Oracle
Monthly
Oracle Lease and Finance Management within Oracle E-Business Suite (versions 12.2.3-12.2.15) exposes its Lease Authoring component to exploitation by low-privileged, network-accessible attackers over HTTP, resulting in partial confidentiality loss, unauthorized data manipulation, and a partial denial of service. The vulnerability is classified as easily exploitable with no user interaction required, making it accessible to any authenticated low-privilege user who can reach the application over the network. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data disclosure in Oracle Self-Service Human Resources (E-Business Suite), Manager Self-Service component, affects versions 12.2.3 through 12.2.15. A low-privileged authenticated attacker with HTTP network access can exploit an authorization bypass to gain complete read access to all data within the Self-Service HR module - including sensitive employee and managerial records. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, but the low attack complexity and broad data exposure make patching via the July 2026 CPU a priority for organizations running Oracle EBS.
Oracle HRMS (US), the Internal Operations component within Oracle E-Business Suite versions 12.2.9 through 12.2.15, is exploitable by low-privileged users with local logon access to the host infrastructure. Successful exploitation enables a repeatable denial of service via process hang or crash, along with unauthorized read access to a subset of HR data and limited unauthorized data modification. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; Oracle issued a fix in the July 2026 Critical Patch Update.
Partial data compromise and denial of service in Oracle HRMS (UK) versions 12.2.3 through 12.2.15 allows low-privileged, network-authenticated attackers to perform unauthorized read, write, and partial disruption of HR data via HTTP. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is characterized by Oracle as 'easily exploitable,' lowering the practical barrier for authenticated insiders or compromised accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting or client-side injection in Oracle Contracts Integration (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows unauthenticated remote attackers to compromise victim sessions via crafted HTTP requests requiring user interaction. The CVSS scope-change indicator (S:C) and UI:R flag confirm the attack pivots through a victim's browser to affect a secondary security context, resulting in unauthorized read access to a subset of data and unauthorized write/insert/delete to accessible Contracts Integration data. No public exploit code has been identified at time of analysis, and a patch is available through Oracle's Critical Patch Update for July 2026.
Full takeover of Oracle Cost Management within E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a highly privileged, network-based attacker who can satisfy high attack complexity conditions over HTTP. Successful exploitation yields complete confidentiality, integrity, and availability impact - effectively handing an attacker full control of the Cost Planning component - despite the suppressed base score of 6.6 caused by the PR:H and AC:H barriers. Disclosed by Oracle's secalert team via the July 2026 Critical Patch Update, no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized data access in Oracle Advanced Benefits 12.2.15 can be achieved by any low-privileged authenticated attacker over HTTP, targeting the Internal Operations component of Oracle E-Business Suite. The flaw - tagged as an Authentication Bypass - permits complete read access to all data accessible within the module, including data classified as critical. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and absence of required user interaction make it straightforward to exploit once credentials are obtained.
Oracle EDI Gateway versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes an information disclosure vulnerability allowing low-privileged network-authenticated attackers to read a subset of EDI transaction data without proper authorization. Tagged as an authentication bypass, the flaw is exploitable over HTTP with low attack complexity and no user interaction required, suggesting an access-control deficiency that permits privilege escalation within the application layer rather than a full bypass of authentication. No public exploit code and no active exploitation have been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Oracle EDI Gateway versions 12.2.3 through 12.2.15 exposes an information disclosure vulnerability via HTTP that enables low-privileged authenticated network attackers to read a subset of EDI transaction data without proper authorization. The vulnerability is tagged 'Authentication Bypass' in threat intelligence sources, yet the CVSS vector assigns PR:L, suggesting the bypass operates within an authenticated session - likely circumventing object-level authorization controls rather than bypassing session authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world urgency moderate despite the vendor's characterization of the flaw as 'easily exploitable.'
Oracle Price Protection (Internal Operations component) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes a medium-severity flaw allowing low-privileged, network-accessible attackers to partially compromise data confidentiality, integrity, and availability via HTTP. The vulnerability is easily exploitable with no attack complexity, requiring only a valid low-privileged account, enabling unauthorized read, write/delete operations on a subset of Price Protection data, and the ability to cause partial denial of service. No public exploit code or active exploitation has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Limited unauthorized data read in Oracle EDI Gateway (E-Business Suite versions 12.2.3-12.2.15) requires a high-privileged attacker with local logon access to the underlying infrastructure, combined with difficult exploitation conditions, to access a subset of EDI data without authorization. The confidentiality impact is narrow and no integrity or availability impact is present. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the July 2026 Critical Patch Update.
Unauthorized data manipulation and partial denial of service affects the Calendar Synchronizations component of Oracle Common Applications Calendar in Oracle E-Business Suite versions 12.2.3 through 12.2.15. Low-privileged authenticated attackers with HTTP network access can read a subset of calendar data, insert or modify records, and cause partial service disruption - all without requiring user interaction. Oracle classified this as 'easily exploitable' in its July 2026 Critical Patch Update; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Unauthorized data disclosure in Oracle U.S. Federal Financials (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read a subset of sensitive financial data via HTTP. Versions 12.2.3 through 12.2.15 are confirmed affected. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate-severity information disclosure with no integrity or availability impact.
Oracle Bills of Material's Web Services component in E-Business Suite 12.2.3-12.2.15 exposes a medium-severity flaw allowing low-privileged authenticated attackers to compromise data confidentiality, integrity, and availability via HTTP. Exploitation yields unauthorized read access to a subset of Bills of Material data, unauthorized insert, update, or delete capability, and the ability to cause a partial denial of service against the module. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Partial compromise of Oracle Advanced Benefits (Self Service Benefits component) is achievable by any low-privileged, network-adjacent attacker over HTTP, affecting all E-Business Suite deployments on versions 12.2.4 through 12.2.15. Successful exploitation yields unauthorized read access to a subset of benefits data, unauthorized write/insert/delete capability against accessible records, and the ability to cause partial denial of service within the affected component. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog, though the low complexity and minimal privilege threshold make it accessible to a broad pool of internal threat actors.
Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) exposes a network-exploitable flaw in its Outlook Sync Win 32 component that allows low-privileged authenticated users to perform unauthorized data reads, writes, and cause a partial denial of service via HTTP. Oracle classified this as easily exploitable, with low attack complexity and no user interaction required beyond holding a valid low-level account. No public exploit identified at time of analysis and it does not appear in the CISA KEV catalog, but the low barrier to exploitation makes it a credible insider or compromised-credential threat for affected EBS deployments.
Oracle Proposals (component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated remote attackers over HTTP, enabling unauthorized read access to a subset of data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the Proposals component. Oracle disclosed this vulnerability in its July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is compromised by a low-privileged, network-accessible attacker via HTTP, yielding partial confidentiality, integrity, and availability impacts. Exploitation requires no user interaction, making it straightforward for any authenticated EBS user to abuse this flaw. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.
Oracle Marketing's Audience component, within Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits low-privileged authenticated network attackers to exploit the application over HTTP with low complexity. Successful exploitation yields unauthorized read access to a subset of marketing data, unauthorized insert/update/delete capability against that data, and the ability to cause a partial denial of service within the Oracle Marketing module. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Product Hub versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes a flaw in its Role Based Security component that allows a low-privileged, network-authenticated attacker to exceed their authorized data access via HTTP. Successful exploitation yields unauthorized read access to a subset of product catalog data, unauthorized insert, update, or delete operations on accessible records, and the ability to cause partial denial of service within the Product Hub module. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.
Oracle Product Hub's Item Catalog component in E-Business Suite versions 12.2.3 through 12.2.15 exposes an easily exploitable flaw allowing low-privileged, authenticated HTTP network attackers to compromise item master data. Successful exploitation yields unauthorized read access to a subset of Product Hub data, unauthorized data modification or deletion, and partial denial of service against the Product Hub component. No public exploit identified at time of analysis, and Oracle classified this as 'easily exploitable' in its July 2026 Critical Patch Update.
Oracle Product Workbench's WebUI component within E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated attackers reachable over HTTP to perform unauthorized data reads, inserts, updates, and deletions against accessible product data, and to cause partial denial of service. Oracle's CPU July 2026 advisory characterizes the vulnerability as 'easily exploitable,' indicating a low-complexity attack path once valid low-level credentials are obtained. No public exploit code or CISA KEV listing has been identified at time of analysis, placing current exploitation status as unconfirmed.
Partial data compromise and denial of service in Oracle Supply Chain Globalization (Oracle E-Business Suite) allows low-privileged authenticated attackers over HTTP to perform unauthorized read, write, and partial availability impacts against the Copy Inventory Organization component. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the E-Business Suite 12.2 release train. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of a credible but not actively weaponized medium-severity vulnerability.
Partial authorization bypass in Oracle Call Center Technology (E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read a subset of sensitive CCT data and perform unauthorized insert, update, or delete operations against that data over HTTP. The RDBMS and UI component fails to enforce access boundaries for authenticated sessions, exposing data integrity and partial confidentiality. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the Oracle Security Alert tag of 'Authentication Bypass' warrants prompt patching in internet-accessible deployments.
Oracle Scripting's Scripting Admin component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is exploitable by low-privileged, network-authenticated attackers over HTTP, enabling unauthorized read and write access to accessible Scripting data. Tagged as an Authentication Bypass, this flaw requires only a valid low-privilege account and no user interaction, making the realistic threat surface broader than the medium CVSS score alone suggests for large enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Oracle July 2026 Critical Patch Update addresses this issue.
Unauthenticated remote exploitation of Oracle Teleservice (E-Business Suite versions 12.2.3 through 12.2.15) via HTTP allows attackers to read a subset of accessible service data and perform unauthorized insert, update, or delete operations against Teleservice records through the Service Diagnostics Scripts component. The vulnerability is tagged as an authentication bypass, indicating the diagnostic scripting interface fails to enforce access controls against unauthenticated callers. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though Oracle's own advisory classifies this as 'easily exploitable,' elevating operational priority for internet-facing EBS deployments.
Unauthorized data access in Oracle Knowledge Management (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged attacker over HTTP without user interaction. Exploitation allows unauthorized read access to a subset of Knowledge Management data and unauthorized insert, update, or delete operations against accessible data records. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, though the 'Authentication Bypass' tag warrants scrutiny given the CVSS PR:L rating.
Unauthorized data access in the UK Payroll component of Oracle HRMS (UK) within Oracle E-Business Suite allows low-privileged, authenticated network attackers to read and manipulate payroll records beyond their intended authorization level. Affected versions span 12.2.3 through 12.2.15 and the attack path requires only HTTP access with no user interaction. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Unauthorized data access and modification in Oracle iSupport's Call Back component exposes versions 12.2.3 through 12.2.15 of Oracle E-Business Suite to low-privileged network-based attack. Authenticated attackers with only basic network access via HTTP can bypass authorization controls - consistent with the 'Authentication Bypass' tag despite the PR:L vector - to read a subset of iSupport data and perform unauthorized insert, update, or delete operations. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low attack complexity and absence of user-interaction requirements make it straightforward to exploit once credentials are obtained.
Oracle Advanced Inbound Telephony (versions 12.2.3 through 12.2.15) within Oracle E-Business Suite exposes a medium-severity network-exploitable flaw in its Servers component that allows low-privileged authenticated attackers to perform unauthorized data reads, data manipulation, and partial denial of service via HTTP. Disclosed as part of Oracle's Critical Patch Update for July 2026 and tracked under ENISA EUVD-2026-47445, the vulnerability carries a CVSS 3.1 base score of 6.3, reflecting its low complexity and absence of required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad affected version range make it a meaningful risk for organizations running unpatched Oracle E-Business Suite deployments.
Unauthorized data access and modification in Oracle HRMS (New Zealand) 12.2.3-12.2.15 exposes the New Zealand Payroll component to low-privileged network attackers over HTTP. Exploiting this flaw, a low-privileged authenticated user can read a subset of HRMS payroll data and perform unauthorized insert, update, or delete operations on accessible records - consistent with an authorization bypass within the application layer. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; EPSS data was not provided in source intelligence.
Oracle HRMS (Republic of Korea) versions 12.2.3 through 12.2.15 exposes a network-accessible flaw in the Korean Payroll component that allows unauthenticated attackers to read a subset of HR data and perform unauthorized insert, update, or delete operations on payroll records. Exploitation requires victim-side human interaction, consistent with a client-side attack pattern (e.g., CSRF or reflected XSS) that bypasses access controls - corroborated by the 'Authentication Bypass' intelligence tag. No public exploit code and no CISA KEV listing have been identified at time of analysis; the Oracle CPU July 2026 advisory is the authoritative remediation source.
Cross-site or session-riding exploit in Oracle HRMS (Japanese) - specifically the Oracle Payroll Japanese component within Oracle E-Business Suite versions 12.2.3 through 12.2.15 - allows unauthenticated remote attackers to manipulate HR and payroll data by deceiving an authenticated user into triggering a malicious HTTPS request. The attack results in unauthorized read access to a subset of HR data and unauthorized insert, update, or delete operations against Oracle HRMS (Japanese) accessible records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated-yet-user-interaction-required attack pattern and Authentication Bypass tag strongly suggest a client-side vector such as CSRF or reflected XSS targeting active user sessions.
Unauthorized data access in Oracle HRMS (Hong Kong), a component of Oracle E-Business Suite, exposes payroll records to low-privileged network attackers via HTTP. Affected versions 12.2.13 through 12.2.15 allow an authenticated low-privileged user to read a subset of restricted payroll data and perform unauthorized insert, update, or delete operations against accessible Hong Kong Payroll data. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible insider or compromised-credential risk for affected tenants.
Unauthorized payroll data exposure in Oracle E-Business Suite's HRMS (Australia) Payroll component allows a low-privileged, network-authenticated attacker to access all HR and payroll data accessible to the application. Affecting versions 12.2.3 through 12.2.15, Oracle classifies this as 'easily exploitable' in the July 2026 Critical Patch Update, requiring only low user privileges over HTTP with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the confidentiality impact against sensitive payroll records elevates practical priority for affected Australian EBS deployments.
Unauthorized data access in Oracle Payroll (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to read all Payroll-accessible data over HTTP. Tagged by intelligence sources as an Authentication Bypass, this flaw enables a user with basic EBS credentials to exceed their authorization and access sensitive payroll records - including salary, tax, and banking information - belonging to the entire organization. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this a practical insider and credential-theft risk for any enterprise running affected EBS versions.
Unauthorized data disclosure in Oracle Learning Management (E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to access critical or complete LMS data via the Import and Export component over HTTP. Tagged as an Authentication Bypass, the flaw enables privilege escalation beyond the attacker's granted access level, resulting in full confidentiality compromise of all Learning Management accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network vector make this straightforward to exploit once credentials are obtained.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite exposes an unauthenticated SMTP-based attack path allowing partial data manipulation and partial denial of service. Versions 12.2.3 through 12.2.15 are confirmed affected per Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and Oracle rates this difficult to exploit (AC:H), placing the practical risk below the moderate CVSS 4.8 score for most organizations.
Unauthorized data access and modification in Oracle Item Master (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by any low-privileged authenticated attacker over HTTP, with no user interaction required. The vulnerability resides in the iSet-up component and enables an attacker to read a subset of Item Master data and perform unauthorized inserts, updates, or deletes beyond their intended authorization scope. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; however, the 'Authentication Bypass' tag suggests an authorization boundary failure that could be straightforward to exploit once an attacker holds any valid account.
Client-side injection in Oracle Banking Origination 14.5.0.16.0's Configuration component allows unauthenticated remote attackers over HTTP to read a subset of accessible banking origination data and perform unauthorized data modifications when a legitimate user interacts with a crafted payload. The CVSS scope change (S:C) confirms exploitation can cascade beyond the primary application into other Oracle Financial Services components sharing the same deployment context. Disclosed in Oracle's Critical Patch Update July 2026 with no confirmed active exploitation or public exploit code at time of analysis.
Confidentiality and integrity compromise in Oracle Security Service 12.2.1.4.0 (Oracle SSL API component within Oracle Fusion Middleware) allows a low-privileged, network-connected attacker to gain unauthorized read and write access to critical data managed by the service over TLS. Tagged as an Authentication Bypass by ENISA EUVD (EUVD-2026-47416) and reported by Oracle's security team via the July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 6.4 due to high attack complexity and mandatory human interaction, significantly constraining real-world exploitability. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Payroll within Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 is exploitable by low-privileged authenticated network attackers via HTTP, enabling unauthorized read, write, and partial denial-of-service against payroll data. Oracle's own advisory classifies this as 'easily exploitable,' indicating low attack complexity for any valid EBS user with HTTP reachability. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, placing this as a moderate real-world priority requiring prompt patching for exposed EBS deployments.
Partial confidentiality exposure in Oracle HRMS (UK)'s UK Payroll component allows a network-adjacent, high-privileged attacker to read a limited subset of HRMS data under difficult exploitation conditions. Affecting E-Business Suite versions 12.2.3 through 12.2.15, this low-severity (CVSS 2.2) vulnerability is tagged as an authentication bypass, suggesting an authorization control weakness within an already-authenticated session rather than a full unauthenticated bypass - consistent with the PR:H and AC:H vector. No public exploit code exists and it is not listed in the CISA KEV catalog, placing real-world risk at the lower end of the spectrum.
Oracle Labor Distribution (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 exposes an authorization bypass in its Internal Operations component, enabling a low-privileged authenticated attacker with network access to read a subset of labor distribution data and perform unauthorized insert, update, or delete operations. The vulnerability is classified as 'easily exploitable' by Oracle with a CVSS 3.1 score of 5.4 (Medium), reflecting low attack complexity and no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; remediation is available via Oracle's July 2026 Critical Patch Update.
Denial-of-service in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged network attacker to cause a complete hang or repeatedly crash the Core component via TCP, fully disrupting availability. The vulnerability is rated CVSS 6.5 (Medium) with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis; this appears to be a vendor-disclosed issue addressed in the Oracle Critical Patch Update for July 2026.
Denial-of-service in Oracle Agile Engineering Data Management 6.2.1 allows any low-privileged network user to crash or hang the application via crafted TCP traffic to the Core component. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms this is easily exploitable with minimal prerequisites, resulting in complete availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity raises automated exploitation concerns.
Denial of service in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged network attacker to crash or hang the application via a crafted HTTP request targeting the Install component. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium), with high attack complexity tempering the real-world risk. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Local integrity and availability compromise in Oracle Agile Engineering Data Management 6.2.1's Document Management component enables low-privileged local users to perform unauthorized data manipulation and trigger partial denial-of-service conditions. Oracle classifies this as 'easily exploitable' given low attack complexity, though the local infrastructure access requirement significantly constrains the realistic attacker pool. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the CVSS 4.4 Medium score reflects the bounded impact ceiling - partial integrity and availability loss only, with no confidentiality exposure.
Oracle Agile Engineering Data Management 6.2.1 contains an authentication bypass in its Install component, reachable over HTTP by low-privileged network attackers, that enables complete unauthorized read and write access to all application data. Exploitation requires both high attack complexity and active human interaction from a victim - limiting opportunistic exploitation - but successful attacks yield critical confidentiality and integrity compromise with no availability impact. No public exploit has been identified at time of analysis; Oracle addressed this in the Critical Patch Update for July 2026.
Unauthorized critical data disclosure in Oracle Agile Engineering Data Management 6.2.1 is achievable by a low-privileged attacker with local infrastructure access, exploiting a weakness in the Install component to bypass authentication controls and reach protected data. The scope change (S:C) means successful exploitation can cascade into unauthorized access across additional Oracle Supply Chain products beyond EDM itself. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and absence of user interaction make this straightforward to exploit given local footing.
Partial denial-of-service exposure in Oracle Agile Engineering Data Management 6.2.1 allows a local, low-privileged attacker to degrade availability of the Install component when a separate user interacts with the system. The CVSS 3.1 base score of 2.8 reflects the constrained impact: only availability is affected, no confidentiality or integrity loss occurs, and exploitation is bounded by local access and mandatory human interaction from a third party. No public exploit code or active exploitation has been identified at time of analysis.
Full system takeover is achievable in Oracle Agile Product Lifecycle Management for Process 6.2.4 via the Data Import component, exploitable by a high-privileged attacker with local infrastructure access. Oracle classifies this as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability despite the constrained attack surface. No public exploit code or CISA KEV listing exists at time of analysis, limiting immediate real-world risk to insider threat and post-compromise escalation scenarios.
Oracle Product Lifecycle Analytics 3.6.1 exposes a network-exploitable flaw in its Installation Issues component, allowing a high-privileged attacker to achieve full confidentiality and integrity compromise of all accessible application data alongside partial service disruption via HTTP. The 'Installation Issues' component designation and the 'Authentication Bypass' intelligence tag together suggest the flaw may reside in insecure post-installation artifacts, exposed setup endpoints, or improperly secured administrative interfaces left accessible after deployment. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Local privilege escalation via authentication bypass in Oracle Agile PLM 9.3.6 allows a low-privileged attacker with existing local infrastructure access to gain unauthorized read access to all PLM-accessible data, with confirmed scope change effects that may extend compromise to additional Oracle supply chain products. The CVSS vector (AV:L/PR:L/S:C/C:H) confirms exploitation is constrained to local infrastructure foothold but produces high-impact confidentiality loss across trust boundaries. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes low-privileged authenticated users to unauthorized read and write access on platform data via HTTP. Disclosed as part of Oracle's Critical Patch Update for July 2026 and tagged as an authentication bypass issue, the vulnerability enables a low-privileged network attacker to read a subset of data and perform unauthorized insert, update, or delete operations within the Experience Manager component. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial-of-service via the Content Acquisition System component in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows any local user already logged onto the host infrastructure to crash or hang the application without requiring elevated OS privileges. Disclosed in Oracle's July 2026 Critical Patch Update, the CVSS 3.1 score of 6.2 (Medium) reflects the local-only attack vector, which substantially constrains exposure to insider threats or attackers who have already achieved OS-level foothold. No public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a network-connected, high-privileged attacker to cause a complete hang or repeatable crash of the database server by targeting the Server: Optimizer component. Oracle classifies the vulnerability as 'easily exploitable' once credentials are obtained, though the high-privilege prerequisite (PR:H) substantially constrains real-world exposure. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Full system takeover of Oracle Communications Convergent Charging Controller (Prov IF component) is achievable by a high-privileged network attacker exploiting a difficult-to-trigger flaw over HTTP in versions 15.0.0.0.0 and 15.2.0.0.0. The attack requires human interaction from a third party in addition to prior high-privilege access, making opportunistic exploitation unlikely. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis, though the complete confidentiality, integrity, and availability impact warrants patching within standard enterprise patch cycles.
Authentication bypass in Oracle Commerce Platform 11.4.0 exposes full data confidentiality and integrity through the Dynamo Application Framework component, allowing a low-privileged network attacker to read or modify all platform data via HTTP. The CVSS 3.1 score of 6.8 reflects meaningful exploitation complexity (AC:H) and the requirement for at least some authenticated access (PR:L), limiting opportunistic mass exploitation. No public exploit code or active exploitation has been identified at time of analysis, and remediation is available via Oracle's July 2026 Critical Patch Update.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network-authenticated attacker to cause a complete, repeatably triggerable crash or hang of the database server via the Optimizer component. Disclosed in Oracle's Critical Patch Update for July 2026, the vulnerability carries a CVSS 3.1 score of 4.9 (Medium), with the moderate score driven entirely by the high privilege requirement (PR:H) that constrains the attack surface to users holding elevated database credentials. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Oracle HRMS (US) Internal Operations component in E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible flaw that allows a low-privileged authenticated attacker to read a subset of HRMS data and cause partial denial of service via HTTP under high-complexity conditions. Disclosed by Oracle via the July 2026 Critical Patch Update (CPU), the vulnerability carries a CVSS 3.1 score of 4.2 (Medium), with no public exploit and no active exploitation confirmed at time of analysis. The high attack complexity (AC:H) materially constrains real-world exploitability despite the network-accessible attack vector.
Unauthorized data exfiltration in Oracle HRMS (UK), a component of Oracle E-Business Suite, exposes complete HR records to low-privileged network attackers via a scope-changing vulnerability in the Internal Operations component. Versions 12.2.8 through 12.2.15 are affected, and successful exploitation can breach data beyond the immediate HRMS (UK) boundary, impacting additional E-Business Suite products. Tagged as an authentication bypass by EUVD intelligence, the attack requires HTTP network access and low privilege credentials but no user interaction, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Order Management's Product Diagnostic Tools component (E-Business Suite 12.2.3-12.2.15) allows a low-privileged network attacker to read all data accessible to the application over HTTP with no user interaction required. The 'Authentication Bypass' tag suggests the diagnostic interface fails to enforce proper authorization boundaries, enabling a minimally privileged account to exceed its intended data access scope. No public exploit has been identified at time of analysis, but the low attack complexity and ERP-grade data sensitivity - order records, customer PII, financial data - elevate business impact well beyond the moderate CVSS 6.5 score.
Local privilege escalation via authentication bypass in Oracle Application Object Library (AOL) Core component exposes critical data across Oracle E-Business Suite 12.2.3 through 12.2.15. A low-privileged attacker with local system access can bypass authentication controls within AOL Core, gaining unauthorized read access to critical or complete AOL-accessible data - and, due to a confirmed scope change, potentially compromising additional integrated EBS products beyond AOL itself. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Denial of service in Oracle MySQL Server and MySQL Cluster's JSON component allows a low-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, though the low attack complexity and low privilege requirement make it straightforward to trigger once database credentials are obtained.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows any low-privileged, network-authenticated attacker to cause a complete, repeatable crash or hang of the database server via the GIS (Geographic Information System) component. Oracle confirmed this in the July 2026 Critical Patch Update with a CVSS 3.1 score of 6.5. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized read access to a subset of student records data is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component over HTTP. An unauthenticated network attacker exploiting an authentication bypass condition (tagged explicitly by the reporter) can retrieve confidential academic data without credentials, though the high attack complexity constrains opportunistic mass exploitation. No public exploit code or active exploitation has been identified; however, even partial disclosure of student records carries regulatory significance under FERPA regardless of the low CVSS score of 3.7.
Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) enables an unauthenticated attacker positioned on the adjacent physical network segment to access critical application data and manipulate select records. The exploit is rated difficult due to adjacent-network positioning requirements and high attack complexity, yielding a moderate CVSS 5.9 score despite the high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, limiting immediate mass-exploitation risk.
Local authentication bypass in MySQL Server and MySQL Cluster's Pluggable Auth component allows an unauthenticated local attacker to perform unauthorized data modification under high-complexity conditions. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster across 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Impact is limited to low-severity integrity compromise - no confidentiality or availability impact - with no public exploit or CISA KEV listing identified at time of analysis.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged network attacker to repeatedly crash or hang the database server via a flaw in the Optimizer component. Oracle classifies this as 'easily exploitable' with network access required over multiple protocols, meaning any valid database account holder can trigger the condition without elevated permissions. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege abuse in Oracle GoldenGate's Libraries component allows low-privileged OS users on the GoldenGate host to read and modify a subset of GoldenGate-accessible data without proper authorization. Three major version branches are affected - 19.x, 21.x, and 23.x - covering a broad deployment window documented in Oracle's Critical Patch Update for July 2026. No public exploit or active exploitation has been identified at time of analysis; the moderate CVSS 4.4 score correctly reflects the local-only attack vector and constrained data impact.
Oracle Performance Management (E-Business Suite, Appraisals component, versions 12.2.3-12.2.15) exposes a network-accessible authorization bypass that allows low-privileged authenticated users to read and manipulate appraisal data beyond their intended access scope via HTTP. Tagged as an Authentication Bypass, the flaw enables partial confidentiality and integrity compromise against a widely-deployed enterprise ERP module. No public exploit code or CISA KEV listing has been identified at time of analysis; disclosure is tied to Oracle's CPU July 2026 advisory cycle.
Unauthorized access to critical data is achievable against MySQL Connector/J versions 9.7.0 and 9.7.1 via a network-accessible authentication bypass flaw requiring human interaction. Oracle classifies this as easily exploitable, meaning a network-positioned unauthenticated attacker can intercept or otherwise obtain complete access to all data flowing through the affected connector when a legitimate application initiates a database connection. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthorized data read in MySQL Server and MySQL Cluster's Performance Schema component exposes a subset of accessible data to highly privileged, network-connected attackers. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed as part of Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing are identified at time of analysis; the CVSS 2.7 score reflects the limited scope and elevated privilege bar.
Unauthorized data access in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker operating over HTTP to read a subset of HR data and perform unauthorized insert, update, or delete operations within the Regression Testing component. The vulnerability is rated CVSS 5.4 Medium with no availability impact, confined to confidentiality and integrity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the source intelligence warrants further investigation given its tension with the PR:L CVSS metric.
Oracle GoldenGate Libraries contain a local, high-complexity flaw affecting versions 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.2 that allows a high-privileged local attacker - with an additional required victim interaction - to gain complete read access to all GoldenGate-accessible data, partially manipulate data integrity, and cause a complete denial of service via hang or repeatable crash. Tagged as an authentication bypass by intelligence sources, the vulnerability likely allows an already-privileged operator to circumvent an internal GoldenGate security control within the Libraries component, elevating their effective access beyond their authorized scope. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Self-Service Human Resources within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes an exploitable authorization control weakness in its Internal Operations component, reachable over HTTP without requiring high privileges. A low-privileged authenticated attacker can perform unauthorized read, insert, update, and delete operations against a subset of HR data - impacting both confidentiality and data integrity. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this straightforward to exploit for any authenticated user.
PeopleSoft Enterprise FIN Engineering Argentina version 9.1 exposes a secondary authorization flaw in its Engineering component that enables a network-reachable high-privileged attacker to perform unauthorized read and limited write operations against accessible financial data via HTTP. The Oracle-provided CVSS 3.1 score of 3.3 (Low) reflects high attack complexity and high privilege prerequisites, substantially containing real-world risk. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the reporter-supplied 'Authentication Bypass' tag conflicts with the PR:H CVSS metric and warrants vendor clarification.
Partial denial of service in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 allows unauthenticated remote attackers to disrupt the Cash Management component via HTTP. The vulnerability is rated Medium (CVSS 5.3) with availability-only impact - confidentiality and integrity are unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Integrity compromise and partial denial-of-service in Oracle PeopleSoft Enterprise FIN General Ledger Argentina 9.1 allows a low-privileged, network-based attacker to create, delete, or modify critical financial data and partially disrupt service availability via HTTP. Exploitation is rated difficult (AC:H), and no confidentiality impact is indicated, suggesting the flaw is scoped to data-write and availability disruption within the Argentina General Ledger component. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by any low-privileged attacker with network HTTP access, requiring no user interaction. The 'Authentication Bypass' tag from EUVD suggests the flaw likely allows an authenticated user to circumvent authorization controls within the Install/Upgrade component, gaining read and write access to recruitment data beyond their assigned permissions. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low attack complexity makes this straightforward for any authenticated insider or compromised account.
Unauthorized data access in Oracle E-Business Suite Secure Enterprise Search versions 12.2.3 through 12.2.15 allows a low-privileged network attacker to read and modify data within the Search Integration Engine component via HTTP. Despite requiring a valid low-privilege account, the vulnerability is tagged as an Authentication Bypass, suggesting attackers can circumvent authorization controls within the search subsystem to access data beyond their permitted scope. No public exploit code or CISA KEV listing exists at time of analysis, and Oracle has addressed this in the July 2026 Critical Patch Update.
PeopleSoft Enterprise FIN eSettlements 9.2 exposes financial settlement data to unauthenticated network attackers via an HTTP-accessible authentication bypass, enabling limited unauthorized read access and write manipulation of settlement records. Carrying a CVSS 3.1 score of 4.8 with high attack complexity (AC:H), exploitation is not trivial and resists easy automation, but the financial nature of the affected data - electronic payments and settlement instructions - amplifies business risk well beyond the moderate numeric score. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept has been identified at the time of this analysis.
Partial authentication bypass in Oracle PeopleSoft Enterprise FIN Grants 9.2 exposes limited data read and write capabilities to unauthenticated network attackers over HTTP. Exploitation is rated difficult (AC:H), meaning the attacker must satisfy specific, unstated preconditions to succeed, constraining real-world risk despite the absence of authentication requirements. Impact is bounded: only a subset of Grants data is accessible for reading, and unauthorized inserts, updates, or deletes are limited to some accessible data - full database compromise is not implied. No public exploit code or active exploitation has been identified at time of analysis.
Complete denial-of-service in Oracle Solaris 11.4's Filesystems component allows any low-privileged local user to cause a kernel hang or repeated crash of the operating system. The attack requires only a valid low-privileged logon session and no special configuration, making it trivially repeatable once inside the system. No public exploit code has been identified at time of analysis, and this vulnerability has not been listed in CISA KEV.
Oracle Concurrent Processing within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a medium-severity flaw in its BI Publisher Integration component that allows a low-privileged, authenticated network attacker to compromise data integrity, read restricted data, and cause partial denial of service via HTTP. The vulnerability is described by Oracle as 'easily exploitable,' lowering the bar for abuse by any user holding a valid account. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, though its low attack complexity and no-UI-interaction requirements make it operationally straightforward once credentials are obtained.
Unauthorized data disclosure in Oracle Production Scheduling (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged network attacker to gain complete read access to all data within the application via a difficult-to-exploit flaw in the User Interface component. Tagged as an authentication bypass, the vulnerability suggests improper access control enforcement in the UI layer that permits privilege escalation beyond the attacker's normally granted permissions, enabling full confidentiality compromise of Production Scheduling data. No public exploit code or active exploitation has been identified; Oracle addressed this in the Critical Patch Update for July 2026.
Partial denial of service in Oracle Inventory Optimization (E-Business Suite versions 12.2.3 through 12.2.15) can be triggered by a low-privileged attacker over HTTP, causing degraded availability of the User Interface component. The vulnerability carries a CVSS 3.1 base score of 3.1, reflecting high attack complexity and limited impact scope. No public exploit code or active exploitation has been identified at time of analysis, and Oracle addressed this in the July 2026 Critical Patch Update.
Oracle Production Scheduling (E-Business Suite component) exposes an integrity-only vulnerability exploitable exclusively by high-privileged local attackers on the hosting infrastructure, across versions 12.2.3 through 12.2.15. Successful exploitation permits unauthorized write operations - insert, update, or delete - against a subset of the scheduling module's data, with no confidentiality or availability impact. No public exploit code exists and the vulnerability is not listed in CISA KEV; the extremely low CVSS score of 1.9 reflects the steep exploitation barrier imposed by local access and high privilege prerequisites.
Oracle Production Scheduling (versions 12.2.3 through 12.2.15) contains a high-privilege network-exploitable flaw in its Internal Operations component that allows authorized but potentially abusive HTTP requests to bypass internal controls and achieve unauthorized creation, deletion, or modification of critical data, with a documented scope change that can cascade impact into adjacent Oracle E-Business Suite products. The vulnerability is tagged as an Authentication Bypass by both the Oracle reporter (secalert_us@oracle.com) and ENISA EUVD-2026-47260, introducing meaningful ambiguity against the CVSS PR:H designation. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the standard CPU patching priority tier despite the scope change.
Oracle Lease and Finance Management within Oracle E-Business Suite (versions 12.2.3-12.2.15) exposes its Lease Authoring component to exploitation by low-privileged, network-accessible attackers over HTTP, resulting in partial confidentiality loss, unauthorized data manipulation, and a partial denial of service. The vulnerability is classified as easily exploitable with no user interaction required, making it accessible to any authenticated low-privilege user who can reach the application over the network. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data disclosure in Oracle Self-Service Human Resources (E-Business Suite), Manager Self-Service component, affects versions 12.2.3 through 12.2.15. A low-privileged authenticated attacker with HTTP network access can exploit an authorization bypass to gain complete read access to all data within the Self-Service HR module - including sensitive employee and managerial records. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, but the low attack complexity and broad data exposure make patching via the July 2026 CPU a priority for organizations running Oracle EBS.
Oracle HRMS (US), the Internal Operations component within Oracle E-Business Suite versions 12.2.9 through 12.2.15, is exploitable by low-privileged users with local logon access to the host infrastructure. Successful exploitation enables a repeatable denial of service via process hang or crash, along with unauthorized read access to a subset of HR data and limited unauthorized data modification. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; Oracle issued a fix in the July 2026 Critical Patch Update.
Partial data compromise and denial of service in Oracle HRMS (UK) versions 12.2.3 through 12.2.15 allows low-privileged, network-authenticated attackers to perform unauthorized read, write, and partial disruption of HR data via HTTP. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is characterized by Oracle as 'easily exploitable,' lowering the practical barrier for authenticated insiders or compromised accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting or client-side injection in Oracle Contracts Integration (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows unauthenticated remote attackers to compromise victim sessions via crafted HTTP requests requiring user interaction. The CVSS scope-change indicator (S:C) and UI:R flag confirm the attack pivots through a victim's browser to affect a secondary security context, resulting in unauthorized read access to a subset of data and unauthorized write/insert/delete to accessible Contracts Integration data. No public exploit code has been identified at time of analysis, and a patch is available through Oracle's Critical Patch Update for July 2026.
Full takeover of Oracle Cost Management within E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a highly privileged, network-based attacker who can satisfy high attack complexity conditions over HTTP. Successful exploitation yields complete confidentiality, integrity, and availability impact - effectively handing an attacker full control of the Cost Planning component - despite the suppressed base score of 6.6 caused by the PR:H and AC:H barriers. Disclosed by Oracle's secalert team via the July 2026 Critical Patch Update, no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized data access in Oracle Advanced Benefits 12.2.15 can be achieved by any low-privileged authenticated attacker over HTTP, targeting the Internal Operations component of Oracle E-Business Suite. The flaw - tagged as an Authentication Bypass - permits complete read access to all data accessible within the module, including data classified as critical. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and absence of required user interaction make it straightforward to exploit once credentials are obtained.
Oracle EDI Gateway versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes an information disclosure vulnerability allowing low-privileged network-authenticated attackers to read a subset of EDI transaction data without proper authorization. Tagged as an authentication bypass, the flaw is exploitable over HTTP with low attack complexity and no user interaction required, suggesting an access-control deficiency that permits privilege escalation within the application layer rather than a full bypass of authentication. No public exploit code and no active exploitation have been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Oracle EDI Gateway versions 12.2.3 through 12.2.15 exposes an information disclosure vulnerability via HTTP that enables low-privileged authenticated network attackers to read a subset of EDI transaction data without proper authorization. The vulnerability is tagged 'Authentication Bypass' in threat intelligence sources, yet the CVSS vector assigns PR:L, suggesting the bypass operates within an authenticated session - likely circumventing object-level authorization controls rather than bypassing session authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world urgency moderate despite the vendor's characterization of the flaw as 'easily exploitable.'
Oracle Price Protection (Internal Operations component) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes a medium-severity flaw allowing low-privileged, network-accessible attackers to partially compromise data confidentiality, integrity, and availability via HTTP. The vulnerability is easily exploitable with no attack complexity, requiring only a valid low-privileged account, enabling unauthorized read, write/delete operations on a subset of Price Protection data, and the ability to cause partial denial of service. No public exploit code or active exploitation has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Limited unauthorized data read in Oracle EDI Gateway (E-Business Suite versions 12.2.3-12.2.15) requires a high-privileged attacker with local logon access to the underlying infrastructure, combined with difficult exploitation conditions, to access a subset of EDI data without authorization. The confidentiality impact is narrow and no integrity or availability impact is present. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the July 2026 Critical Patch Update.
Unauthorized data manipulation and partial denial of service affects the Calendar Synchronizations component of Oracle Common Applications Calendar in Oracle E-Business Suite versions 12.2.3 through 12.2.15. Low-privileged authenticated attackers with HTTP network access can read a subset of calendar data, insert or modify records, and cause partial service disruption - all without requiring user interaction. Oracle classified this as 'easily exploitable' in its July 2026 Critical Patch Update; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Unauthorized data disclosure in Oracle U.S. Federal Financials (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read a subset of sensitive financial data via HTTP. Versions 12.2.3 through 12.2.15 are confirmed affected. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate-severity information disclosure with no integrity or availability impact.
Oracle Bills of Material's Web Services component in E-Business Suite 12.2.3-12.2.15 exposes a medium-severity flaw allowing low-privileged authenticated attackers to compromise data confidentiality, integrity, and availability via HTTP. Exploitation yields unauthorized read access to a subset of Bills of Material data, unauthorized insert, update, or delete capability, and the ability to cause a partial denial of service against the module. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Partial compromise of Oracle Advanced Benefits (Self Service Benefits component) is achievable by any low-privileged, network-adjacent attacker over HTTP, affecting all E-Business Suite deployments on versions 12.2.4 through 12.2.15. Successful exploitation yields unauthorized read access to a subset of benefits data, unauthorized write/insert/delete capability against accessible records, and the ability to cause partial denial of service within the affected component. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog, though the low complexity and minimal privilege threshold make it accessible to a broad pool of internal threat actors.
Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) exposes a network-exploitable flaw in its Outlook Sync Win 32 component that allows low-privileged authenticated users to perform unauthorized data reads, writes, and cause a partial denial of service via HTTP. Oracle classified this as easily exploitable, with low attack complexity and no user interaction required beyond holding a valid low-level account. No public exploit identified at time of analysis and it does not appear in the CISA KEV catalog, but the low barrier to exploitation makes it a credible insider or compromised-credential threat for affected EBS deployments.
Oracle Proposals (component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated remote attackers over HTTP, enabling unauthorized read access to a subset of data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the Proposals component. Oracle disclosed this vulnerability in its July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is compromised by a low-privileged, network-accessible attacker via HTTP, yielding partial confidentiality, integrity, and availability impacts. Exploitation requires no user interaction, making it straightforward for any authenticated EBS user to abuse this flaw. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.
Oracle Marketing's Audience component, within Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits low-privileged authenticated network attackers to exploit the application over HTTP with low complexity. Successful exploitation yields unauthorized read access to a subset of marketing data, unauthorized insert/update/delete capability against that data, and the ability to cause a partial denial of service within the Oracle Marketing module. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Product Hub versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes a flaw in its Role Based Security component that allows a low-privileged, network-authenticated attacker to exceed their authorized data access via HTTP. Successful exploitation yields unauthorized read access to a subset of product catalog data, unauthorized insert, update, or delete operations on accessible records, and the ability to cause partial denial of service within the Product Hub module. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.
Oracle Product Hub's Item Catalog component in E-Business Suite versions 12.2.3 through 12.2.15 exposes an easily exploitable flaw allowing low-privileged, authenticated HTTP network attackers to compromise item master data. Successful exploitation yields unauthorized read access to a subset of Product Hub data, unauthorized data modification or deletion, and partial denial of service against the Product Hub component. No public exploit identified at time of analysis, and Oracle classified this as 'easily exploitable' in its July 2026 Critical Patch Update.
Oracle Product Workbench's WebUI component within E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated attackers reachable over HTTP to perform unauthorized data reads, inserts, updates, and deletions against accessible product data, and to cause partial denial of service. Oracle's CPU July 2026 advisory characterizes the vulnerability as 'easily exploitable,' indicating a low-complexity attack path once valid low-level credentials are obtained. No public exploit code or CISA KEV listing has been identified at time of analysis, placing current exploitation status as unconfirmed.
Partial data compromise and denial of service in Oracle Supply Chain Globalization (Oracle E-Business Suite) allows low-privileged authenticated attackers over HTTP to perform unauthorized read, write, and partial availability impacts against the Copy Inventory Organization component. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the E-Business Suite 12.2 release train. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of a credible but not actively weaponized medium-severity vulnerability.
Partial authorization bypass in Oracle Call Center Technology (E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read a subset of sensitive CCT data and perform unauthorized insert, update, or delete operations against that data over HTTP. The RDBMS and UI component fails to enforce access boundaries for authenticated sessions, exposing data integrity and partial confidentiality. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the Oracle Security Alert tag of 'Authentication Bypass' warrants prompt patching in internet-accessible deployments.
Oracle Scripting's Scripting Admin component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is exploitable by low-privileged, network-authenticated attackers over HTTP, enabling unauthorized read and write access to accessible Scripting data. Tagged as an Authentication Bypass, this flaw requires only a valid low-privilege account and no user interaction, making the realistic threat surface broader than the medium CVSS score alone suggests for large enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Oracle July 2026 Critical Patch Update addresses this issue.
Unauthenticated remote exploitation of Oracle Teleservice (E-Business Suite versions 12.2.3 through 12.2.15) via HTTP allows attackers to read a subset of accessible service data and perform unauthorized insert, update, or delete operations against Teleservice records through the Service Diagnostics Scripts component. The vulnerability is tagged as an authentication bypass, indicating the diagnostic scripting interface fails to enforce access controls against unauthenticated callers. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though Oracle's own advisory classifies this as 'easily exploitable,' elevating operational priority for internet-facing EBS deployments.
Unauthorized data access in Oracle Knowledge Management (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged attacker over HTTP without user interaction. Exploitation allows unauthorized read access to a subset of Knowledge Management data and unauthorized insert, update, or delete operations against accessible data records. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, though the 'Authentication Bypass' tag warrants scrutiny given the CVSS PR:L rating.
Unauthorized data access in the UK Payroll component of Oracle HRMS (UK) within Oracle E-Business Suite allows low-privileged, authenticated network attackers to read and manipulate payroll records beyond their intended authorization level. Affected versions span 12.2.3 through 12.2.15 and the attack path requires only HTTP access with no user interaction. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Unauthorized data access and modification in Oracle iSupport's Call Back component exposes versions 12.2.3 through 12.2.15 of Oracle E-Business Suite to low-privileged network-based attack. Authenticated attackers with only basic network access via HTTP can bypass authorization controls - consistent with the 'Authentication Bypass' tag despite the PR:L vector - to read a subset of iSupport data and perform unauthorized insert, update, or delete operations. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low attack complexity and absence of user-interaction requirements make it straightforward to exploit once credentials are obtained.
Oracle Advanced Inbound Telephony (versions 12.2.3 through 12.2.15) within Oracle E-Business Suite exposes a medium-severity network-exploitable flaw in its Servers component that allows low-privileged authenticated attackers to perform unauthorized data reads, data manipulation, and partial denial of service via HTTP. Disclosed as part of Oracle's Critical Patch Update for July 2026 and tracked under ENISA EUVD-2026-47445, the vulnerability carries a CVSS 3.1 base score of 6.3, reflecting its low complexity and absence of required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad affected version range make it a meaningful risk for organizations running unpatched Oracle E-Business Suite deployments.
Unauthorized data access and modification in Oracle HRMS (New Zealand) 12.2.3-12.2.15 exposes the New Zealand Payroll component to low-privileged network attackers over HTTP. Exploiting this flaw, a low-privileged authenticated user can read a subset of HRMS payroll data and perform unauthorized insert, update, or delete operations on accessible records - consistent with an authorization bypass within the application layer. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; EPSS data was not provided in source intelligence.
Oracle HRMS (Republic of Korea) versions 12.2.3 through 12.2.15 exposes a network-accessible flaw in the Korean Payroll component that allows unauthenticated attackers to read a subset of HR data and perform unauthorized insert, update, or delete operations on payroll records. Exploitation requires victim-side human interaction, consistent with a client-side attack pattern (e.g., CSRF or reflected XSS) that bypasses access controls - corroborated by the 'Authentication Bypass' intelligence tag. No public exploit code and no CISA KEV listing have been identified at time of analysis; the Oracle CPU July 2026 advisory is the authoritative remediation source.
Cross-site or session-riding exploit in Oracle HRMS (Japanese) - specifically the Oracle Payroll Japanese component within Oracle E-Business Suite versions 12.2.3 through 12.2.15 - allows unauthenticated remote attackers to manipulate HR and payroll data by deceiving an authenticated user into triggering a malicious HTTPS request. The attack results in unauthorized read access to a subset of HR data and unauthorized insert, update, or delete operations against Oracle HRMS (Japanese) accessible records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated-yet-user-interaction-required attack pattern and Authentication Bypass tag strongly suggest a client-side vector such as CSRF or reflected XSS targeting active user sessions.
Unauthorized data access in Oracle HRMS (Hong Kong), a component of Oracle E-Business Suite, exposes payroll records to low-privileged network attackers via HTTP. Affected versions 12.2.13 through 12.2.15 allow an authenticated low-privileged user to read a subset of restricted payroll data and perform unauthorized insert, update, or delete operations against accessible Hong Kong Payroll data. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible insider or compromised-credential risk for affected tenants.
Unauthorized payroll data exposure in Oracle E-Business Suite's HRMS (Australia) Payroll component allows a low-privileged, network-authenticated attacker to access all HR and payroll data accessible to the application. Affecting versions 12.2.3 through 12.2.15, Oracle classifies this as 'easily exploitable' in the July 2026 Critical Patch Update, requiring only low user privileges over HTTP with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the confidentiality impact against sensitive payroll records elevates practical priority for affected Australian EBS deployments.
Unauthorized data access in Oracle Payroll (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to read all Payroll-accessible data over HTTP. Tagged by intelligence sources as an Authentication Bypass, this flaw enables a user with basic EBS credentials to exceed their authorization and access sensitive payroll records - including salary, tax, and banking information - belonging to the entire organization. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this a practical insider and credential-theft risk for any enterprise running affected EBS versions.
Unauthorized data disclosure in Oracle Learning Management (E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to access critical or complete LMS data via the Import and Export component over HTTP. Tagged as an Authentication Bypass, the flaw enables privilege escalation beyond the attacker's granted access level, resulting in full confidentiality compromise of all Learning Management accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network vector make this straightforward to exploit once credentials are obtained.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite exposes an unauthenticated SMTP-based attack path allowing partial data manipulation and partial denial of service. Versions 12.2.3 through 12.2.15 are confirmed affected per Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and Oracle rates this difficult to exploit (AC:H), placing the practical risk below the moderate CVSS 4.8 score for most organizations.
Unauthorized data access and modification in Oracle Item Master (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by any low-privileged authenticated attacker over HTTP, with no user interaction required. The vulnerability resides in the iSet-up component and enables an attacker to read a subset of Item Master data and perform unauthorized inserts, updates, or deletes beyond their intended authorization scope. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; however, the 'Authentication Bypass' tag suggests an authorization boundary failure that could be straightforward to exploit once an attacker holds any valid account.
Client-side injection in Oracle Banking Origination 14.5.0.16.0's Configuration component allows unauthenticated remote attackers over HTTP to read a subset of accessible banking origination data and perform unauthorized data modifications when a legitimate user interacts with a crafted payload. The CVSS scope change (S:C) confirms exploitation can cascade beyond the primary application into other Oracle Financial Services components sharing the same deployment context. Disclosed in Oracle's Critical Patch Update July 2026 with no confirmed active exploitation or public exploit code at time of analysis.
Confidentiality and integrity compromise in Oracle Security Service 12.2.1.4.0 (Oracle SSL API component within Oracle Fusion Middleware) allows a low-privileged, network-connected attacker to gain unauthorized read and write access to critical data managed by the service over TLS. Tagged as an Authentication Bypass by ENISA EUVD (EUVD-2026-47416) and reported by Oracle's security team via the July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 6.4 due to high attack complexity and mandatory human interaction, significantly constraining real-world exploitability. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Payroll within Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 is exploitable by low-privileged authenticated network attackers via HTTP, enabling unauthorized read, write, and partial denial-of-service against payroll data. Oracle's own advisory classifies this as 'easily exploitable,' indicating low attack complexity for any valid EBS user with HTTP reachability. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, placing this as a moderate real-world priority requiring prompt patching for exposed EBS deployments.
Partial confidentiality exposure in Oracle HRMS (UK)'s UK Payroll component allows a network-adjacent, high-privileged attacker to read a limited subset of HRMS data under difficult exploitation conditions. Affecting E-Business Suite versions 12.2.3 through 12.2.15, this low-severity (CVSS 2.2) vulnerability is tagged as an authentication bypass, suggesting an authorization control weakness within an already-authenticated session rather than a full unauthenticated bypass - consistent with the PR:H and AC:H vector. No public exploit code exists and it is not listed in the CISA KEV catalog, placing real-world risk at the lower end of the spectrum.
Oracle Labor Distribution (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 exposes an authorization bypass in its Internal Operations component, enabling a low-privileged authenticated attacker with network access to read a subset of labor distribution data and perform unauthorized insert, update, or delete operations. The vulnerability is classified as 'easily exploitable' by Oracle with a CVSS 3.1 score of 5.4 (Medium), reflecting low attack complexity and no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; remediation is available via Oracle's July 2026 Critical Patch Update.
Denial-of-service in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged network attacker to cause a complete hang or repeatedly crash the Core component via TCP, fully disrupting availability. The vulnerability is rated CVSS 6.5 (Medium) with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis; this appears to be a vendor-disclosed issue addressed in the Oracle Critical Patch Update for July 2026.
Denial-of-service in Oracle Agile Engineering Data Management 6.2.1 allows any low-privileged network user to crash or hang the application via crafted TCP traffic to the Core component. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms this is easily exploitable with minimal prerequisites, resulting in complete availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity raises automated exploitation concerns.
Denial of service in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged network attacker to crash or hang the application via a crafted HTTP request targeting the Install component. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium), with high attack complexity tempering the real-world risk. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Local integrity and availability compromise in Oracle Agile Engineering Data Management 6.2.1's Document Management component enables low-privileged local users to perform unauthorized data manipulation and trigger partial denial-of-service conditions. Oracle classifies this as 'easily exploitable' given low attack complexity, though the local infrastructure access requirement significantly constrains the realistic attacker pool. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the CVSS 4.4 Medium score reflects the bounded impact ceiling - partial integrity and availability loss only, with no confidentiality exposure.
Oracle Agile Engineering Data Management 6.2.1 contains an authentication bypass in its Install component, reachable over HTTP by low-privileged network attackers, that enables complete unauthorized read and write access to all application data. Exploitation requires both high attack complexity and active human interaction from a victim - limiting opportunistic exploitation - but successful attacks yield critical confidentiality and integrity compromise with no availability impact. No public exploit has been identified at time of analysis; Oracle addressed this in the Critical Patch Update for July 2026.
Unauthorized critical data disclosure in Oracle Agile Engineering Data Management 6.2.1 is achievable by a low-privileged attacker with local infrastructure access, exploiting a weakness in the Install component to bypass authentication controls and reach protected data. The scope change (S:C) means successful exploitation can cascade into unauthorized access across additional Oracle Supply Chain products beyond EDM itself. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and absence of user interaction make this straightforward to exploit given local footing.
Partial denial-of-service exposure in Oracle Agile Engineering Data Management 6.2.1 allows a local, low-privileged attacker to degrade availability of the Install component when a separate user interacts with the system. The CVSS 3.1 base score of 2.8 reflects the constrained impact: only availability is affected, no confidentiality or integrity loss occurs, and exploitation is bounded by local access and mandatory human interaction from a third party. No public exploit code or active exploitation has been identified at time of analysis.
Full system takeover is achievable in Oracle Agile Product Lifecycle Management for Process 6.2.4 via the Data Import component, exploitable by a high-privileged attacker with local infrastructure access. Oracle classifies this as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability despite the constrained attack surface. No public exploit code or CISA KEV listing exists at time of analysis, limiting immediate real-world risk to insider threat and post-compromise escalation scenarios.
Oracle Product Lifecycle Analytics 3.6.1 exposes a network-exploitable flaw in its Installation Issues component, allowing a high-privileged attacker to achieve full confidentiality and integrity compromise of all accessible application data alongside partial service disruption via HTTP. The 'Installation Issues' component designation and the 'Authentication Bypass' intelligence tag together suggest the flaw may reside in insecure post-installation artifacts, exposed setup endpoints, or improperly secured administrative interfaces left accessible after deployment. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Local privilege escalation via authentication bypass in Oracle Agile PLM 9.3.6 allows a low-privileged attacker with existing local infrastructure access to gain unauthorized read access to all PLM-accessible data, with confirmed scope change effects that may extend compromise to additional Oracle supply chain products. The CVSS vector (AV:L/PR:L/S:C/C:H) confirms exploitation is constrained to local infrastructure foothold but produces high-impact confidentiality loss across trust boundaries. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes low-privileged authenticated users to unauthorized read and write access on platform data via HTTP. Disclosed as part of Oracle's Critical Patch Update for July 2026 and tagged as an authentication bypass issue, the vulnerability enables a low-privileged network attacker to read a subset of data and perform unauthorized insert, update, or delete operations within the Experience Manager component. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial-of-service via the Content Acquisition System component in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows any local user already logged onto the host infrastructure to crash or hang the application without requiring elevated OS privileges. Disclosed in Oracle's July 2026 Critical Patch Update, the CVSS 3.1 score of 6.2 (Medium) reflects the local-only attack vector, which substantially constrains exposure to insider threats or attackers who have already achieved OS-level foothold. No public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a network-connected, high-privileged attacker to cause a complete hang or repeatable crash of the database server by targeting the Server: Optimizer component. Oracle classifies the vulnerability as 'easily exploitable' once credentials are obtained, though the high-privilege prerequisite (PR:H) substantially constrains real-world exposure. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Full system takeover of Oracle Communications Convergent Charging Controller (Prov IF component) is achievable by a high-privileged network attacker exploiting a difficult-to-trigger flaw over HTTP in versions 15.0.0.0.0 and 15.2.0.0.0. The attack requires human interaction from a third party in addition to prior high-privilege access, making opportunistic exploitation unlikely. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis, though the complete confidentiality, integrity, and availability impact warrants patching within standard enterprise patch cycles.
Authentication bypass in Oracle Commerce Platform 11.4.0 exposes full data confidentiality and integrity through the Dynamo Application Framework component, allowing a low-privileged network attacker to read or modify all platform data via HTTP. The CVSS 3.1 score of 6.8 reflects meaningful exploitation complexity (AC:H) and the requirement for at least some authenticated access (PR:L), limiting opportunistic mass exploitation. No public exploit code or active exploitation has been identified at time of analysis, and remediation is available via Oracle's July 2026 Critical Patch Update.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network-authenticated attacker to cause a complete, repeatably triggerable crash or hang of the database server via the Optimizer component. Disclosed in Oracle's Critical Patch Update for July 2026, the vulnerability carries a CVSS 3.1 score of 4.9 (Medium), with the moderate score driven entirely by the high privilege requirement (PR:H) that constrains the attack surface to users holding elevated database credentials. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Oracle HRMS (US) Internal Operations component in E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible flaw that allows a low-privileged authenticated attacker to read a subset of HRMS data and cause partial denial of service via HTTP under high-complexity conditions. Disclosed by Oracle via the July 2026 Critical Patch Update (CPU), the vulnerability carries a CVSS 3.1 score of 4.2 (Medium), with no public exploit and no active exploitation confirmed at time of analysis. The high attack complexity (AC:H) materially constrains real-world exploitability despite the network-accessible attack vector.
Unauthorized data exfiltration in Oracle HRMS (UK), a component of Oracle E-Business Suite, exposes complete HR records to low-privileged network attackers via a scope-changing vulnerability in the Internal Operations component. Versions 12.2.8 through 12.2.15 are affected, and successful exploitation can breach data beyond the immediate HRMS (UK) boundary, impacting additional E-Business Suite products. Tagged as an authentication bypass by EUVD intelligence, the attack requires HTTP network access and low privilege credentials but no user interaction, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Order Management's Product Diagnostic Tools component (E-Business Suite 12.2.3-12.2.15) allows a low-privileged network attacker to read all data accessible to the application over HTTP with no user interaction required. The 'Authentication Bypass' tag suggests the diagnostic interface fails to enforce proper authorization boundaries, enabling a minimally privileged account to exceed its intended data access scope. No public exploit has been identified at time of analysis, but the low attack complexity and ERP-grade data sensitivity - order records, customer PII, financial data - elevate business impact well beyond the moderate CVSS 6.5 score.
Local privilege escalation via authentication bypass in Oracle Application Object Library (AOL) Core component exposes critical data across Oracle E-Business Suite 12.2.3 through 12.2.15. A low-privileged attacker with local system access can bypass authentication controls within AOL Core, gaining unauthorized read access to critical or complete AOL-accessible data - and, due to a confirmed scope change, potentially compromising additional integrated EBS products beyond AOL itself. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Denial of service in Oracle MySQL Server and MySQL Cluster's JSON component allows a low-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, though the low attack complexity and low privilege requirement make it straightforward to trigger once database credentials are obtained.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows any low-privileged, network-authenticated attacker to cause a complete, repeatable crash or hang of the database server via the GIS (Geographic Information System) component. Oracle confirmed this in the July 2026 Critical Patch Update with a CVSS 3.1 score of 6.5. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized read access to a subset of student records data is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component over HTTP. An unauthenticated network attacker exploiting an authentication bypass condition (tagged explicitly by the reporter) can retrieve confidential academic data without credentials, though the high attack complexity constrains opportunistic mass exploitation. No public exploit code or active exploitation has been identified; however, even partial disclosure of student records carries regulatory significance under FERPA regardless of the low CVSS score of 3.7.
Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) enables an unauthenticated attacker positioned on the adjacent physical network segment to access critical application data and manipulate select records. The exploit is rated difficult due to adjacent-network positioning requirements and high attack complexity, yielding a moderate CVSS 5.9 score despite the high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, limiting immediate mass-exploitation risk.
Local authentication bypass in MySQL Server and MySQL Cluster's Pluggable Auth component allows an unauthenticated local attacker to perform unauthorized data modification under high-complexity conditions. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster across 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Impact is limited to low-severity integrity compromise - no confidentiality or availability impact - with no public exploit or CISA KEV listing identified at time of analysis.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged network attacker to repeatedly crash or hang the database server via a flaw in the Optimizer component. Oracle classifies this as 'easily exploitable' with network access required over multiple protocols, meaning any valid database account holder can trigger the condition without elevated permissions. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege abuse in Oracle GoldenGate's Libraries component allows low-privileged OS users on the GoldenGate host to read and modify a subset of GoldenGate-accessible data without proper authorization. Three major version branches are affected - 19.x, 21.x, and 23.x - covering a broad deployment window documented in Oracle's Critical Patch Update for July 2026. No public exploit or active exploitation has been identified at time of analysis; the moderate CVSS 4.4 score correctly reflects the local-only attack vector and constrained data impact.
Oracle Performance Management (E-Business Suite, Appraisals component, versions 12.2.3-12.2.15) exposes a network-accessible authorization bypass that allows low-privileged authenticated users to read and manipulate appraisal data beyond their intended access scope via HTTP. Tagged as an Authentication Bypass, the flaw enables partial confidentiality and integrity compromise against a widely-deployed enterprise ERP module. No public exploit code or CISA KEV listing has been identified at time of analysis; disclosure is tied to Oracle's CPU July 2026 advisory cycle.
Unauthorized access to critical data is achievable against MySQL Connector/J versions 9.7.0 and 9.7.1 via a network-accessible authentication bypass flaw requiring human interaction. Oracle classifies this as easily exploitable, meaning a network-positioned unauthenticated attacker can intercept or otherwise obtain complete access to all data flowing through the affected connector when a legitimate application initiates a database connection. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthorized data read in MySQL Server and MySQL Cluster's Performance Schema component exposes a subset of accessible data to highly privileged, network-connected attackers. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed as part of Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing are identified at time of analysis; the CVSS 2.7 score reflects the limited scope and elevated privilege bar.
Unauthorized data access in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker operating over HTTP to read a subset of HR data and perform unauthorized insert, update, or delete operations within the Regression Testing component. The vulnerability is rated CVSS 5.4 Medium with no availability impact, confined to confidentiality and integrity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the source intelligence warrants further investigation given its tension with the PR:L CVSS metric.
Oracle GoldenGate Libraries contain a local, high-complexity flaw affecting versions 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.2 that allows a high-privileged local attacker - with an additional required victim interaction - to gain complete read access to all GoldenGate-accessible data, partially manipulate data integrity, and cause a complete denial of service via hang or repeatable crash. Tagged as an authentication bypass by intelligence sources, the vulnerability likely allows an already-privileged operator to circumvent an internal GoldenGate security control within the Libraries component, elevating their effective access beyond their authorized scope. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Self-Service Human Resources within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes an exploitable authorization control weakness in its Internal Operations component, reachable over HTTP without requiring high privileges. A low-privileged authenticated attacker can perform unauthorized read, insert, update, and delete operations against a subset of HR data - impacting both confidentiality and data integrity. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this straightforward to exploit for any authenticated user.
PeopleSoft Enterprise FIN Engineering Argentina version 9.1 exposes a secondary authorization flaw in its Engineering component that enables a network-reachable high-privileged attacker to perform unauthorized read and limited write operations against accessible financial data via HTTP. The Oracle-provided CVSS 3.1 score of 3.3 (Low) reflects high attack complexity and high privilege prerequisites, substantially containing real-world risk. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the reporter-supplied 'Authentication Bypass' tag conflicts with the PR:H CVSS metric and warrants vendor clarification.
Partial denial of service in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 allows unauthenticated remote attackers to disrupt the Cash Management component via HTTP. The vulnerability is rated Medium (CVSS 5.3) with availability-only impact - confidentiality and integrity are unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Integrity compromise and partial denial-of-service in Oracle PeopleSoft Enterprise FIN General Ledger Argentina 9.1 allows a low-privileged, network-based attacker to create, delete, or modify critical financial data and partially disrupt service availability via HTTP. Exploitation is rated difficult (AC:H), and no confidentiality impact is indicated, suggesting the flaw is scoped to data-write and availability disruption within the Argentina General Ledger component. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by any low-privileged attacker with network HTTP access, requiring no user interaction. The 'Authentication Bypass' tag from EUVD suggests the flaw likely allows an authenticated user to circumvent authorization controls within the Install/Upgrade component, gaining read and write access to recruitment data beyond their assigned permissions. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low attack complexity makes this straightforward for any authenticated insider or compromised account.
Unauthorized data access in Oracle E-Business Suite Secure Enterprise Search versions 12.2.3 through 12.2.15 allows a low-privileged network attacker to read and modify data within the Search Integration Engine component via HTTP. Despite requiring a valid low-privilege account, the vulnerability is tagged as an Authentication Bypass, suggesting attackers can circumvent authorization controls within the search subsystem to access data beyond their permitted scope. No public exploit code or CISA KEV listing exists at time of analysis, and Oracle has addressed this in the July 2026 Critical Patch Update.
PeopleSoft Enterprise FIN eSettlements 9.2 exposes financial settlement data to unauthenticated network attackers via an HTTP-accessible authentication bypass, enabling limited unauthorized read access and write manipulation of settlement records. Carrying a CVSS 3.1 score of 4.8 with high attack complexity (AC:H), exploitation is not trivial and resists easy automation, but the financial nature of the affected data - electronic payments and settlement instructions - amplifies business risk well beyond the moderate numeric score. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept has been identified at the time of this analysis.
Partial authentication bypass in Oracle PeopleSoft Enterprise FIN Grants 9.2 exposes limited data read and write capabilities to unauthenticated network attackers over HTTP. Exploitation is rated difficult (AC:H), meaning the attacker must satisfy specific, unstated preconditions to succeed, constraining real-world risk despite the absence of authentication requirements. Impact is bounded: only a subset of Grants data is accessible for reading, and unauthorized inserts, updates, or deletes are limited to some accessible data - full database compromise is not implied. No public exploit code or active exploitation has been identified at time of analysis.
Complete denial-of-service in Oracle Solaris 11.4's Filesystems component allows any low-privileged local user to cause a kernel hang or repeated crash of the operating system. The attack requires only a valid low-privileged logon session and no special configuration, making it trivially repeatable once inside the system. No public exploit code has been identified at time of analysis, and this vulnerability has not been listed in CISA KEV.
Oracle Concurrent Processing within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a medium-severity flaw in its BI Publisher Integration component that allows a low-privileged, authenticated network attacker to compromise data integrity, read restricted data, and cause partial denial of service via HTTP. The vulnerability is described by Oracle as 'easily exploitable,' lowering the bar for abuse by any user holding a valid account. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, though its low attack complexity and no-UI-interaction requirements make it operationally straightforward once credentials are obtained.
Unauthorized data disclosure in Oracle Production Scheduling (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged network attacker to gain complete read access to all data within the application via a difficult-to-exploit flaw in the User Interface component. Tagged as an authentication bypass, the vulnerability suggests improper access control enforcement in the UI layer that permits privilege escalation beyond the attacker's normally granted permissions, enabling full confidentiality compromise of Production Scheduling data. No public exploit code or active exploitation has been identified; Oracle addressed this in the Critical Patch Update for July 2026.
Partial denial of service in Oracle Inventory Optimization (E-Business Suite versions 12.2.3 through 12.2.15) can be triggered by a low-privileged attacker over HTTP, causing degraded availability of the User Interface component. The vulnerability carries a CVSS 3.1 base score of 3.1, reflecting high attack complexity and limited impact scope. No public exploit code or active exploitation has been identified at time of analysis, and Oracle addressed this in the July 2026 Critical Patch Update.
Oracle Production Scheduling (E-Business Suite component) exposes an integrity-only vulnerability exploitable exclusively by high-privileged local attackers on the hosting infrastructure, across versions 12.2.3 through 12.2.15. Successful exploitation permits unauthorized write operations - insert, update, or delete - against a subset of the scheduling module's data, with no confidentiality or availability impact. No public exploit code exists and the vulnerability is not listed in CISA KEV; the extremely low CVSS score of 1.9 reflects the steep exploitation barrier imposed by local access and high privilege prerequisites.
Oracle Production Scheduling (versions 12.2.3 through 12.2.15) contains a high-privilege network-exploitable flaw in its Internal Operations component that allows authorized but potentially abusive HTTP requests to bypass internal controls and achieve unauthorized creation, deletion, or modification of critical data, with a documented scope change that can cascade impact into adjacent Oracle E-Business Suite products. The vulnerability is tagged as an Authentication Bypass by both the Oracle reporter (secalert_us@oracle.com) and ENISA EUVD-2026-47260, introducing meaningful ambiguity against the CVSS PR:H designation. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the standard CPU patching priority tier despite the scope change.