracle Hyperion Financial Reporting 11.2.25.0.000 data is achievable by unauthenticated remote attackers via HTTP, provided a victim authenticated user interacts with attacker-controlled content. The attack achieves a scope change - impacting components beyond the directly targeted server - yielding limited confidentiality exposure and insert/update/delete capability against accessible Financial Reporting data. No public exploit has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.
Unauthorized data access and modification in Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by unauthenticated remote attackers over HTTP when a legitimate user is socially engineered into interacting with attacker-controlled content. Classified under the Authentication Bypass tag, the flaw enables partial confidentiality exposure and unauthorized write operations against financial reporting data without requiring any attacker credentials, exploiting the victim's active session. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle released a fix in the August 2026 Critical Patch Update.
Integrity compromise and partial data disclosure in Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes financial reporting data to a local low-privileged attacker who can, under high-complexity conditions, create, modify, or delete critical data and read a subset of accessible reporting records. The Server component is the affected entry point, and exploitation requires an established logon to the infrastructure host. No public exploit has been identified at time of analysis, and the CVSS 3.1 score of 5.3 (Medium) appropriately reflects the local access constraint and difficult exploitation conditions.
Unauthorized read access to Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, with no user interaction or special configuration required. The vulnerability is tagged as an authentication bypass in the Server component, allowing exposure of a subset of Financial Reporting data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-authentication attack vector makes it straightforward to leverage opportunistically.
Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes an authentication-related flaw in its Server component that allows a low-privileged, network-authenticated attacker to gain unauthorized read access to critical financial data and limited write access through crafted HTTP requests - provided a separate user interaction is triggered. Tagged by Oracle as an Authentication Bypass, the vulnerability yields High confidentiality impact and Low integrity impact against version 11.2.25.0.000. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes an authentication bypass in its Server component, reachable over HTTP without credentials, that allows full read and write access to sensitive financial data. The attack is tagged as an Authentication Bypass by the reporting source (secalert_us@oracle.com) and yields both C:H and I:H impact, meaning an attacker can exfiltrate all accessible financial data and tamper with or delete critical records. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the high-impact outcome against an enterprise financial platform warrants priority patching.
Unauthorized data disclosure in Oracle Mobile Application Server's MWA Terminal Server component affects all supported E-Business Suite deployments running versions 12.2.3 through 12.2.15. Low-privileged network attackers with HTTP access can exploit an authorization bypass to gain complete read access to all data within the Mobile Application Server's scope - including sensitive warehouse, inventory, and business records. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog, but Oracle's advisory language explicitly flags it as 'easily exploitable,' reducing the practical barrier significantly.
Unauthorized read access to a subset of data is possible in Oracle Helidon 3.2.18's Imperative Web Server component via unauthenticated HTTPS network requests. Tagged as an Authentication Bypass, this flaw allows a remote unauthenticated attacker with network reach to the affected service to circumvent access controls and retrieve restricted information without any credentials or user interaction. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and zero-privilege requirement make it accessible to unsophisticated attackers.
Unauthorized data access and modification in Oracle Cash Management (versions 12.2.3 through 12.2.15) is achievable by a high-privileged attacker with local logon access to the host infrastructure where the application executes. Exploitation allows complete read access and write or delete control over critical Cash Management data, covering both confidentiality and integrity at a High impact level with no availability component. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Oracle Production Scheduling versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes a network-accessible HTTP endpoint in its Internal Operations component that can be abused by a low-privileged authenticated attacker to read all data accessible to the application. The impact is limited to confidentiality - no integrity or availability loss - but the scope covers 'complete access to all Oracle Production Scheduling accessible data,' which may include sensitive operational and supply-chain planning records. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Local information disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables an unauthenticated attacker with logon access to the underlying infrastructure to bypass application-level authentication controls and read a subset of accessible data. The attack vector is local (AV:L), meaning exploitation requires the attacker to already have operating-system-level access to the host running the product, significantly limiting the exposed population. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this vulnerability via its August 2026 Critical Patch Update.
Unauthorized data access and modification in Oracle Autonomous Health Framework's Cluster Health Analyzer component allows a low-privileged attacker with adjacency to the physical communication segment to fully compromise confidentiality and integrity of AHF data, with scope change enabling lateral impact on additional Oracle products. Affected versions span the 26.x release line through 26.5.2, disclosed in Oracle's August 2026 Critical Patch Update. No public exploit code has been identified at time of analysis, and the High attack complexity combined with the adjacent-only attack vector materially constrains real-world exploitability despite the 7.7 base score.
Integrity-bypassing authentication flaw in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated remote attackers to create, delete, or modify critical application data via HTTP, despite requiring high attack complexity to trigger. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms the attack is network-reachable without credentials but is gated behind difficult-to-replicate exploitation conditions. No active exploitation has been confirmed (no CISA KEV listing), and no public exploit code has been identified at time of analysis.
Full takeover of Oracle Autonomous Health Framework is achievable by an unauthenticated attacker positioned on the same physical or logical network segment as the affected host, exploiting a flaw in the Trace File Analyzer (TFA) component. Affected releases span multiple 26.x branches - 26 through 26.1.0, 26.2.0, 26.3.1, 26.5.0, and 26.5.2 - with successful exploitation yielding complete confidentiality, integrity, and availability compromise. No public exploit code has been identified and no CISA KEV listing is present at time of analysis, though the low attack complexity and absence of authentication requirements make exploitation straightforward for any attacker with adjacent network access.
Integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables a high-privileged local attacker to bypass security controls within the application's Security component, resulting in unauthorized creation, deletion, or modification of critical financial or planning data. Exploitation is tightly constrained by local infrastructure access, high privilege requirements, and high attack complexity, placing this vulnerability at meaningful risk only from insider threats or fully compromised privileged accounts. No public exploit or active exploitation has been identified at time of analysis.
Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable by a highly privileged local attacker through a difficult-to-exploit flaw in the Install component. The CVSS vector (AV:L/AC:H/PR:H) confirms that while the impact is severe - achieving complete confidentiality, integrity, and availability compromise - the attack prerequisites are restrictive, limiting realistic exposure. No public exploit code has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.
Local access exploitation in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated attacker with infrastructure logon to partially compromise data confidentiality and integrity, requiring human interaction to succeed. Tagged as an authentication bypass in the Security component, the flaw yields only limited read and write/insert/delete access to a subset of accessible data, with no availability impact. No public exploit or CISA KEV listing exists at time of analysis; the low CVSS score of 3.6 reflects the constrained impact and high exploitation complexity.
Unauthorized data access in Oracle Agile Engineering Data Management 6.2.1 is achievable by unauthenticated network attackers via HTTP through the Engineering Communication Interface component. The flaw - tagged as an authentication bypass - permits limited confidentiality and integrity compromise, allowing unauthorized read of a subset of accessible data and unauthorized update, insert, or delete operations on some data. No active exploitation has been confirmed (no CISA KEV listing), and the high attack complexity (AC:H) materially constrains real-world exploitation.
Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable through a vulnerability in its Install component, exploitable by a high-privileged attacker with local logon access to the host infrastructure. The CVSS 3.1 base score of 6.7 reflects the constrained attack prerequisites - local access and high privileges - yet successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Full system compromise of Oracle Agile Engineering Data Management 6.2.1 is possible through a flaw in the Engineering Communication Interface (ECI) component, but only under a confluence of highly restrictive conditions - local infrastructure access, high privileges, high attack complexity, and mandatory third-party user interaction. The CVSS base score of 6.3 (Medium) reflects these compounding constraints despite a full confidentiality, integrity, and availability impact. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthorized data manipulation in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by unauthenticated network attackers via HTTP, contingent on a victim interacting with attacker-supplied content. The vulnerability resides in the Security component and is tagged as an authentication bypass, consistent with a CSRF-like mechanism where the attacker leverages a victim's session to insert, update, or delete accessible data. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the moderate CVSS score of 4.3 reflects the integrity-only, user-interaction-dependent nature of the attack.
Partial authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated remote attacker to read a limited subset of application data over HTTP without valid credentials. The attack is classified as difficult to exploit (AC:H), meaning specific conditions must be met for reliable success, and impact is confined to low-level confidentiality loss with no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows remote attackers via HTTP to perform unauthorized insert, update, or delete operations on accessible data without credentials. The vulnerability resides in the Security component of this enterprise performance management suite and is classified as easily exploitable per Oracle's advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass tag and PR:N CVSS vector confirm no credential barrier exists for exploitation.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a remote unauthenticated attacker to compromise data confidentiality and integrity via a network-delivered HTTP attack that requires victim interaction. Successful exploitation yields complete read access to all data accessible by the Calculation Manager and limited write capability (insert, update, delete) against a subset of that data. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the tagging of this vulnerability as an Authentication Bypass in the Security component, combined with the high confidentiality impact, makes it a meaningful risk for organizations running Oracle Hyperion environments.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 is achievable by an unauthenticated attacker physically co-located on the same network segment as the affected host. The Security and Authentication component contains an easily exploitable flaw - CVSS AC:L and PR:N confirm no elevated privileges or complexity are required once adjacent network access is established. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the Oracle Reports Developer instance. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 is achievable by an unauthenticated attacker present on the same physical network segment as the host running the software. The vulnerability resides in the Security and Authentication component of this Oracle Fusion Middleware product, meaning the mechanism meant to enforce access control can be bypassed without credentials. With a CVSS 3.1 score of 8.8, the impact spans complete confidentiality, integrity, and availability compromise; no public exploit or CISA KEV listing has been identified at time of analysis.
Full compromise of Oracle Reports Developer 12.2.1.19.0 is achievable by an unauthenticated attacker who has access to the same physical or logical network segment as the host running the software. The flaw resides in the Security and Authentication component of this Oracle Fusion Middleware product, and successful exploitation yields complete confidentiality, integrity, and availability impact - effectively a full system takeover. No public exploit or CISA KEV listing exists at time of analysis, but the combination of no required privileges, no user interaction, and a low-complexity attack makes this a credible threat within the adjacent network boundary.
Partial information disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to read a subset of application data via HTTP under high-complexity conditions. The vulnerability resides in the Security component and is tagged as an authentication bypass, suggesting insufficient authorization enforcement rather than a full credential bypass. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Unauthorized read access to a subset of Oracle Hyperion Calculation Manager 11.2.25.0.000 data is achievable by an unauthenticated attacker who has gained proximity to the physical communication segment on which the software executes, exploiting a flaw in its Security component. The CVSS 3.1 score of 3.1 reflects a tightly constrained impact - confidentiality only, with no integrity or availability effects - combined with an adjacent-only network vector and high attack complexity. No public exploit code and no active exploitation have been identified at time of analysis.