Oracle
Monthly
Oracle Production Scheduling versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes its Internal Operations component to exploitation by high-privileged remote attackers over HTTP. Successful exploitation yields partial unauthorized read and write access to accessible data alongside a partial denial of service condition. No public exploit code or confirmed active exploitation has been identified at time of analysis; CVSS score of 4.7 (Medium) reflects the significant mitigation from the high-privilege prerequisite.
Oracle Production Scheduling versions 12.2.3 through 12.2.15 in Oracle E-Business Suite exposes a local exploitation path through its Internal Operations component, enabling a low-privileged attacker - given co-presence of a second interacting user - to achieve unauthorized creation, deletion, or modification of critical data with a scope change that can cascade impact to additional Oracle EBS products. Tagged as an authentication bypass by ENISA EUVD-2026-47258, the flaw is addressed in Oracle's Critical Patch Update for July 2026. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle HRMS (Norway) Payroll component within E-Business Suite versions 12.2.3 through 12.2.15 exposes limited confidentiality and integrity risks to high-privileged authenticated network attackers over HTTP. A successfully exploited vulnerability enables unauthorized read access to a subset of Norway Payroll data and unauthorized update, insert, or delete operations on accessible records within that module. No public exploit code has been identified at time of analysis, CISA KEV listing is absent, and the CVSS 3.1 base score of 3.8 (Low) reflects the constrained scope and high privilege bar required.
Oracle Inventory Management within Oracle E-Business Suite 12.2.3 through 12.2.15 is susceptible to a local, highly constrained partial denial-of-service condition affecting only availability. Exploitation requires an already highly privileged attacker with direct logon access to the underlying infrastructure hosting the application, combined with high attack complexity, making successful exploitation extremely difficult in practice. No public exploit code or active exploitation has been identified; the CVSS score of 1.9 reflects the minimal real-world risk posed by this vulnerability.
Full takeover of Oracle Inventory Management (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged attacker with local infrastructure access exploiting a flaw in the Internal Operations component. The CVSS vector (AV:L/AC:H/PR:H) places this firmly in the category of post-compromise or insider-threat scenarios rather than remote opportunistic attacks, yet the confirmed C:H/I:H/A:H impact means a successful exploitation yields complete control of the affected instance. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Unauthorized read access to Oracle Time and Labor data is achievable by unauthenticated remote attackers targeting the Internal Operations component via HTTP, affecting E-Business Suite versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass, the flaw allows network-based attackers to circumvent access controls without credentials, though the high attack complexity (AC:H) constrains reliable exploitation. Impact is confined to partial confidentiality loss - no integrity or availability impact - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Time and Labor (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 exposes a difficult-to-exploit flaw that allows a high-privileged, network-authenticated attacker operating over HTTP to gain complete read access to all Time and Labor data and limited write access (insert, update, delete), with scope change implications affecting additional Oracle EBS components. Tagged as an authentication bypass by ENISA EUVD intelligence, this conflict with the CVSS PR:H requirement warrants investigative scrutiny - it may indicate a secondary authorization bypass rather than a full authentication bypass. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Oracle Scripting within E-Business Suite (versions 12.2.3 through 12.2.15) allows a high-privileged attacker with HTTP network access to fully compromise data confidentiality and integrity in the Internal Operations component. Despite the PR:H CVSS rating, the 'Authentication Bypass' tag raises concern that effective access controls may be circumventable, potentially lowering the real exploitation barrier below what the score implies. No public exploit or CISA KEV listing has been identified at time of analysis, but the July 2026 Oracle CPU advisory confirms the issue and remediation is available.
Unauthorized data access and modification in Oracle Flow Manufacturing (component: Internal Operations) allows a low-privileged, network-adjacent attacker to compromise confidentiality and integrity of Flow Manufacturing data, with a scope change that may impact additional Oracle E-Business Suite products. Affected versions span 12.2.3 through 12.2.15, a wide deployment window covering over a decade of releases. The attack requires human interaction from a victim beyond the attacker, suggesting a social-engineering or UI-based exploitation vector. No public exploit code or CISA KEV listing has been identified at time of analysis; this is a medium-severity finding addressed in Oracle's July 2026 Critical Patch Update.
Cross-product data exposure in Oracle Transportation Execution (E-Business Suite 12.2.3-12.2.15) allows an authenticated low-privileged attacker over HTTP to read and modify a subset of Transportation data while also impacting additional EBS products due to a scope change. The attack requires victim interaction, suggesting a client-side injection vector (consistent with the 'Authentication Bypass' tag and scope change in the CVSS vector), where attacker-controlled content is rendered by another user. Disclosed in Oracle's July 2026 Critical Patch Update with no confirmed public exploit or CISA KEV listing at time of analysis.
Partial confidentiality exposure in Oracle HRMS (Ireland), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a network-based high-privileged attacker to read a limited subset of HRMS data via HTTP under high-complexity conditions. The impact is confined solely to confidentiality with no integrity or availability consequence, and the CVSS 3.1 base score of 2.2 reflects how constrained exploitation is in practice. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog. Notably, the intelligence tag 'Authentication Bypass' conflicts with the PR:H vector - this discrepancy warrants verification against the Oracle July 2026 CPU advisory.
Oracle Service Contracts (E-Business Suite versions 12.2.3-12.2.15) exposes a network-accessible integrity and confidentiality flaw in its Internal Operations component that allows a high-privileged, authenticated attacker to bypass authorization controls and gain unauthorized read or write access to all Service Contracts data. The attack is rated difficult to exploit and requires human interaction from a third party, substantially limiting opportunistic exploitation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, though the 'Authentication Bypass' tag signals a meaningful authorization control gap rather than a simple privilege escalation.
Unauthorized read access in Oracle Project Contracts (E-Business Suite component: Internal Operations) can be achieved by a low-privileged network attacker under high-complexity exploit conditions, exposing a subset of Project Contracts data. Affected versions span 12.2.3 through 12.2.15, as confirmed by Oracle Security Alerts via the July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, keeping real-world risk low despite the network-accessible attack surface and the notable 'Authentication Bypass' tag applied by ENISA EUVD.
Oracle Labor Distribution, an Internal Operations component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a high-privileged local attacker to compromise data integrity by creating, deleting, or modifying critical application data. Despite carrying an 'Authentication Bypass' tag in available intelligence, the CVSS vector (AV:L/AC:H/PR:H) constrains exploitation to actors who already possess elevated logon access to the underlying infrastructure - suggesting an internal authorization bypass rather than a full authentication circumvention. No public exploit code exists and no active exploitation has been identified; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Partial data integrity compromise in Oracle Labor Distribution (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged attacker with network access via HTTP to perform unauthorized insert, update, or delete operations on some accessible data within the product's Internal Operations component. The 'Authentication Bypass' tag in the intelligence data is notable but conflicts with the PR:L CVSS metric, suggesting this is more accurately an internal authorization bypass within an authenticated session rather than a full bypass of the login mechanism. No public exploit code exists and the vulnerability is not listed in CISA KEV; with a CVSS 3.1 score of 3.1 (Low) and AC:H, this represents a low-priority finding for most environments.
Partial denial-of-service in Oracle Labor Distribution (E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated attackers over HTTP under high-complexity conditions. The vulnerability affects only the availability of the Internal Operations component and yields only a partial availability impact, placing it firmly in the low-severity tier. No public exploit code exists and no active exploitation has been identified at the time of analysis.
Partial unauthorized read access in Oracle Public Sector Financials (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker over HTTP to read a limited subset of data they are not authorized to access. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector confirms authentication is required (PR:L), suggesting this is a partial authorization bypass or privilege boundary failure rather than a full authentication bypass. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized data manipulation in Oracle Public Sector Financials (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged authenticated attacker over HTTP targeting the Internal Operations component. Despite the 'Authentication Bypass' tag, the CVSS PR:L metric confirms initial credentials are required, suggesting the flaw represents a post-authentication authorization control bypass rather than a full authentication bypass. Impact is constrained to limited integrity loss - partial unauthorized insert, update, or delete of accessible data - with no confidentiality or availability impact, and no public exploit or active exploitation identified at time of analysis.
Unauthorized read access to a subset of procurement data is achievable in Oracle iSupplier Portal versions 12.2.3 through 12.2.15 via the Internal Operations component over HTTP, requiring a low-privileged account and difficult attack conditions. The intelligence tags classify this as an Authentication Bypass, creating tension with the official CVSS PR:L metric - if bypass is possible, the real-world requirement may be lower than the vector implies. No public exploit or active exploitation has been identified at time of analysis; this vulnerability is addressed in Oracle's July 2026 Critical Patch Update.
Unauthorized read access to Oracle iSupplier Portal (E-Business Suite versions 12.2.3-12.2.15) is possible for unauthenticated network attackers targeting the Internal Operations component over HTTP. The Authentication Bypass tag indicates the root cause involves inadequate access controls on internal HTTP endpoints, though exploitation is constrained by high attack complexity (AC:H), meaning specific conditions must be met. Impact is confined to partial confidentiality loss - no integrity or availability impact - with no public exploit code or active exploitation confirmed at time of analysis.
Oracle Property Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes a low-severity information disclosure flaw in the Internal Operations component that allows a highly privileged local attacker to read an unauthorized subset of Property Manager data under difficult exploitation conditions. The CVSS 3.1 score of 1.9 reflects the combined constraints of local infrastructure access, high privilege prerequisites, and high attack complexity, resulting in only partial confidentiality impact with no integrity or availability exposure. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; this is addressed in Oracle's Critical Patch Update for July 2026.
Unauthorized data access in Oracle Property Manager (E-Business Suite component: Internal Operations) allows low-privileged authenticated network attackers to read and manipulate property management data via HTTP. Affected versions span 12.2.3 through 12.2.15. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low attack complexity and broad version range make patching a near-term priority for EBS deployments.
Unauthorized data access and modification in Oracle Property Manager (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a network-authenticated low-privileged attacker via HTTP when a victim user interacts with attacker-controlled content, triggering a scope change that may impact additional EBS components. The vulnerability permits unauthorized read access to a subset of Property Manager data and unauthorized insert, update, or delete operations on accessible data. No public exploit code or CISA KEV listing is identified at time of analysis, but the 'Authentication Bypass' tag signals a potential authorization control failure beyond the base CVSS score suggests.
Partial compromise of Oracle Installed Base (Create Item Instance component) within Oracle E-Business Suite versions 12.2.4 through 12.2.15 is achievable by a low-privileged authenticated attacker over HTTP, subject to high attack complexity conditions. Successful exploitation results in unauthorized read access to a subset of Installed Base data, unauthorized data manipulation (insert/update/delete), and the ability to cause a partial denial of service. No public exploit or active exploitation has been identified at time of analysis; the Oracle CPU July 2026 advisory addresses this issue.
Unauthorized data disclosure in Oracle HCM Configuration Workbench (Rapid Implementation component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to gain complete access to all data accessible within the application via HTTP. Tagged as an Authentication Bypass, the flaw indicates that a legitimately authenticated user with minimal privileges can circumvent authorization controls to access sensitive HCM data well beyond their entitlement - covering employee PII, compensation structures, and organizational data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range spanning twelve supported minor releases elevate operational risk in large enterprise environments running externally accessible EBS instances.
Oracle Work in Process within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes low-privileged local attackers to unauthorized partial data disclosure and partial denial-of-service conditions via the Internal Operations component. Exploitation demands an existing OS-level logon to the host infrastructure and high attack complexity, making reliable exploitation difficult and opportunistic mass exploitation implausible. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, consistent with the vendor-assigned CVSS 3.1 score of 3.6 (Low).
Local privilege escalation via authentication bypass in Oracle Payroll (E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged user with infrastructure logon to gain complete unauthorized read access to all Oracle Payroll data, with scope change indicating potential lateral impact to additional EBS components. The CVSS vector confirms local attack vector with low complexity and no user interaction required, making this straightforwardly exploitable by any authenticated OS-level user on the Payroll host. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle's 'easily exploitable' language in the advisory warrants prompt patching for any internet-adjacent or multi-tenant EBS deployment.
Full takeover of Oracle HRMS (Norway) - the Norway Payroll component within Oracle E-Business Suite - is possible for a high-privileged attacker who can satisfy difficult exploitation conditions over HTTP across versions 12.2.8 through 12.2.15. Despite the complete C/I/A impact, the CVSS 3.1 score of 6.6 reflects real-world constraints: both high attack complexity (AC:H) and high privilege requirements (PR:H) must be met, making opportunistic mass exploitation unlikely. No public exploit code or CISA KEV listing has been identified at time of analysis, consistent with this being a targeted, insider-threat-class risk.
Limited local data disclosure in Oracle Work in Process (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows a high-privileged attacker with local infrastructure access to read a subset of accessible data under difficult exploitation conditions. The CVSS 3.1 base score of 1.9 reflects an extremely constrained attack surface - local vector, high complexity, and high privilege requirements combine to make this one of the lowest-severity issues addressed in the Oracle CPU July 2026 advisory. No public exploit identified at time of analysis, and no active exploitation has been reported.
Unauthorized read access to critical data in Oracle Work in Process (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-connected attacker exploiting an authentication bypass in the Internal Operations component via HTTP. The flaw is rated difficult to exploit (AC:H) and carries no integrity or availability impact, but successful exploitation grants complete access to all data accessible within the Work in Process module. No public exploit code or CISA KEV listing is associated with this vulnerability at time of analysis.
Oracle Order Management's Product Diagnostic Tools component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised by a low-privileged authenticated attacker over HTTP, resulting in unauthorized read and write access to Order Management data. The scope change (S:C in CVSS) indicates successful exploitation can cascade to impact additional Oracle EBS modules beyond Order Management itself. Tagged as an Authentication Bypass, no public exploit has been identified at time of analysis, though the patch is included in Oracle's CPU July 2026 release.
Unauthorized critical data disclosure in Oracle Order Management (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 stems from a flaw in the Product Diagnostic Tools component, exploitable by a high-privileged attacker over HTTP with no user interaction. Successful exploitation triggers a scope change, meaning the compromise can extend to additional Oracle products accessible through the Order Management context, resulting in complete access to all confidential data within that reach. No public exploit has been identified at time of analysis, and a fix is available via Oracle's Critical Patch Update for July 2026.
Oracle Order Entry in E-Business Suite versions 12.2.3 through 12.2.15 exposes a low-severity local privilege vulnerability in its Internal Operations component, allowing a high-privileged local attacker to perform unauthorized data manipulation and cause partial service disruption. The attack requires physical or logical access to the infrastructure hosting the application and an already-elevated account, significantly constraining real-world exploitability. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at the time of analysis.
Unauthorized data access and denial of service in Oracle Mobile Application Server's MWA Terminal Server component (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a high-privileged attacker over HTTP. Successful exploitation grants complete read access to all data accessible by the Mobile Application Server, limited write capability (insert/update/delete on some data), and the ability to cause a complete, repeatable denial-of-service crash. The 'Authentication Bypass' tag in the intelligence data conflicts with the PR:H CVSS metric, suggesting the flaw may allow an authenticated administrator to bypass authorization controls beyond their intended access scope. No public exploit or CISA KEV listing has been identified at time of analysis.
Critical data exposure and tampering in Oracle Citizen Interaction Center (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a high-privileged, network-authenticated attacker to achieve full read and write access to all application data via HTTP. Despite the 'Authentication Bypass' tag, the CVSS PR:H metric indicates exploitation requires an already-authenticated high-privilege account, suggesting an internal authorization control bypass rather than an unauthenticated entry point. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed through Oracle's Critical Patch Update for July 2026.
The Search component of Oracle Knowledge Management in E-Business Suite versions 12.2.5 through 12.2.15 allows unauthenticated network attackers to compromise data confidentiality and integrity when a victim user interacts with a crafted HTTP request, with successful exploitation producing a scope change that can impact additional E-Business Suite products. Disclosed via Oracle's July 2026 Critical Patch Update, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) scores 6.1 and is consistent with a reflected injection class - likely Cross-Site Scripting - given the combination of no-privilege network access, required human interaction, and cross-product scope change. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data disclosure in Oracle Price Protection (E-Business Suite versions 12.2.3 through 12.2.15) allows a network-adjacent, low-privileged attacker to gain complete read access to all pricing data accessible by the application. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass, suggesting that a legitimately authenticated but low-privileged session can circumvent authorization controls to reach confidential pricing records. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network reachability make it straightforward to exploit once credentials are obtained.
Oracle Interaction Blending within E-Business Suite exposes a network-accessible RMI interface flaw that allows a high-privileged attacker to partially compromise confidentiality, integrity, and availability of application data. Affected deployments span versions 12.2.3 through 12.2.15 of the Internal Operations component. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing it at low immediate operational priority despite the triple-impact scope.
Oracle iSupport versions 12.2.3 through 12.2.15 within Oracle E-Business Suite contain a vulnerability in the Internal Operations component that allows a highly privileged network attacker to fully compromise the affected application via HTTP. Successful exploitation results in complete confidentiality, integrity, and availability impact - described by Oracle as a full takeover of Oracle iSupport. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; disclosure occurred through Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle iSupport (E-Business Suite versions 12.2.3-12.2.15) is achievable by a highly privileged remote attacker exploiting a flaw in the Internal Operations component via HTTP, resulting in complete compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score of 6.6 reflects the severity of the impact offset by high attack complexity and high privilege requirements, which meaningfully constrain the exploitable attacker population. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, making this a significant but operationally constrained risk for Oracle EBS deployments.
Unauthorized read access to critical data is possible in Oracle iStore (E-Business Suite Shopping Cart component, versions 12.2.3-12.2.15) via an authentication bypass condition exploitable by low-privileged network attackers over HTTP. The attack is rated difficult to exploit (AC:H), limiting opportunistic risk, but a successful attempt yields high confidentiality impact - complete access to all iStore-accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Oracle via their July 2026 Critical Patch Update.
Cross-site injection in Oracle iStore's Shopping Cart component (E-Business Suite versions 12.2.3-12.2.15) enables unauthenticated remote attackers to read a subset of iStore-accessible data and perform unauthorized data modifications, with a scope change indicating impact can extend to adjacent Oracle E-Business Suite modules. The attack requires victim interaction via HTTP but no credentials, and Oracle has published a fix in the July 2026 Critical Patch Update. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the vendor-assigned tag of 'Authentication Bypass' suggests the client-side injection may circumvent session-level controls beyond what the CVSS score alone implies.
Unauthorized data disclosure in Oracle Supply Chain Trading Connector (E-Business Suite versions 12.2.3 through 12.2.15) exposes all connector-accessible data to low-privileged authenticated network attackers via HTTP. The Collaboration History component fails to enforce proper authorization controls, enabling a valid but low-privileged account to read critical trading data beyond its intended scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and straightforward network vector make this a realistic insider or credential-compromise escalation path.
Oracle Supply Chain Trading Connector versions 12.2.3 through 12.2.15 expose the Collaboration History component to unauthorized data access and service degradation by any authenticated network user over HTTP. Low-privileged attackers can read a subset of accessible records and perform unauthorized inserts, updates, and deletes, as well as cause a partial denial of service. No public exploit code and no CISA KEV listing exist at time of analysis, but Oracle's own advisory classifies this as 'Easily exploitable,' indicating minimal preconditions beyond valid credentials.
Oracle Cost Management versions 12.2.3 through 12.2.15 (Cost Planning component) exposes a network-exploitable flaw enabling a high-privileged attacker to compromise full data confidentiality and integrity within the module, plus cause partial denial of service. Oracle's own CPU July 2026 advisory classifies this as difficult to exploit due to high attack complexity and elevated privilege prerequisites, yielding a medium CVSS 3.1 score of 6.2 despite high C/I impact ratings. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Integrity compromise in Oracle E-Business Intelligence (component: Definition) affects versions 12.2.3 through 12.2.15, disclosed as part of Oracle's Critical Patch Update July 2026. A network-accessible, high-privileged attacker who can also induce victim interaction may perform unauthorized insert, update, or delete operations on a subset of accessible E-Business Intelligence data. The CVSS base score of 2.0 reflects the highly constrained exploitation requirements: high attack complexity, high privilege level, and mandatory user interaction, all of which drastically limit real-world exploitation probability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site scripting or client-side injection in Oracle E-Business Intelligence 12.2.3 through 12.2.15 enables unauthenticated remote attackers to read a subset of accessible data and perform unauthorized data modifications when a victim user interacts with a crafted HTTP request. The scope change (S:C in CVSS) indicates successful exploitation extends impact beyond the vulnerable component - characteristic of a browser-context attack such as reflected XSS through the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the tagging as 'Authentication Bypass' alongside PR:N merits close attention in enterprise deployments.
Oracle E-Business Intelligence versions 12.2.3 through 12.2.15 contains a flaw in its Internal Operations component that, under high-complexity conditions, permits a network-accessible highly privileged attacker to gain unauthorized read and write access to critical business intelligence data. Despite high confidentiality and integrity impact metrics, the overall CVSS 3.1 score of 5.9 reflects the mitigating effects of AC:H and PR:H, meaning exploitation is neither trivial nor broadly accessible. Notably, the 'Authentication Bypass' tag attached to this vulnerability is in tension with the PR:H CVSS metric, suggesting the bypass may circumvent a secondary authorization layer rather than the initial authentication mechanism - no public exploit or CISA KEV listing has been identified at time of analysis.
Oracle iSetup (versions 12.2.3 through 12.2.15), the General Ledger Update Transform and Reports component within Oracle E-Business Suite, allows a low-privileged authenticated attacker with network access via HTTP to bypass authorization controls and achieve complete confidentiality and integrity compromise of all iSetup-accessible data. Successful exploitation enables unauthorized read access to critical financial data and the ability to create, modify, or delete ledger records - a significant business risk in financial and compliance contexts despite the CVSS 3.1 medium score of 6.8. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Unauthorized data access in Oracle TeleSales (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to read, insert, update, or delete subsets of TeleSales data via HTTP without additional complexity. Tagged as an authentication bypass, the vulnerability likely represents an authorization control failure where a low-privilege account can exceed its intended data permissions within the Internal Operations component. No public exploit code or CISA KEV listing exists at time of analysis, but Oracle rates it 'easily exploitable' with low attack complexity.
Oracle Application Object Library (AOL), the Core component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exploitable over HTTP by low-privileged authenticated attackers with network access, resulting in partial unauthorized read access to AOL data, unauthorized data modification or insertion, and partial denial of service against AOL services. Oracle's July 2026 Critical Patch Update (CPU) addresses this vulnerability and classifies it as 'easily exploitable,' indicating limited technical barriers to exploitation. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the broad affected version range and low exploitation complexity elevate remediation priority for internet-facing EBS deployments.
Full takeover of Oracle Application Object Library in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a high-privileged local attacker exploiting a flaw in the AOL Generic Loader component. The CVSS vector (AV:L/AC:L/PR:H) confirms this is a local, infrastructure-level attack requiring existing privileged access to the host, yet yields complete confidentiality, integrity, and availability compromise once triggered. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Full takeover of Oracle E-Business Suite's Pasta component (Internal Operations) is achievable by a high-privileged attacker with local logon access to the host infrastructure running versions 12.2.3 through 12.2.15. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the Pasta service, consistent with the tags noting Information Disclosure as a primary impact vector alongside full control. Patched in Oracle Critical Patch Update July 2026; no public exploit identified at time of analysis and the component is not listed in CISA KEV.
Local privilege abuse in Oracle E-Business Suite's Applications Technology Stack Configuration component exposes critical data to high-privileged local attackers across versions 12.2.3 through 12.2.15. The vulnerability allows an authenticated, high-privileged attacker with local infrastructure access to achieve both full confidentiality and integrity compromise of all data accessible to the Applications Technology Stack, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and the vulnerability is tagged as an authentication bypass despite the PR:H requirement - suggesting the bypass may escalate effective access beyond what the initial privilege level should permit.
Local privilege abuse in Oracle Applications DBA (E-Business Suite component: Internal Operations) allows a low-privileged authenticated user with local system access to achieve full confidentiality compromise of DBA-accessible data, with scope change enabling impact on additional Oracle products beyond the directly targeted component. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the E-Business Suite 12.2 release train. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle's own advisory classifies the vulnerability as 'easily exploitable,' lowering the bar for threat actors with local infrastructure access.
Oracle Enterprise Asset Management (EAM), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes an authentication bypass condition in the Internal Operations component that allows a low-privileged, network-authenticated attacker to read and tamper with a subset of EAM data. Despite the medium CVSS score of 4.2, the 'Authentication Bypass' tag signals that a legitimately low-privileged account can cross authorization boundaries within the application. No public exploit code exists and this vulnerability is not listed in CISA KEV, making it a moderate but non-urgent priority for most organizations.
Local denial-of-service in Oracle MySQL Server and MySQL Cluster allows an unauthenticated attacker with OS-level logon access to the host infrastructure to crash or hang the database service via a flaw in the Replication component. Affected versions span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle classifies this as easily exploitable; no public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation requires physical or logical host-level access rather than remote network reachability.
Oracle Cost Management in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in the Internal Operations component, allowing a low-privileged remote attacker to gain unauthorized read and write access to sensitive cost management data over HTTP. The CVSS 3.1 score of 6.8 (C:H/I:H) reflects the potential for complete data exfiltration and manipulation - including creation, deletion, and modification of critical financial records - moderated by a High attack complexity that limits opportunistic targeting. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data access and modification in Oracle Customer Interaction History (part of Oracle E-Business Suite) allows a network-adjacent low-privileged attacker to read a subset of confidential records and perform unauthorized insert, update, or delete operations via HTTP. Affected deployments span versions 12.2.3 through 12.2.15. The vulnerability was disclosed as part of Oracle's Critical Patch Update for July 2026; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-connected attacker to repeatedly hang or crash the database server by exploiting a flaw in the JSON component. The vulnerability requires only a valid MySQL login and network access over any supported protocol, making it trivially reachable in multi-tenant or cloud-hosted environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and low privilege threshold elevate practical risk above what the moderate CVSS score of 6.5 might suggest.
Unauthorized data access in Oracle Complex Maintenance, Repair and Overhaul (CMRO) versions 12.2.3 through 12.2.15 allows low-privileged authenticated attackers with HTTP network access to read a subset of CMRO application data and perform unauthorized insert, update, or delete operations against accessible records via the Common Utilities component. The vulnerability is tagged as an Authentication Bypass, suggesting that despite requiring a low-privileged account, exploitation circumvents authorization controls to access data beyond the attacker's sanctioned scope. No public exploit code or confirmed active exploitation has been identified at time of analysis; the issue was disclosed as part of Oracle's Critical Patch Update for July 2026.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) exposes an authentication bypass that permits low-privileged local users to read and modify CRM data beyond their authorized scope. The flaw requires an existing logon to the infrastructure hosting the application, constraining the attack surface to internal or compromised users rather than remote internet-based attackers. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.4 Medium rating reflects these limiting factors.
Local authentication bypass in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component) versions 22.3 through 26.5 allows a low-privileged attacker with infrastructure logon access to gain complete unauthorized read access to all CRM data, including critical records. The scope change in the CVSS vector confirms that exploitation can cascade to impact additional products integrated with the Siebel environment, amplifying data exposure beyond the initial target. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access and manipulation is possible in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) via a flaw in the Siebel Cloud Manager component, tagged as an Authentication Bypass. An unauthenticated attacker positioned on the same physical network segment as the hosting hardware can, under high-complexity conditions, read a subset of accessible CRM data and perform unauthorized inserts or modifications. No confirmed active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis, and the CVSS 4.2 score accurately reflects the constrained adjacency and complexity requirements.
Full takeover of Oracle Universal Work Queue (versions 12.2.3 through 12.2.15) is achievable by a network-authenticated attacker with high administrative privileges exploiting a flaw in the Work Provider Site Level Administration component via HTTP. Despite requiring elevated credentials and high attack complexity, successful exploitation yields complete confidentiality, integrity, and availability compromise - effectively full system takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, and Oracle disclosed this through their July 2026 Critical Patch Update.
Oracle Site Hub's Site Hierarchy Flows component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes a medium-severity flaw accessible to low-privileged authenticated users over HTTP with no user interaction required. Successful exploitation yields partial unauthorized read access to Site Hub data, unauthorized insert, update, or delete capability against accessible data, and the ability to induce a partial denial of service within the application. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis; this vulnerability was disclosed as part of Oracle's July 2026 Critical Patch Update.
High-privileged network exploitation of Oracle Enterprise Asset Management's Internal Operations component allows unauthorized read and write access to critical EAM data across versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass by Oracle, the flaw requires an attacker who already holds high-level privileges to navigate high-complexity conditions over HTTP - suggesting an internal authorization bypass rather than a complete pre-auth bypass. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit or CISA KEV listing exists at time of analysis.
Cross-site scripting or authorization bypass in Oracle Enterprise Asset Management (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker to read a subset of accessible data and perform unauthorized write operations, with confirmed scope change that may impact additional E-Business Suite products. The attack is network-delivered via HTTP and requires a victim user to interact, consistent with a stored or reflected XSS-class injection despite the tag indicating authentication bypass. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the medium-severity tier warranting patch prioritization for internet-facing or multi-tenant E-Business Suite deployments.
Oracle E-Business Suite's Scheduler component (Rules UI) in versions 12.2.3 through 12.2.15 allows low-privileged, network-authenticated attackers to read restricted scheduling data, manipulate scheduling rules via unauthorized insert, update, or delete operations, and cause partial denial of service - all via HTTP without user interaction. Disclosed as part of Oracle's July 2026 Critical Patch Update, this vulnerability carries a CVSS 6.3 medium rating with no public exploit or CISA KEV listing identified at time of analysis.
Unauthorized access to sensitive federal financial data is possible in Oracle U.S. Federal Financials (versions 12.2.3-12.2.15, part of Oracle E-Business Suite) via a network-accessible authentication bypass in the Internal Operations component. An unauthenticated remote attacker with network access over HTTPS can, under high-complexity conditions, bypass authentication controls to read critical or complete confidential data - with scope change impact extending to additional E-Business Suite products beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag and scope-change designation elevate concern for federal agency deployments.
Cross-site injection in Oracle iSupport (E-Business Suite component) versions 12.2.3 through 12.2.15 enables unauthenticated remote attackers to compromise both iSupport and additional EBS components via HTTP. The CVSS scope change (S:C) combined with the 'Authentication Bypass' tag indicates the vulnerability can break out of iSupport's security boundary into adjacent Oracle EBS products, enabling unauthorized read and write access to application data. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires a victim user to interact with attacker-controlled content.
Unauthorized data manipulation in Oracle Applications Framework (Oracle E-Business Suite) versions 12.2.8 through 12.2.15 exposes the Upload Attachments component to low-privileged network attackers who can read and modify a subset of accessible application data. Exploitation requires human interaction from a third party, consistent with a cross-site request forgery or social-engineering-assisted vector. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 3.1 base score of 4.6 (Medium) reflects limited impact scope with no availability impact.
Unauthorized data disclosure in Oracle BI Publisher's XML Services component allows any low-privileged, network-authenticated attacker to access all data within the application via HTTP. Affected across three major release lines - 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 - the flaw carries a CVSS 3.1 score of 6.5 with high confidentiality impact and no integrity or availability dimension. The 'Authentication Bypass' tag suggests the vulnerability enables privilege escalation within the product's authorization model rather than a full pre-auth bypass; no public exploit or CISA KEV listing has been identified at time of analysis.
Integrity and partial availability compromise in Oracle PeopleSoft Enterprise HCM Global Payroll Mexico 9.2 is reachable by low-privileged network attackers over HTTP, though exploitation requires high complexity to trigger. Successful exploitation enables unauthorized creation, deletion, or modification of critical payroll data, as well as a partial denial of service against the Global Payroll Mexico component. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the Oracle CPU July 2026 advisory confirms the issue and presumably includes a patch.
Oracle PeopleSoft Enterprise HCM Human Resources 9.2 exposes a Security component flaw that enables a low-privileged, network-accessible attacker to bypass access controls via Oracle Net, resulting in complete confidentiality and integrity compromise of all HCM HR data. The vulnerability permits unauthorized creation, deletion, and modification of critical HR records alongside full read access to all accessible data within the system. No public exploit has been identified at time of analysis, and the CVSS AC:H designation indicates specific, undisclosed preconditions must be met for successful exploitation.
Local privilege escalation of data access in Oracle APEX's Installation component allows a low-privileged OS user to read all data accessible to the APEX platform. Affected versions are 24.1, 24.2, and 26.1. Despite the 'Authentication Bypass' tag suggesting a control-plane weakness during or after installation, exploitation is constrained to attackers with an existing local logon to the host infrastructure - no public exploit identified at time of analysis and no CISA KEV listing.
Authentication bypass in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 (Installation Security component) permits an unauthenticated attacker on the same physical network segment to partially read and modify data accessible to the application. Exploitation is constrained by high attack complexity and a mandatory user-interaction requirement, making opportunistic attacks highly impractical. No public exploit code exists and the vulnerability is not listed in CISA KEV; CVSS 3.7 (Low) accurately reflects the limited real-world threat.
Integrity compromise in JD Edwards EnterpriseOne Tools 9.2.26.3 allows a high-privileged local attacker to perform unauthorized creation, deletion, or modification of critical data - including all data accessible to the EnterpriseOne Tools platform - with a scope change that may extend impact to additional dependent products. The vulnerability resides in the Installation Security component and is tagged as an Authentication Bypass, suggesting the high-privilege requirement may be circumvented or bypassed under specific conditions. No public exploit code and no CISA KEV listing have been identified at time of analysis; this is a July 2026 Oracle Critical Patch Update disclosure.
Denial-of-service in MySQL Connector/J 9.7.0-9.7.1 allows an unauthenticated remote attacker to crash or indefinitely hang the connector process via multiple protocols, contingent on human interaction from a victim. Oracle disclosed this in the July 2026 Critical Patch Update (CPU), rating it CVSS 6.5. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting risk is currently theoretical rather than actively weaponized.
Oracle JD Edwards EnterpriseOne Configurator 9.2 exposes its Configuration Management component to a medium-severity network attack over HTTP that can cause repeated crashes or hangs alongside limited unauthorized data read and write. A low-privileged attacker who can reach the application over the network may - under high-complexity conditions - deny service to all Configurator users and access or modify a subset of configuration data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the high attack complexity materially reduces the likelihood of opportunistic mass exploitation.
Unauthenticated network-based authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 enables remote attackers to corrupt or destroy critical campus data and read a subset of accessible records via HTTP. The Security component flaw is tagged as an authentication bypass, with high integrity impact allowing unauthorized creation, deletion, and modification of critical data - a significant risk for higher education institutions relying on this system for student and community records. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's July 2026 CPU confirms the vulnerability and a patch release.
Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 exposes sensitive student and institutional data to unauthenticated remote attackers over HTTP. The Security component vulnerability allows a network-adjacent attacker to skip authentication controls and gain full read access to all Campus Community data, plus limited write access for inserts and deletes. No public exploit code exists and no CISA KEV listing has been observed, but the PR:N/C:H combination makes this a material confidentiality risk for higher education institutions running the affected version.
Full system takeover is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component, exploitable over HTTP by a high-privileged network attacker under high-complexity conditions. Successful exploitation yields complete compromise of confidentiality, integrity, and availability - effectively granting an attacker control over the affected instance. No public exploit code exists and the vulnerability is not listed in CISA KEV; Oracle disclosed this through its Critical Patch Update for July 2026.
Critical data exposure and unauthorized modification in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged, network-authenticated attacker to bypass access controls within the Commonline Loans component via HTTP. Successful exploitation yields complete read and write access to all financial aid data accessible to the application, including sensitive student loan records. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Unauthenticated read access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows remote attackers to retrieve a subset of protected campus data via HTTP without credentials. The 'Authentication Bypass' tag indicates the Security component fails to enforce access controls on at least one network-accessible endpoint, exposing data - likely student records, enrollment data, or PII - to anonymous network queries. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle explicitly characterizes this as 'easily exploitable.'
Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows unauthenticated network attackers via HTTPS to access critical or complete application data through an authentication bypass in the Security component. Disclosed as part of Oracle's Critical Patch Update for July 2026, the CVSS 3.1 score of 5.9 (Medium) reflects high attack complexity (AC:H), meaning exploitation requires specific non-trivial conditions. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthorized data access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows a low-privileged authenticated attacker to read all data accessible within the system via HTTPS against the Communication component. Tagged as an Authentication Bypass by EUVD intelligence, the flaw appears to operate at the authorization layer - an attacker with a valid low-privilege session can exceed their permitted data scope rather than bypass authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a credible insider or credential-theft-follow-on threat for higher education environments.
Local data integrity compromise in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 enables low-privileged users with logon access to the host infrastructure to bypass application-layer authorization controls within the Institutional Methodology Need Analysis component. Successful exploitation permits unauthorized creation, deletion, or modification of critical financial aid records and partial read access to accessible data. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; however, the low attack complexity makes exploitation straightforward for any insider or attacker with an existing host foothold.
Local unauthorized data access in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged authenticated user with logon access to the hosting infrastructure to compromise the FM Need Analysis Calculator component and read critical or complete financial aid data. The Authentication Bypass tag from EUVD-2026-46965 suggests the component fails to enforce authorization boundaries for already-authenticated low-privilege accounts, enabling horizontal or vertical privilege escalation within the application. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at the time of analysis.
Integrity compromise in Oracle PeopleSoft Enterprise FIN Common Objects 9.2 allows a low-privileged local attacker to perform unauthorized creation, deletion, or modification of critical financial data when human interaction from another user is obtained. The vulnerability resides in the Security component and carries a CVSS 3.1 base score of 4.4, reflecting high attack complexity and a local-only attack vector. No public exploit code or active exploitation has been identified at time of analysis, and Oracle has disclosed the issue via its July 2026 Critical Patch Update.
Oracle Production Scheduling versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes its Internal Operations component to exploitation by high-privileged remote attackers over HTTP. Successful exploitation yields partial unauthorized read and write access to accessible data alongside a partial denial of service condition. No public exploit code or confirmed active exploitation has been identified at time of analysis; CVSS score of 4.7 (Medium) reflects the significant mitigation from the high-privilege prerequisite.
Oracle Production Scheduling versions 12.2.3 through 12.2.15 in Oracle E-Business Suite exposes a local exploitation path through its Internal Operations component, enabling a low-privileged attacker - given co-presence of a second interacting user - to achieve unauthorized creation, deletion, or modification of critical data with a scope change that can cascade impact to additional Oracle EBS products. Tagged as an authentication bypass by ENISA EUVD-2026-47258, the flaw is addressed in Oracle's Critical Patch Update for July 2026. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle HRMS (Norway) Payroll component within E-Business Suite versions 12.2.3 through 12.2.15 exposes limited confidentiality and integrity risks to high-privileged authenticated network attackers over HTTP. A successfully exploited vulnerability enables unauthorized read access to a subset of Norway Payroll data and unauthorized update, insert, or delete operations on accessible records within that module. No public exploit code has been identified at time of analysis, CISA KEV listing is absent, and the CVSS 3.1 base score of 3.8 (Low) reflects the constrained scope and high privilege bar required.
Oracle Inventory Management within Oracle E-Business Suite 12.2.3 through 12.2.15 is susceptible to a local, highly constrained partial denial-of-service condition affecting only availability. Exploitation requires an already highly privileged attacker with direct logon access to the underlying infrastructure hosting the application, combined with high attack complexity, making successful exploitation extremely difficult in practice. No public exploit code or active exploitation has been identified; the CVSS score of 1.9 reflects the minimal real-world risk posed by this vulnerability.
Full takeover of Oracle Inventory Management (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged attacker with local infrastructure access exploiting a flaw in the Internal Operations component. The CVSS vector (AV:L/AC:H/PR:H) places this firmly in the category of post-compromise or insider-threat scenarios rather than remote opportunistic attacks, yet the confirmed C:H/I:H/A:H impact means a successful exploitation yields complete control of the affected instance. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Unauthorized read access to Oracle Time and Labor data is achievable by unauthenticated remote attackers targeting the Internal Operations component via HTTP, affecting E-Business Suite versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass, the flaw allows network-based attackers to circumvent access controls without credentials, though the high attack complexity (AC:H) constrains reliable exploitation. Impact is confined to partial confidentiality loss - no integrity or availability impact - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Time and Labor (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 exposes a difficult-to-exploit flaw that allows a high-privileged, network-authenticated attacker operating over HTTP to gain complete read access to all Time and Labor data and limited write access (insert, update, delete), with scope change implications affecting additional Oracle EBS components. Tagged as an authentication bypass by ENISA EUVD intelligence, this conflict with the CVSS PR:H requirement warrants investigative scrutiny - it may indicate a secondary authorization bypass rather than a full authentication bypass. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Oracle Scripting within E-Business Suite (versions 12.2.3 through 12.2.15) allows a high-privileged attacker with HTTP network access to fully compromise data confidentiality and integrity in the Internal Operations component. Despite the PR:H CVSS rating, the 'Authentication Bypass' tag raises concern that effective access controls may be circumventable, potentially lowering the real exploitation barrier below what the score implies. No public exploit or CISA KEV listing has been identified at time of analysis, but the July 2026 Oracle CPU advisory confirms the issue and remediation is available.
Unauthorized data access and modification in Oracle Flow Manufacturing (component: Internal Operations) allows a low-privileged, network-adjacent attacker to compromise confidentiality and integrity of Flow Manufacturing data, with a scope change that may impact additional Oracle E-Business Suite products. Affected versions span 12.2.3 through 12.2.15, a wide deployment window covering over a decade of releases. The attack requires human interaction from a victim beyond the attacker, suggesting a social-engineering or UI-based exploitation vector. No public exploit code or CISA KEV listing has been identified at time of analysis; this is a medium-severity finding addressed in Oracle's July 2026 Critical Patch Update.
Cross-product data exposure in Oracle Transportation Execution (E-Business Suite 12.2.3-12.2.15) allows an authenticated low-privileged attacker over HTTP to read and modify a subset of Transportation data while also impacting additional EBS products due to a scope change. The attack requires victim interaction, suggesting a client-side injection vector (consistent with the 'Authentication Bypass' tag and scope change in the CVSS vector), where attacker-controlled content is rendered by another user. Disclosed in Oracle's July 2026 Critical Patch Update with no confirmed public exploit or CISA KEV listing at time of analysis.
Partial confidentiality exposure in Oracle HRMS (Ireland), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a network-based high-privileged attacker to read a limited subset of HRMS data via HTTP under high-complexity conditions. The impact is confined solely to confidentiality with no integrity or availability consequence, and the CVSS 3.1 base score of 2.2 reflects how constrained exploitation is in practice. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog. Notably, the intelligence tag 'Authentication Bypass' conflicts with the PR:H vector - this discrepancy warrants verification against the Oracle July 2026 CPU advisory.
Oracle Service Contracts (E-Business Suite versions 12.2.3-12.2.15) exposes a network-accessible integrity and confidentiality flaw in its Internal Operations component that allows a high-privileged, authenticated attacker to bypass authorization controls and gain unauthorized read or write access to all Service Contracts data. The attack is rated difficult to exploit and requires human interaction from a third party, substantially limiting opportunistic exploitation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, though the 'Authentication Bypass' tag signals a meaningful authorization control gap rather than a simple privilege escalation.
Unauthorized read access in Oracle Project Contracts (E-Business Suite component: Internal Operations) can be achieved by a low-privileged network attacker under high-complexity exploit conditions, exposing a subset of Project Contracts data. Affected versions span 12.2.3 through 12.2.15, as confirmed by Oracle Security Alerts via the July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, keeping real-world risk low despite the network-accessible attack surface and the notable 'Authentication Bypass' tag applied by ENISA EUVD.
Oracle Labor Distribution, an Internal Operations component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a high-privileged local attacker to compromise data integrity by creating, deleting, or modifying critical application data. Despite carrying an 'Authentication Bypass' tag in available intelligence, the CVSS vector (AV:L/AC:H/PR:H) constrains exploitation to actors who already possess elevated logon access to the underlying infrastructure - suggesting an internal authorization bypass rather than a full authentication circumvention. No public exploit code exists and no active exploitation has been identified; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Partial data integrity compromise in Oracle Labor Distribution (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged attacker with network access via HTTP to perform unauthorized insert, update, or delete operations on some accessible data within the product's Internal Operations component. The 'Authentication Bypass' tag in the intelligence data is notable but conflicts with the PR:L CVSS metric, suggesting this is more accurately an internal authorization bypass within an authenticated session rather than a full bypass of the login mechanism. No public exploit code exists and the vulnerability is not listed in CISA KEV; with a CVSS 3.1 score of 3.1 (Low) and AC:H, this represents a low-priority finding for most environments.
Partial denial-of-service in Oracle Labor Distribution (E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated attackers over HTTP under high-complexity conditions. The vulnerability affects only the availability of the Internal Operations component and yields only a partial availability impact, placing it firmly in the low-severity tier. No public exploit code exists and no active exploitation has been identified at the time of analysis.
Partial unauthorized read access in Oracle Public Sector Financials (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker over HTTP to read a limited subset of data they are not authorized to access. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector confirms authentication is required (PR:L), suggesting this is a partial authorization bypass or privilege boundary failure rather than a full authentication bypass. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized data manipulation in Oracle Public Sector Financials (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged authenticated attacker over HTTP targeting the Internal Operations component. Despite the 'Authentication Bypass' tag, the CVSS PR:L metric confirms initial credentials are required, suggesting the flaw represents a post-authentication authorization control bypass rather than a full authentication bypass. Impact is constrained to limited integrity loss - partial unauthorized insert, update, or delete of accessible data - with no confidentiality or availability impact, and no public exploit or active exploitation identified at time of analysis.
Unauthorized read access to a subset of procurement data is achievable in Oracle iSupplier Portal versions 12.2.3 through 12.2.15 via the Internal Operations component over HTTP, requiring a low-privileged account and difficult attack conditions. The intelligence tags classify this as an Authentication Bypass, creating tension with the official CVSS PR:L metric - if bypass is possible, the real-world requirement may be lower than the vector implies. No public exploit or active exploitation has been identified at time of analysis; this vulnerability is addressed in Oracle's July 2026 Critical Patch Update.
Unauthorized read access to Oracle iSupplier Portal (E-Business Suite versions 12.2.3-12.2.15) is possible for unauthenticated network attackers targeting the Internal Operations component over HTTP. The Authentication Bypass tag indicates the root cause involves inadequate access controls on internal HTTP endpoints, though exploitation is constrained by high attack complexity (AC:H), meaning specific conditions must be met. Impact is confined to partial confidentiality loss - no integrity or availability impact - with no public exploit code or active exploitation confirmed at time of analysis.
Oracle Property Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes a low-severity information disclosure flaw in the Internal Operations component that allows a highly privileged local attacker to read an unauthorized subset of Property Manager data under difficult exploitation conditions. The CVSS 3.1 score of 1.9 reflects the combined constraints of local infrastructure access, high privilege prerequisites, and high attack complexity, resulting in only partial confidentiality impact with no integrity or availability exposure. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; this is addressed in Oracle's Critical Patch Update for July 2026.
Unauthorized data access in Oracle Property Manager (E-Business Suite component: Internal Operations) allows low-privileged authenticated network attackers to read and manipulate property management data via HTTP. Affected versions span 12.2.3 through 12.2.15. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low attack complexity and broad version range make patching a near-term priority for EBS deployments.
Unauthorized data access and modification in Oracle Property Manager (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a network-authenticated low-privileged attacker via HTTP when a victim user interacts with attacker-controlled content, triggering a scope change that may impact additional EBS components. The vulnerability permits unauthorized read access to a subset of Property Manager data and unauthorized insert, update, or delete operations on accessible data. No public exploit code or CISA KEV listing is identified at time of analysis, but the 'Authentication Bypass' tag signals a potential authorization control failure beyond the base CVSS score suggests.
Partial compromise of Oracle Installed Base (Create Item Instance component) within Oracle E-Business Suite versions 12.2.4 through 12.2.15 is achievable by a low-privileged authenticated attacker over HTTP, subject to high attack complexity conditions. Successful exploitation results in unauthorized read access to a subset of Installed Base data, unauthorized data manipulation (insert/update/delete), and the ability to cause a partial denial of service. No public exploit or active exploitation has been identified at time of analysis; the Oracle CPU July 2026 advisory addresses this issue.
Unauthorized data disclosure in Oracle HCM Configuration Workbench (Rapid Implementation component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to gain complete access to all data accessible within the application via HTTP. Tagged as an Authentication Bypass, the flaw indicates that a legitimately authenticated user with minimal privileges can circumvent authorization controls to access sensitive HCM data well beyond their entitlement - covering employee PII, compensation structures, and organizational data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range spanning twelve supported minor releases elevate operational risk in large enterprise environments running externally accessible EBS instances.
Oracle Work in Process within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes low-privileged local attackers to unauthorized partial data disclosure and partial denial-of-service conditions via the Internal Operations component. Exploitation demands an existing OS-level logon to the host infrastructure and high attack complexity, making reliable exploitation difficult and opportunistic mass exploitation implausible. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, consistent with the vendor-assigned CVSS 3.1 score of 3.6 (Low).
Local privilege escalation via authentication bypass in Oracle Payroll (E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged user with infrastructure logon to gain complete unauthorized read access to all Oracle Payroll data, with scope change indicating potential lateral impact to additional EBS components. The CVSS vector confirms local attack vector with low complexity and no user interaction required, making this straightforwardly exploitable by any authenticated OS-level user on the Payroll host. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle's 'easily exploitable' language in the advisory warrants prompt patching for any internet-adjacent or multi-tenant EBS deployment.
Full takeover of Oracle HRMS (Norway) - the Norway Payroll component within Oracle E-Business Suite - is possible for a high-privileged attacker who can satisfy difficult exploitation conditions over HTTP across versions 12.2.8 through 12.2.15. Despite the complete C/I/A impact, the CVSS 3.1 score of 6.6 reflects real-world constraints: both high attack complexity (AC:H) and high privilege requirements (PR:H) must be met, making opportunistic mass exploitation unlikely. No public exploit code or CISA KEV listing has been identified at time of analysis, consistent with this being a targeted, insider-threat-class risk.
Limited local data disclosure in Oracle Work in Process (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows a high-privileged attacker with local infrastructure access to read a subset of accessible data under difficult exploitation conditions. The CVSS 3.1 base score of 1.9 reflects an extremely constrained attack surface - local vector, high complexity, and high privilege requirements combine to make this one of the lowest-severity issues addressed in the Oracle CPU July 2026 advisory. No public exploit identified at time of analysis, and no active exploitation has been reported.
Unauthorized read access to critical data in Oracle Work in Process (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-connected attacker exploiting an authentication bypass in the Internal Operations component via HTTP. The flaw is rated difficult to exploit (AC:H) and carries no integrity or availability impact, but successful exploitation grants complete access to all data accessible within the Work in Process module. No public exploit code or CISA KEV listing is associated with this vulnerability at time of analysis.
Oracle Order Management's Product Diagnostic Tools component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised by a low-privileged authenticated attacker over HTTP, resulting in unauthorized read and write access to Order Management data. The scope change (S:C in CVSS) indicates successful exploitation can cascade to impact additional Oracle EBS modules beyond Order Management itself. Tagged as an Authentication Bypass, no public exploit has been identified at time of analysis, though the patch is included in Oracle's CPU July 2026 release.
Unauthorized critical data disclosure in Oracle Order Management (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 stems from a flaw in the Product Diagnostic Tools component, exploitable by a high-privileged attacker over HTTP with no user interaction. Successful exploitation triggers a scope change, meaning the compromise can extend to additional Oracle products accessible through the Order Management context, resulting in complete access to all confidential data within that reach. No public exploit has been identified at time of analysis, and a fix is available via Oracle's Critical Patch Update for July 2026.
Oracle Order Entry in E-Business Suite versions 12.2.3 through 12.2.15 exposes a low-severity local privilege vulnerability in its Internal Operations component, allowing a high-privileged local attacker to perform unauthorized data manipulation and cause partial service disruption. The attack requires physical or logical access to the infrastructure hosting the application and an already-elevated account, significantly constraining real-world exploitability. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at the time of analysis.
Unauthorized data access and denial of service in Oracle Mobile Application Server's MWA Terminal Server component (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a high-privileged attacker over HTTP. Successful exploitation grants complete read access to all data accessible by the Mobile Application Server, limited write capability (insert/update/delete on some data), and the ability to cause a complete, repeatable denial-of-service crash. The 'Authentication Bypass' tag in the intelligence data conflicts with the PR:H CVSS metric, suggesting the flaw may allow an authenticated administrator to bypass authorization controls beyond their intended access scope. No public exploit or CISA KEV listing has been identified at time of analysis.
Critical data exposure and tampering in Oracle Citizen Interaction Center (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a high-privileged, network-authenticated attacker to achieve full read and write access to all application data via HTTP. Despite the 'Authentication Bypass' tag, the CVSS PR:H metric indicates exploitation requires an already-authenticated high-privilege account, suggesting an internal authorization control bypass rather than an unauthenticated entry point. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed through Oracle's Critical Patch Update for July 2026.
The Search component of Oracle Knowledge Management in E-Business Suite versions 12.2.5 through 12.2.15 allows unauthenticated network attackers to compromise data confidentiality and integrity when a victim user interacts with a crafted HTTP request, with successful exploitation producing a scope change that can impact additional E-Business Suite products. Disclosed via Oracle's July 2026 Critical Patch Update, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) scores 6.1 and is consistent with a reflected injection class - likely Cross-Site Scripting - given the combination of no-privilege network access, required human interaction, and cross-product scope change. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data disclosure in Oracle Price Protection (E-Business Suite versions 12.2.3 through 12.2.15) allows a network-adjacent, low-privileged attacker to gain complete read access to all pricing data accessible by the application. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass, suggesting that a legitimately authenticated but low-privileged session can circumvent authorization controls to reach confidential pricing records. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network reachability make it straightforward to exploit once credentials are obtained.
Oracle Interaction Blending within E-Business Suite exposes a network-accessible RMI interface flaw that allows a high-privileged attacker to partially compromise confidentiality, integrity, and availability of application data. Affected deployments span versions 12.2.3 through 12.2.15 of the Internal Operations component. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing it at low immediate operational priority despite the triple-impact scope.
Oracle iSupport versions 12.2.3 through 12.2.15 within Oracle E-Business Suite contain a vulnerability in the Internal Operations component that allows a highly privileged network attacker to fully compromise the affected application via HTTP. Successful exploitation results in complete confidentiality, integrity, and availability impact - described by Oracle as a full takeover of Oracle iSupport. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; disclosure occurred through Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle iSupport (E-Business Suite versions 12.2.3-12.2.15) is achievable by a highly privileged remote attacker exploiting a flaw in the Internal Operations component via HTTP, resulting in complete compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score of 6.6 reflects the severity of the impact offset by high attack complexity and high privilege requirements, which meaningfully constrain the exploitable attacker population. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, making this a significant but operationally constrained risk for Oracle EBS deployments.
Unauthorized read access to critical data is possible in Oracle iStore (E-Business Suite Shopping Cart component, versions 12.2.3-12.2.15) via an authentication bypass condition exploitable by low-privileged network attackers over HTTP. The attack is rated difficult to exploit (AC:H), limiting opportunistic risk, but a successful attempt yields high confidentiality impact - complete access to all iStore-accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Oracle via their July 2026 Critical Patch Update.
Cross-site injection in Oracle iStore's Shopping Cart component (E-Business Suite versions 12.2.3-12.2.15) enables unauthenticated remote attackers to read a subset of iStore-accessible data and perform unauthorized data modifications, with a scope change indicating impact can extend to adjacent Oracle E-Business Suite modules. The attack requires victim interaction via HTTP but no credentials, and Oracle has published a fix in the July 2026 Critical Patch Update. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the vendor-assigned tag of 'Authentication Bypass' suggests the client-side injection may circumvent session-level controls beyond what the CVSS score alone implies.
Unauthorized data disclosure in Oracle Supply Chain Trading Connector (E-Business Suite versions 12.2.3 through 12.2.15) exposes all connector-accessible data to low-privileged authenticated network attackers via HTTP. The Collaboration History component fails to enforce proper authorization controls, enabling a valid but low-privileged account to read critical trading data beyond its intended scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and straightforward network vector make this a realistic insider or credential-compromise escalation path.
Oracle Supply Chain Trading Connector versions 12.2.3 through 12.2.15 expose the Collaboration History component to unauthorized data access and service degradation by any authenticated network user over HTTP. Low-privileged attackers can read a subset of accessible records and perform unauthorized inserts, updates, and deletes, as well as cause a partial denial of service. No public exploit code and no CISA KEV listing exist at time of analysis, but Oracle's own advisory classifies this as 'Easily exploitable,' indicating minimal preconditions beyond valid credentials.
Oracle Cost Management versions 12.2.3 through 12.2.15 (Cost Planning component) exposes a network-exploitable flaw enabling a high-privileged attacker to compromise full data confidentiality and integrity within the module, plus cause partial denial of service. Oracle's own CPU July 2026 advisory classifies this as difficult to exploit due to high attack complexity and elevated privilege prerequisites, yielding a medium CVSS 3.1 score of 6.2 despite high C/I impact ratings. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Integrity compromise in Oracle E-Business Intelligence (component: Definition) affects versions 12.2.3 through 12.2.15, disclosed as part of Oracle's Critical Patch Update July 2026. A network-accessible, high-privileged attacker who can also induce victim interaction may perform unauthorized insert, update, or delete operations on a subset of accessible E-Business Intelligence data. The CVSS base score of 2.0 reflects the highly constrained exploitation requirements: high attack complexity, high privilege level, and mandatory user interaction, all of which drastically limit real-world exploitation probability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site scripting or client-side injection in Oracle E-Business Intelligence 12.2.3 through 12.2.15 enables unauthenticated remote attackers to read a subset of accessible data and perform unauthorized data modifications when a victim user interacts with a crafted HTTP request. The scope change (S:C in CVSS) indicates successful exploitation extends impact beyond the vulnerable component - characteristic of a browser-context attack such as reflected XSS through the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the tagging as 'Authentication Bypass' alongside PR:N merits close attention in enterprise deployments.
Oracle E-Business Intelligence versions 12.2.3 through 12.2.15 contains a flaw in its Internal Operations component that, under high-complexity conditions, permits a network-accessible highly privileged attacker to gain unauthorized read and write access to critical business intelligence data. Despite high confidentiality and integrity impact metrics, the overall CVSS 3.1 score of 5.9 reflects the mitigating effects of AC:H and PR:H, meaning exploitation is neither trivial nor broadly accessible. Notably, the 'Authentication Bypass' tag attached to this vulnerability is in tension with the PR:H CVSS metric, suggesting the bypass may circumvent a secondary authorization layer rather than the initial authentication mechanism - no public exploit or CISA KEV listing has been identified at time of analysis.
Oracle iSetup (versions 12.2.3 through 12.2.15), the General Ledger Update Transform and Reports component within Oracle E-Business Suite, allows a low-privileged authenticated attacker with network access via HTTP to bypass authorization controls and achieve complete confidentiality and integrity compromise of all iSetup-accessible data. Successful exploitation enables unauthorized read access to critical financial data and the ability to create, modify, or delete ledger records - a significant business risk in financial and compliance contexts despite the CVSS 3.1 medium score of 6.8. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Unauthorized data access in Oracle TeleSales (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to read, insert, update, or delete subsets of TeleSales data via HTTP without additional complexity. Tagged as an authentication bypass, the vulnerability likely represents an authorization control failure where a low-privilege account can exceed its intended data permissions within the Internal Operations component. No public exploit code or CISA KEV listing exists at time of analysis, but Oracle rates it 'easily exploitable' with low attack complexity.
Oracle Application Object Library (AOL), the Core component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exploitable over HTTP by low-privileged authenticated attackers with network access, resulting in partial unauthorized read access to AOL data, unauthorized data modification or insertion, and partial denial of service against AOL services. Oracle's July 2026 Critical Patch Update (CPU) addresses this vulnerability and classifies it as 'easily exploitable,' indicating limited technical barriers to exploitation. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the broad affected version range and low exploitation complexity elevate remediation priority for internet-facing EBS deployments.
Full takeover of Oracle Application Object Library in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a high-privileged local attacker exploiting a flaw in the AOL Generic Loader component. The CVSS vector (AV:L/AC:L/PR:H) confirms this is a local, infrastructure-level attack requiring existing privileged access to the host, yet yields complete confidentiality, integrity, and availability compromise once triggered. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Full takeover of Oracle E-Business Suite's Pasta component (Internal Operations) is achievable by a high-privileged attacker with local logon access to the host infrastructure running versions 12.2.3 through 12.2.15. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the Pasta service, consistent with the tags noting Information Disclosure as a primary impact vector alongside full control. Patched in Oracle Critical Patch Update July 2026; no public exploit identified at time of analysis and the component is not listed in CISA KEV.
Local privilege abuse in Oracle E-Business Suite's Applications Technology Stack Configuration component exposes critical data to high-privileged local attackers across versions 12.2.3 through 12.2.15. The vulnerability allows an authenticated, high-privileged attacker with local infrastructure access to achieve both full confidentiality and integrity compromise of all data accessible to the Applications Technology Stack, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and the vulnerability is tagged as an authentication bypass despite the PR:H requirement - suggesting the bypass may escalate effective access beyond what the initial privilege level should permit.
Local privilege abuse in Oracle Applications DBA (E-Business Suite component: Internal Operations) allows a low-privileged authenticated user with local system access to achieve full confidentiality compromise of DBA-accessible data, with scope change enabling impact on additional Oracle products beyond the directly targeted component. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the E-Business Suite 12.2 release train. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle's own advisory classifies the vulnerability as 'easily exploitable,' lowering the bar for threat actors with local infrastructure access.
Oracle Enterprise Asset Management (EAM), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes an authentication bypass condition in the Internal Operations component that allows a low-privileged, network-authenticated attacker to read and tamper with a subset of EAM data. Despite the medium CVSS score of 4.2, the 'Authentication Bypass' tag signals that a legitimately low-privileged account can cross authorization boundaries within the application. No public exploit code exists and this vulnerability is not listed in CISA KEV, making it a moderate but non-urgent priority for most organizations.
Local denial-of-service in Oracle MySQL Server and MySQL Cluster allows an unauthenticated attacker with OS-level logon access to the host infrastructure to crash or hang the database service via a flaw in the Replication component. Affected versions span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle classifies this as easily exploitable; no public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation requires physical or logical host-level access rather than remote network reachability.
Oracle Cost Management in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in the Internal Operations component, allowing a low-privileged remote attacker to gain unauthorized read and write access to sensitive cost management data over HTTP. The CVSS 3.1 score of 6.8 (C:H/I:H) reflects the potential for complete data exfiltration and manipulation - including creation, deletion, and modification of critical financial records - moderated by a High attack complexity that limits opportunistic targeting. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data access and modification in Oracle Customer Interaction History (part of Oracle E-Business Suite) allows a network-adjacent low-privileged attacker to read a subset of confidential records and perform unauthorized insert, update, or delete operations via HTTP. Affected deployments span versions 12.2.3 through 12.2.15. The vulnerability was disclosed as part of Oracle's Critical Patch Update for July 2026; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-connected attacker to repeatedly hang or crash the database server by exploiting a flaw in the JSON component. The vulnerability requires only a valid MySQL login and network access over any supported protocol, making it trivially reachable in multi-tenant or cloud-hosted environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and low privilege threshold elevate practical risk above what the moderate CVSS score of 6.5 might suggest.
Unauthorized data access in Oracle Complex Maintenance, Repair and Overhaul (CMRO) versions 12.2.3 through 12.2.15 allows low-privileged authenticated attackers with HTTP network access to read a subset of CMRO application data and perform unauthorized insert, update, or delete operations against accessible records via the Common Utilities component. The vulnerability is tagged as an Authentication Bypass, suggesting that despite requiring a low-privileged account, exploitation circumvents authorization controls to access data beyond the attacker's sanctioned scope. No public exploit code or confirmed active exploitation has been identified at time of analysis; the issue was disclosed as part of Oracle's Critical Patch Update for July 2026.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) exposes an authentication bypass that permits low-privileged local users to read and modify CRM data beyond their authorized scope. The flaw requires an existing logon to the infrastructure hosting the application, constraining the attack surface to internal or compromised users rather than remote internet-based attackers. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.4 Medium rating reflects these limiting factors.
Local authentication bypass in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component) versions 22.3 through 26.5 allows a low-privileged attacker with infrastructure logon access to gain complete unauthorized read access to all CRM data, including critical records. The scope change in the CVSS vector confirms that exploitation can cascade to impact additional products integrated with the Siebel environment, amplifying data exposure beyond the initial target. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access and manipulation is possible in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) via a flaw in the Siebel Cloud Manager component, tagged as an Authentication Bypass. An unauthenticated attacker positioned on the same physical network segment as the hosting hardware can, under high-complexity conditions, read a subset of accessible CRM data and perform unauthorized inserts or modifications. No confirmed active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis, and the CVSS 4.2 score accurately reflects the constrained adjacency and complexity requirements.
Full takeover of Oracle Universal Work Queue (versions 12.2.3 through 12.2.15) is achievable by a network-authenticated attacker with high administrative privileges exploiting a flaw in the Work Provider Site Level Administration component via HTTP. Despite requiring elevated credentials and high attack complexity, successful exploitation yields complete confidentiality, integrity, and availability compromise - effectively full system takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, and Oracle disclosed this through their July 2026 Critical Patch Update.
Oracle Site Hub's Site Hierarchy Flows component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes a medium-severity flaw accessible to low-privileged authenticated users over HTTP with no user interaction required. Successful exploitation yields partial unauthorized read access to Site Hub data, unauthorized insert, update, or delete capability against accessible data, and the ability to induce a partial denial of service within the application. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis; this vulnerability was disclosed as part of Oracle's July 2026 Critical Patch Update.
High-privileged network exploitation of Oracle Enterprise Asset Management's Internal Operations component allows unauthorized read and write access to critical EAM data across versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass by Oracle, the flaw requires an attacker who already holds high-level privileges to navigate high-complexity conditions over HTTP - suggesting an internal authorization bypass rather than a complete pre-auth bypass. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit or CISA KEV listing exists at time of analysis.
Cross-site scripting or authorization bypass in Oracle Enterprise Asset Management (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker to read a subset of accessible data and perform unauthorized write operations, with confirmed scope change that may impact additional E-Business Suite products. The attack is network-delivered via HTTP and requires a victim user to interact, consistent with a stored or reflected XSS-class injection despite the tag indicating authentication bypass. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the medium-severity tier warranting patch prioritization for internet-facing or multi-tenant E-Business Suite deployments.
Oracle E-Business Suite's Scheduler component (Rules UI) in versions 12.2.3 through 12.2.15 allows low-privileged, network-authenticated attackers to read restricted scheduling data, manipulate scheduling rules via unauthorized insert, update, or delete operations, and cause partial denial of service - all via HTTP without user interaction. Disclosed as part of Oracle's July 2026 Critical Patch Update, this vulnerability carries a CVSS 6.3 medium rating with no public exploit or CISA KEV listing identified at time of analysis.
Unauthorized access to sensitive federal financial data is possible in Oracle U.S. Federal Financials (versions 12.2.3-12.2.15, part of Oracle E-Business Suite) via a network-accessible authentication bypass in the Internal Operations component. An unauthenticated remote attacker with network access over HTTPS can, under high-complexity conditions, bypass authentication controls to read critical or complete confidential data - with scope change impact extending to additional E-Business Suite products beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag and scope-change designation elevate concern for federal agency deployments.
Cross-site injection in Oracle iSupport (E-Business Suite component) versions 12.2.3 through 12.2.15 enables unauthenticated remote attackers to compromise both iSupport and additional EBS components via HTTP. The CVSS scope change (S:C) combined with the 'Authentication Bypass' tag indicates the vulnerability can break out of iSupport's security boundary into adjacent Oracle EBS products, enabling unauthorized read and write access to application data. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires a victim user to interact with attacker-controlled content.
Unauthorized data manipulation in Oracle Applications Framework (Oracle E-Business Suite) versions 12.2.8 through 12.2.15 exposes the Upload Attachments component to low-privileged network attackers who can read and modify a subset of accessible application data. Exploitation requires human interaction from a third party, consistent with a cross-site request forgery or social-engineering-assisted vector. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 3.1 base score of 4.6 (Medium) reflects limited impact scope with no availability impact.
Unauthorized data disclosure in Oracle BI Publisher's XML Services component allows any low-privileged, network-authenticated attacker to access all data within the application via HTTP. Affected across three major release lines - 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 - the flaw carries a CVSS 3.1 score of 6.5 with high confidentiality impact and no integrity or availability dimension. The 'Authentication Bypass' tag suggests the vulnerability enables privilege escalation within the product's authorization model rather than a full pre-auth bypass; no public exploit or CISA KEV listing has been identified at time of analysis.
Integrity and partial availability compromise in Oracle PeopleSoft Enterprise HCM Global Payroll Mexico 9.2 is reachable by low-privileged network attackers over HTTP, though exploitation requires high complexity to trigger. Successful exploitation enables unauthorized creation, deletion, or modification of critical payroll data, as well as a partial denial of service against the Global Payroll Mexico component. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the Oracle CPU July 2026 advisory confirms the issue and presumably includes a patch.
Oracle PeopleSoft Enterprise HCM Human Resources 9.2 exposes a Security component flaw that enables a low-privileged, network-accessible attacker to bypass access controls via Oracle Net, resulting in complete confidentiality and integrity compromise of all HCM HR data. The vulnerability permits unauthorized creation, deletion, and modification of critical HR records alongside full read access to all accessible data within the system. No public exploit has been identified at time of analysis, and the CVSS AC:H designation indicates specific, undisclosed preconditions must be met for successful exploitation.
Local privilege escalation of data access in Oracle APEX's Installation component allows a low-privileged OS user to read all data accessible to the APEX platform. Affected versions are 24.1, 24.2, and 26.1. Despite the 'Authentication Bypass' tag suggesting a control-plane weakness during or after installation, exploitation is constrained to attackers with an existing local logon to the host infrastructure - no public exploit identified at time of analysis and no CISA KEV listing.
Authentication bypass in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 (Installation Security component) permits an unauthenticated attacker on the same physical network segment to partially read and modify data accessible to the application. Exploitation is constrained by high attack complexity and a mandatory user-interaction requirement, making opportunistic attacks highly impractical. No public exploit code exists and the vulnerability is not listed in CISA KEV; CVSS 3.7 (Low) accurately reflects the limited real-world threat.
Integrity compromise in JD Edwards EnterpriseOne Tools 9.2.26.3 allows a high-privileged local attacker to perform unauthorized creation, deletion, or modification of critical data - including all data accessible to the EnterpriseOne Tools platform - with a scope change that may extend impact to additional dependent products. The vulnerability resides in the Installation Security component and is tagged as an Authentication Bypass, suggesting the high-privilege requirement may be circumvented or bypassed under specific conditions. No public exploit code and no CISA KEV listing have been identified at time of analysis; this is a July 2026 Oracle Critical Patch Update disclosure.
Denial-of-service in MySQL Connector/J 9.7.0-9.7.1 allows an unauthenticated remote attacker to crash or indefinitely hang the connector process via multiple protocols, contingent on human interaction from a victim. Oracle disclosed this in the July 2026 Critical Patch Update (CPU), rating it CVSS 6.5. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting risk is currently theoretical rather than actively weaponized.
Oracle JD Edwards EnterpriseOne Configurator 9.2 exposes its Configuration Management component to a medium-severity network attack over HTTP that can cause repeated crashes or hangs alongside limited unauthorized data read and write. A low-privileged attacker who can reach the application over the network may - under high-complexity conditions - deny service to all Configurator users and access or modify a subset of configuration data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the high attack complexity materially reduces the likelihood of opportunistic mass exploitation.
Unauthenticated network-based authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 enables remote attackers to corrupt or destroy critical campus data and read a subset of accessible records via HTTP. The Security component flaw is tagged as an authentication bypass, with high integrity impact allowing unauthorized creation, deletion, and modification of critical data - a significant risk for higher education institutions relying on this system for student and community records. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's July 2026 CPU confirms the vulnerability and a patch release.
Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 exposes sensitive student and institutional data to unauthenticated remote attackers over HTTP. The Security component vulnerability allows a network-adjacent attacker to skip authentication controls and gain full read access to all Campus Community data, plus limited write access for inserts and deletes. No public exploit code exists and no CISA KEV listing has been observed, but the PR:N/C:H combination makes this a material confidentiality risk for higher education institutions running the affected version.
Full system takeover is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component, exploitable over HTTP by a high-privileged network attacker under high-complexity conditions. Successful exploitation yields complete compromise of confidentiality, integrity, and availability - effectively granting an attacker control over the affected instance. No public exploit code exists and the vulnerability is not listed in CISA KEV; Oracle disclosed this through its Critical Patch Update for July 2026.
Critical data exposure and unauthorized modification in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged, network-authenticated attacker to bypass access controls within the Commonline Loans component via HTTP. Successful exploitation yields complete read and write access to all financial aid data accessible to the application, including sensitive student loan records. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Unauthenticated read access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows remote attackers to retrieve a subset of protected campus data via HTTP without credentials. The 'Authentication Bypass' tag indicates the Security component fails to enforce access controls on at least one network-accessible endpoint, exposing data - likely student records, enrollment data, or PII - to anonymous network queries. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle explicitly characterizes this as 'easily exploitable.'
Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows unauthenticated network attackers via HTTPS to access critical or complete application data through an authentication bypass in the Security component. Disclosed as part of Oracle's Critical Patch Update for July 2026, the CVSS 3.1 score of 5.9 (Medium) reflects high attack complexity (AC:H), meaning exploitation requires specific non-trivial conditions. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthorized data access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows a low-privileged authenticated attacker to read all data accessible within the system via HTTPS against the Communication component. Tagged as an Authentication Bypass by EUVD intelligence, the flaw appears to operate at the authorization layer - an attacker with a valid low-privilege session can exceed their permitted data scope rather than bypass authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a credible insider or credential-theft-follow-on threat for higher education environments.
Local data integrity compromise in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 enables low-privileged users with logon access to the host infrastructure to bypass application-layer authorization controls within the Institutional Methodology Need Analysis component. Successful exploitation permits unauthorized creation, deletion, or modification of critical financial aid records and partial read access to accessible data. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; however, the low attack complexity makes exploitation straightforward for any insider or attacker with an existing host foothold.
Local unauthorized data access in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged authenticated user with logon access to the hosting infrastructure to compromise the FM Need Analysis Calculator component and read critical or complete financial aid data. The Authentication Bypass tag from EUVD-2026-46965 suggests the component fails to enforce authorization boundaries for already-authenticated low-privilege accounts, enabling horizontal or vertical privilege escalation within the application. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at the time of analysis.
Integrity compromise in Oracle PeopleSoft Enterprise FIN Common Objects 9.2 allows a low-privileged local attacker to perform unauthorized creation, deletion, or modification of critical financial data when human interaction from another user is obtained. The vulnerability resides in the Security component and carries a CVSS 3.1 base score of 4.4, reflecting high attack complexity and a local-only attack vector. No public exploit code or active exploitation has been identified at time of analysis, and Oracle has disclosed the issue via its July 2026 Critical Patch Update.