Oracle
Monthly
Oracle GoldenGate exposes critical data to any low-privileged user who can log on to the host running the product, through a weakness in the Vendor Access Module component. Affected builds span three release trains: 19.1.0.0.0 through 19.32.0.0, 21.3 through 21.23, and 23.4 through 23.26.3.0.0; successful exploitation yields high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 5.5). The attack path is strictly local and authenticated (AV:L/PR:L), so external unauthenticated attackers cannot reach it directly, and there is no public exploit identified at time of analysis - a moderate-severity data-exposure issue rather than a mass-exploitable emergency.
Unauthenticated HTTP access to PeopleSoft Financials 9.1 with the Brazil localization (FIN Common Objects) can allow remote attackers to make limited unauthorized updates, inserts, or deletes and cause a partial denial of service, with no confidentiality impact. Oracle rates this CVSS 3.1 base 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), and no public exploit identified at time of analysis. Exposure is limited to organizations running the affected Brazil Common Objects module on a PeopleSoft web tier reachable by the attacker.
Oracle SOA Suite Fabric Layer in versions 12.2.1.4.0 and 14.1.2.0.0 contains a difficult-to-exploit authenticated flaw that lets a low-privileged attacker with HTTPS network access read and modify limited SOA Suite data and cause partial denial of service. The CVSS 3.1 score is 5.0 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L), so exploitation requires a valid low-privileged account and a specialized condition rather than a reliable single request. No public exploit was identified at time of analysis, and impact is bounded to partial confidentiality, integrity, and availability effects.
Confidentiality exposure in Oracle GoldenGate 23.4 through 23.26.2.0.0 allows a high-privileged, authenticated attacker with HTTP access to the Admin Client Executable to read critical data. Oracle rates exploitation as difficult (AC:H) and the vector is confidentiality-only, so practical risk is low and limited to insiders or holders of compromised privileged credentials; no public exploit was identified at time of analysis.
Oracle BI Publisher 12.2.1.4.0 allows a low-privileged authenticated attacker with HTTPS network access to read a limited subset of data exposed through the BI Platform Security component, rated CVSS 4.3. The issue is not anonymously exploitable because the assessed vector requires PR:L, and impact is limited to confidentiality with no write or availability effect. No public exploit code was identified at time of analysis, and the vendor advisory is Oracle's October 2026 Critical Patch Update.
Oracle BI Publisher's Web Server component, in versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, exposes a CVSS 4.7 flaw through which a network-based, unauthenticated attacker can obtain limited unauthorized read access and perform limited insert/update/delete operations against BI Publisher data, with a scope change that may affect additional products. Successful exploitation requires the attacker to induce a user other than themselves to interact with a crafted HTTP request (UI:R) and is explicitly rated as difficult with high attack complexity (AC:H). No public exploit code and no CISA KEV entry were identified at time of analysis, and the mandatory victim interaction plus high complexity keep practical risk low-to-moderate despite network reachability.
Partial denial of service in Oracle BI EE 12.2.1.4.0 is a low-priority, authenticated-only availability issue affecting the BI Foundation component. A low-privileged attacker who already holds an account and can reach the service over HTTP can degrade availability, but the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, score 4.3) shows no confidentiality or integrity impact and no scope change. There is no public exploit identified at time of analysis and no CISA KEV confirmation in the supplied data.
Oracle BI EE 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 contains an HTTP-reachable flaw in the Analytics Web General component that enables a low-privileged authenticated attacker to read a subset of BI-accessible data and perform limited unauthorized updates, inserts, or deletes after inducing another user to interact with crafted content. The scope change raises the possibility of significant impact on additional products, although confidentiality and integrity effects are partial and availability is unaffected. This is a moderate-priority issue for routine patch cycles; no public exploit identified at time of analysis, and no active exploitation is confirmed by the supplied intelligence.
Authenticated data exposure in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a low-privileged user with HTTP access read critical data through the Report Distribution component. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confines impact to confidentiality, and a valid account is required. No public exploit was identified at time of analysis.
Authenticated low-privileged attackers with network access to Oracle BI Publisher's Security component can read a subset of data and perform unauthorized inserts, updates, or deletes on some accessible data in versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), with no availability impact and no user interaction required. At time of analysis, no public exploit identified; exploitation requires valid low-privileged credentials and HTTP access to the affected component.
Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 expose a confidentiality-only flaw in the Web Server component that lets an authenticated low-privileged attacker with HTTP reachability read critical data or all BI Publisher-accessible data. The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects low attack complexity and no user interaction, but the PR:L prerequisite means valid credentials are required, and there is no integrity, availability, or scope impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 contain a high-privilege local vulnerability in the Porting component that lets an attacker with existing elevated credentials and logon access to the host infrastructure read, create, delete, or modify critical PeopleTools data, affecting both confidentiality and integrity (CVSS 3.1 base 6.0). The local attack vector and PR:H requirement mean this is an insider-abuse or post-compromise impact-escalation scenario rather than a remotely reachable flaw, and no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis. Oracle addressed the issue in its October 2026 Critical Patch Update.
Local information disclosure in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged user who can log on to the host running OIM reach critical data through the Installer component, with a high confidentiality impact and no integrity or availability effect. Because the vector is strictly local (AV:L) and requires a valid low-privileged account (PR:L) with no user interaction (UI:N), this is primarily an insider or post-compromise risk rather than a remotely reachable attack surface. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update; it is rated medium severity at CVSS 3.1 base 5.5.
Unauthenticated HTTP requests against the Updates Environment Management component in PeopleSoft Enterprise PeopleTools 8.61-8.63 can modify a limited subset of application data, producing low integrity impact with no confidentiality or availability effect. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confirms that no privileges or user interaction are required, but practical exposure depends on whether the affected PeopleTools interface is network-reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, so the risk is moderate rather than critical.
Hard-to-exploit confidentiality and integrity exposure in Oracle Java SE's Compiler component affects the 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27 releases as well as Oracle GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1, letting a remote attacker who supplies data to the affected APIs read a subset of accessible data and perform unauthorized updates, inserts or deletes. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, base 4.8) reflects no authentication or user-interaction requirement but a high attack complexity that depends on conditions the attacker does not control, so practical exploitability is limited; no public exploit code and no confirmed active exploitation were identified at time of analysis, and Oracle explicitly excludes Untrusted Java Web Start applications and Untrusted Java applets as attack paths.
Local low-privileged users who can log on to a host running PeopleSoft Enterprise FIN General Ledger Brazil 9.1 can tamper with General Ledger data and degrade service availability, with integrity and partial denial-of-service impact but no confidentiality exposure (CVSS 3.1 base score 4.4). The flaw is easily triggered once an attacker already holds valid credentials on the hosting infrastructure, since exploitation requires local access (AV:L) and low privileges (PR:L) with no user interaction; the Brazil-specific GL localization is a narrow deployment, which limits exposure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is addressed through Oracle's October 2026 Critical Patch Update.
Oracle PeopleSoft Enterprise FIN Cash Management 9.2 (component: Cash Management) contains a low-severity flaw that lets an attacker who already holds a high-privileged account with logon access to the application server host tamper with, read, or partially disrupt Cash Management data. Because the vector is local (AV:L) with high attack complexity (AC:H), high privileges (PR:H), and a mandatory action by a separate human user (UI:R), successful exploitation yields only limited confidentiality, integrity, and availability impact (CVSS 3.1 base score 3.8). No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is best treated as an insider-risk and patch-hygiene item rather than an external attack path.
Information disclosure in Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 allows a low-privileged authenticated bidder or supplier account to read critical data beyond its intended scope through the Bidder Registration component over HTTP. Exploitation is straightforward (AC:L, UI:N) but gated by the need for a valid account, and the impact is confidentiality-only - data can be read, not altered or disrupted. No public exploit code or confirmed active exploitation has been identified at time of analysis; Oracle lists the fix in its October 2026 Critical Patch Update.
Oracle PeopleSoft Enterprise SCM Purchasing 9.2 has a medium-severity (CVSS 5.4) weakness in its Supplier Registration component that lets a low-privileged authenticated attacker use HTTP to persuade a different user to interact with malicious content, yielding partial read and limited insert/update/delete access to Purchasing data with possible scope change into connected products. The CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N vector confirms network reachability, low-privileged authentication, and required victim interaction; no public exploit identified at time of analysis and no CISA KEV entry was provided. This should be treated as a routine but non-urgent patch priority rather than an emergency.
Low-privileged authenticated users can read critical or all accessible data in PeopleSoft Enterprise SCM Strategic Sourcing 9.2 through an HTTP-reachable flaw, according to Oracle's October 2026 Critical Patch Update. The CVSS 6.5 rating is confidentiality-only (C:H/I:N/A:N) and requires a valid low-privilege account (PR:L), so it is not exploitable by unauthenticated remote attackers; no public exploit code or confirmed active exploitation is identified in the available intelligence, making this a moderate-priority issue rather than an emergency.
Adjacent-network attackers can trigger a hang or repeatable full crash of the Oracle Database Server RDBMS component in versions 23.4.0 through 23.26.3, producing a complete denial of service. The flaw is easily exploitable - low complexity, no authentication, and no user interaction - but is gated by a network-adjacency precondition: the attacker must sit on the same physical communication segment (Layer-2/local network) as the database hardware, so it is not reachable across routed or internet boundaries. Impact is availability-only (CVSS 3.1 6.5, AV:A/AC:L/PR:N/UI:N/C:N/I:N/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or KEV data was supplied.
Limited confidentiality exposure in Oracle JavaFX 25.0.4 and 27 stems from a high-complexity flaw in the JavaFX component that a network-positioned, unauthenticated attacker can only trigger after a victim loads and runs attacker-supplied sandboxed Java Web Start or applet code; a successful attack yields read access to a subset of JavaFX-accessible data, with no integrity or availability impact. The assessed CVSS 3.1 base score of 3.1 reflects the combined drag of high attack complexity (AC:H), mandatory user interaction (UI:R), and single-scope low confidentiality impact. This is a client-side-only issue that does not affect server deployments running solely administrator-installed trusted code, and no public exploit identified at time of analysis.
Unauthenticated HTTP access to the eProcurement component in PeopleSoft Enterprise FIN Common Objects Brazil 9.1 can disclose a subset of accessible data, with no integrity or availability impact. The issue is remotely exploitable with low complexity and no user interaction (CVSS 3.1 base 5.3), and exposure is limited to deployments of the Brazilian financials localization module that expose eProcurement over the network. No public exploit code or confirmed active exploitation was identified at time of analysis.
Local low-privileged users on hosts running Oracle Outside In Technology 8.5.8 can abuse the Clean Content SDK document-processing path to create, delete, or modify critical data, read a limited subset of accessible data, and cause a partial denial of service. The flaw carries a CVSS 3.1 base score of 6.6 with an integrity-heavy profile (I:H, C:L, A:L) and requires an existing local logon (AV:L, PR:L) without user interaction, making it a moderate local threat rather than a remotely reachable one. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1, specifically the eProcurement component, exposes critical data to a high-privileged attacker who can reach the server over the adjacent network segment. Successful exploitation lets that attacker create, delete, or modify critical records and read all data the module can access, with high confidentiality and integrity impact and no availability impact. The CVSS 3.1 score of 6.1 reflects severe data impact offset by demanding prerequisites: an existing high-privileged account (PR:H) plus physical or adjacent-network access (AV:A), no user interaction (UI:N), and low attack complexity (AC:L) once those are met. No public exploit code or confirmed active exploitation was identified at time of analysis, so risk is concentrated among insiders and attackers who already hold a strong foothold on the PeopleSoft deployment.
Unauthenticated HTTP access to PeopleSoft Enterprise CC Common Application Objects 9.2 can allow limited unauthorized update, insert, or delete operations within the BAM Framework component, but only when high-complexity preconditions are satisfied. The issue carries a CVSS 3.1 score of 3.7 with integrity-only impact and no confidentiality or availability effect; no public exploit identified at time of analysis, and there is no CISA KEV confirmation.
Unauthenticated HTTP requests can modify some data and cause a partial denial of service in the QAS component of PeopleSoft Enterprise PeopleTools 8.61 through 8.63. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), reflecting low integrity and availability impact with no confidentiality impact. No public exploit was identified at time of analysis, and real-world exposure depends on whether the QAS HTTP interface is reachable from untrusted networks.
Physical-access attackers who can convince a legitimate operator to interact with a crafted element can achieve complete takeover of Oracle Fusion Middleware Control 12.2.1.4.0 and 14.1.2.0.0 (Framework component), with high confidentiality, integrity and availability impact under CVSS 3.1 scoring of 6.6. The moderate score is driven almost entirely by the attack vector (AV:P) and the required victim interaction (UI:R) rather than by any weakness in the impact, and no attacker authentication (PR:N) is needed once those two preconditions are met. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; Oracle ships the fix through its October 2026 Critical Patch Update cycle.
High-privileged users of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 can abuse the Asset Management component over HTTP to create, delete, or modify critical records, read data they should not reach, and partially disrupt availability of the module (CVSS 3.1 6.4, Medium). Exploitation is gated by two hard preconditions: the attacker must already hold a high-privilege authenticated account (PR:H) and a separate victim must be induced to interact with the attack (UI:R), so this cannot be triggered unauthenticated or fully automated. No public exploit code was identified and there is no CISA KEV confirmation of active exploitation at time of analysis; the practical exposure is confined to organizations running the Argentina localization of FIN Common Objects on version 9.1.
Unauthorized access to sensitive data in Oracle Java SE (8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) becomes possible when a Java client runtime executes attacker-supplied code inside the sandbox - typically a sandboxed Java Web Start application or applet loaded from the internet - and the JGSS component fails to enforce an intended security boundary. The CVSS 3.1 score is 5.3 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N): reachable over the network by an unauthenticated attacker, but gated by required human interaction and explicitly rated difficult to exploit, with confidentiality-only impact and no integrity or availability effect. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and realistic exposure is sharply limited because the vulnerable configuration (browser applets and Web Start) is deprecated and disabled or absent in most modern environments; server deployments running only administrator-installed trusted code are explicitly out of scope.
Unauthorized access to critical data in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27), Oracle GraalVM for JDK (17.0.20.1 and 21.0.12.1), and Oracle GraalVM Enterprise Edition (21.3.19.1.1) is possible through the JGSS component, but only in client deployments that run sandboxed Java Web Start applications or applets loading untrusted code; servers running only trusted administrator-installed code are explicitly not affected. Oracle describes the flaw as difficult to exploit (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N), requiring no privileges but needing a victim to interact with the malicious application, and no public exploit was identified at time of analysis. Despite the low real-world priority, organizations still using applet or Web Start sandboxes should apply the October 2026 CPU.
Unauthorized modification of critical data in Oracle Java SE's JGSS component affects Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, as well as GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1, allowing a remote, unauthenticated attacker to alter data accessible through the JVM. The flaw is difficult to exploit (CVSS 3.1 base 5.9, AC:H) and requires an application or web service that supplies attacker-controlled network data to JGSS APIs; Oracle states it is not reachable through untrusted Java Web Start applications or applets. No public exploit identified at time of analysis and no CISA KEV active exploitation is confirmed, with impact limited to integrity and no confidentiality or availability effect.
Low-impact integrity modification in Oracle Java SE's JSSE component is possible when an unauthenticated remote attacker can feed crafted data into TLS-handling APIs, but exploitation requires high-complexity, hard-to-control conditions and affects only limited accessible data. The affected releases span Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, plus GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1. No public exploit identified at time of analysis, and the CVSS 3.1 score is 3.7 with no confidentiality or availability impact.
Oracle JD Edwards EnterpriseOne Tools (E1 Dev Platform Tech - UNIX), versions 9.2.0.0 through 9.2.26.5, exposes an HTTP-reachable weakness that lets an unauthenticated remote attacker achieve limited read and limited insert/update/delete access to application-accessible data. Exploitation is not direct: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) shows no authentication barrier but a mandatory human-interaction step, meaning a legitimate user must be induced to engage with attacker-supplied content before the payload succeeds, and there is no availability impact. At CVSS 3.1 base 5.4 this is a routine patch-cycle item rather than an emergency; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated remote attackers can achieve limited, unauthorized modification of data (insert/update/delete) in applications built on the JDK's Lightweight HTTP Server (com.sun.net.httpserver / jdk.httpserver module), affecting Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, as well as Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1 and Oracle GraalVM Enterprise Edition 21.3.19.1.1. The flaw is rated CVSS 3.1 base 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no credentials, no user interaction and no special conditions beyond network reachability, but with impact confined to partial integrity - there is no confidentiality or availability impact and no scope change. Exploitation is only possible where an application actually exposes a reachable service built on this opt-in component and accepts attacker-supplied data through its APIs (for example a web service), not through Untrusted Java Web Start applications or applets, which Oracle explicitly excludes. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied; the practical risk is concentrated in deployments that use the built-in HTTP server as an internet-facing endpoint rather than in general-purpose JDK installations.
Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition can allow an unauthenticated, network-reachable attacker to cause unauthorized updates, inserts, or deletes of data accessible to affected Java Networking APIs. The issue is integrity-only (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) and affects specific Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27 releases, GraalVM for JDK 17.0.20.1 and 21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1. Exploitation requires an application to feed attacker-controlled data into the Networking component server-side, not through untrusted Java Web Start applications or applets; this is a low-to-moderate priority issue despite the ubiquitous affected software. No public exploit identified at time of analysis.
Unauthenticated network attackers can cause limited integrity modification of data in Oracle Java SE and GraalVM deployments that pass attacker-controlled input to the Networking component, affecting specific 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1 releases. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning only partial unauthorized data updates, inserts, or deletes are possible, with no confidentiality or availability impact; exploitation is constrained by the need to reach the affected networking API path outside applet or Java Web Start contexts, such as through a web service. No public exploit code or CISA KEV entry was identified in the provided data, so there is no public exploit identified at time of analysis.
Local privilege escalation in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.9) lets an attacker who already holds high-privileged logon access on the deployment host take over the Siebel CRM Deployment instance, with full confidentiality, integrity, and availability impact confined to that component. The attack is local (AV:L), requires high privileges (PR:H), and needs no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score of 6.7 reflects a moderate-priority issue whose real-world risk is strongly constrained by the mandatory prior privileged foothold on the server.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.9, can be fully compromised - confidentiality, integrity and availability - by an attacker who already holds a high-privileged logon on the host where the deployment component runs. The flaw is not remotely reachable: exploitation requires local access plus administrative credentials (CVSS 3.1 6.7, AV:L/PR:H/UI:N), but once those prerequisites are met, attack complexity is low and no user interaction is needed, making it a realistic post-compromise or insider escalation path rather than an external entry point. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS data was supplied.
Information disclosure in Oracle Siebel CRM Deployment (Server Infrastructure) versions 17.0 through 26.9 allows a low-privileged authenticated attacker with HTTP network access to read critical data accessible to the Siebel CRM Deployment component. The vendor CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is limited to confidentiality with no integrity or availability effect; no public exploit was identified at time of analysis and no CISA KEV entry is present. Although the source tags call this an authentication bypass, the assessed vector requires a valid low-privileged Siebel account, making network exposure and account privilege the primary risk factors.
Oracle Siebel CRM's Customer Order Management component (versions 17.0 through 26.9) contains a medium-severity (CVSS 6.5) flaw that requires a low-privileged authenticated attacker and interaction by another user. Successful exploitation over HTTP can let an attacker read and modify limited Order Management data, cause partial denial of service, and potentially affect additional products because of the scope-change metric. No public exploit was identified at time of analysis; Oracle addressed the issue in its October 2026 Critical Patch Update.
Unauthenticated remote access to Oracle Siebel CRM Deployment Server Infrastructure in versions 17.0 through 26.9 can allow a network attacker to read a limited subset of deployment data and update, insert, or delete some records over HTTP. The CVSS 3.1 score is 6.5 with low confidentiality and integrity impact and no availability impact, and the available Oracle tagging identifies an authentication-bypass condition. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a moderate patching priority rather than an emergency.
Information disclosure in Siebel CRM Deployment 17.0 through 26.9 lets a low-privileged attacker who can log on locally to the deployment server read critical data accessible to the Server Infrastructure component. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms local, authenticated access is required and that only confidentiality is affected; there is no remote or unauthenticated path. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE.
Limited unauthorized read/write access and partial denial of service in Oracle Siebel CRM Deployment 17.0 through 26.9 require an attacker to already hold high-privileged logon access to the infrastructure host running the Server Infrastructure component. The CVSS 3.9 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) confirms a local, difficult-to-exploit path with low confidentiality, integrity, and availability impact, so practical risk is confined to privileged local operators or an adversary who has already compromised such an account. No public exploit identified at time of analysis; the vendor reference is Oracle's October 2026 Critical Patch Update advisory.
Authenticated low-privileged HTTP requests to Oracle Siebel CRM Deployment's Server Infrastructure component can hang or repeatedly crash the service, producing a complete denial of service across all supported releases 17.0 through 26.9 (CVSS 3.1 base 6.5). The attack is network-reachable and low-complexity with no user interaction, but it requires valid low-privileged credentials (PR:L), so risk is bounded to authenticated users, compromised accounts, and malicious insiders rather than anonymous internet attackers. Impact is availability-only - no data disclosure or modification - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 can be taken over by an attacker who already holds a high-privileged account and has interactive logon access to the infrastructure host where the component executes. The issue is rated CVSS 3.1 base 6.7 with high confidentiality, integrity, and availability impact, but the local attack vector (AV:L) and high-privilege prerequisite (PR:H) sharply constrain the realistic attacker population to insiders or actors who already have a foothold. No public exploit identified at time of analysis; no CISA KEV entry is present in the provided data.
Unauthenticated HTTP access to Oracle Siebel CRM's Open UI in versions 17.0 through 26.9 can let an attacker read and modify a limited subset of application data, with CVSS 6.5 reflecting partial confidentiality and integrity impact and no availability effect. The flaw is remotely reachable without credentials or user interaction, so exposed Open UI endpoints are the main exposure point; Oracle's October 2026 Critical Patch Update advisory is the listed vendor reference, and no public exploit has been identified at time of analysis.
Confidential data disclosure in Oracle Siebel CRM's End User Open UI affects versions 17.0 through 26.9, allowing a low-privileged user with local logon access to the Siebel infrastructure to read critical data. The CVSS 3.1 score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so the issue is local, requires valid credentials, and has no integrity or availability impact. No public exploit was identified at time of analysis.
Unauthorized access to critical data in Oracle Siebel CRM's Siebel Apps - Financial Services (Financial Accounts component) is possible for unauthenticated remote attackers in versions 17.0 through 26.9, although Oracle rates exploitation as difficult due to AC:H. Successful attacks could expose all accessible Financial Services data and permit limited unauthorized inserts, updates, or deletes, producing a CVSS 3.1 score of 6.5. No public exploit identified at time of analysis, and no CISA KEV entry was provided; risk is materially higher where the Financial Accounts HTTP interface is internet-facing rather than restricted to internal or VPN access.
Oracle Siebel CRM Deployment 17.0 through 26.9 contains a hard-to-exploit, unauthenticated HTTP-exposed weakness in the Server Infrastructure component that can give an attacker high confidentiality access and limited integrity impact. With CVSS 3.1 score 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N), the issue is constrained by high attack complexity and has no availability impact. No public exploit identified at time of analysis, and no CISA KEV entry was provided; Oracle's October 2026 Critical Patch Update is the vendor fix.
Unauthenticated remote attackers can trick a logged-in Siebel CRM End User into an action that results in unauthorized insert, update, or delete of a limited subset of that user's accessible data in the Open UI component (versions 17.0 through 26.9). The attack is delivered over HTTP with low complexity, but requires victim interaction (UI:R) and affects only integrity - confidentiality and availability are untouched, keeping the CVSS 3.1 base score at 4.3. No public exploit code or confirmed active exploitation was identified at time of analysis, and the mandatory human-interaction prerequisite plus the narrowly scoped write-only impact make this a low-priority item relative to other Siebel issues.
A locally reachable flaw in Oracle Siebel CRM Deployment's Server Infrastructure component lets an attacker who already holds high privileges and can log on to the host cause a partial denial of service, degrading availability of the deployment service. Only supported Siebel CRM Deployment releases 17.0 through 26.9 are affected, and the CVSS 3.1 base score is 2.3 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), reflecting a local-only attack path, a high pre-existing privilege requirement, and no confidentiality or integrity impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a low-priority hardening item rather than an urgent exposure, though it should still be closed out in the routine Oracle Critical Patch Update cycle.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 expose confidential data to any low-privileged user who can log on locally to the host where the Siebel server infrastructure runs. No user interaction or elevated privileges are needed, and a successful attack yields read access to critical Siebel CRM Deployment data with no integrity or availability impact (CVSS 3.1 base 5.5, C:H/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical barrier remains that the attacker must already hold a local account on the Siebel server host.
Oracle Siebel CRM Deployment releases 17.0 through 26.9 expose a Server Infrastructure weakness that lets a low-privilege user with HTTP access hang or repeatedly crash the component while also reading and modifying a limited subset of data it manages. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, base 6.4) shows the attack is remote but gated by a valid low-privilege Siebel account and by a high-complexity precondition such as a race window or a particular server state the attacker does not fully control, so the availability impact dominates (A:H) while confidentiality and integrity effects stay low. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation; this is a moderate-severity, moderate-priority issue rather than a top-tier emergency, with the highest practical risk in deployments where the Siebel server is internet-facing or broadly reachable from the corporate network and low-privilege accounts are liberally provisioned.
Oracle Siebel CRM Deployment 17.0 through 26.9 contains a local high-privilege access-control weakness that can let an attacker who already has logon access to the Siebel host read and modify critical deployment data. Exploitation is not network-reachable and requires a pre-existing high-privileged local foothold, so realistic risk is limited to malicious insiders or attackers who have already compromised a privileged account. No public exploit code or CISA KEV entry was identified at time of analysis.
Low-privileged authenticated users can tamper with critical deployment data in Oracle Siebel CRM Deployment (Server Infrastructure) versions 17.0 through 26.9 via HTTP, although high attack complexity makes reliable exploitation difficult. The flaw affects integrity only, with no confidentiality or availability impact, and requires a valid account on the target instance. No public exploit code or CISA KEV entry was identified at time of analysis; CVSS 3.1 base score is 5.3.
Denial of service affecting Oracle Siebel CRM Deployment versions 17.0 through 26.9 allows an unauthenticated, network-positioned attacker to hang or repeatedly crash the Deployment Server Infrastructure over HTTP. The CVSS 3.1 score is 5.9 with a high attack-complexity rating, meaning success depends on server-state, timing, or request characteristics outside the attacker's direct control, and impact is limited to availability with no confidentiality, integrity, or code-execution effect. No public exploit code was identified at time of analysis, and this is a moderate-severity availability issue rather than a top-priority compromise risk.
Authenticated low-privileged users can create, modify, or delete critical data in the Siebel CRM Deployment Server Infrastructure component of Oracle Siebel CRM versions 17.0 through 26.9 by sending crafted requests over the HTTP interface. The flaw is rated CVSS 3.1 6.5 with an integrity-only impact (C:N/I:H/A:N) and is easily exploitable once a valid low-privilege credential or session is obtained - it is not confirmed as unauthenticated despite the 'Authentication Bypass' tag attached to the report. No public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis, making this a moderate-priority integrity risk concentrated on internet-facing Siebel application servers.
Partial denial of service in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle JavaFX (21.0.12, 25.0.4, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) is reachable by unauthenticated remote attackers who can get attacker-controlled image data into the ImageIO component, either through a web service or API that decodes supplied data or through sandboxed Web Start/applet code loading untrusted content. Impact is confined to availability - a partial denial of service (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L) with no confidentiality or integrity effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is limited to JVMs that actually parse untrusted images.
Partial denial of service in Oracle Java SE 8u503/8u503-perf and Oracle GraalVM Enterprise Edition 21.3.19.1.1 is reachable by unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base score 5.3) who can supply crafted data into the CORBA component's APIs, typically through a CORBA/IIOP-based service or a web service that passes untrusted input to those APIs. The flaw cannot be triggered via untrusted Java Web Start applications or applets, so only server-side or service-side CORBA data paths are in scope; confidentiality and integrity are unaffected and the impact stops at a partial availability loss. No public exploit code or CISA KEV entry was identified at time of analysis, and the practical attack surface is narrow because CORBA is legacy and rarely network-exposed in modern Java deployments.
Oracle Siebel CRM Deployment (Server Infrastructure) versions 17.0 through 26.9 expose critical data to unauthenticated network attackers who can persuade another user to take an action, such as opening an attacker-supplied link or request. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a high-complexity, confidentiality-only issue: no attacker credentials are required, but success depends on victim interaction and additional conditions outside the attacker's control, so unattended mass exploitation is unlikely. No public exploit identified at time of analysis; Oracle's October 2026 Critical Patch Update is the remediation reference.
High-privileged attackers with network access to the CORBA interface can hang or repeatedly crash Oracle Siebel CRM Development versions 17.0 through 26.9 through the Integration - Scripting component, while also obtaining limited read and write access to a subset of application data. The CVSS 3.1 base score is 6.0 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H), and no public exploit was identified at the time of analysis.
Critical data exposure in Oracle Siebel CRM's Open UI component affects versions 17.0 through 26.9, where an authenticated low-privileged attacker with HTTP access can read critical or all user-accessible data. The flaw is low-complexity and needs no user interaction but requires a valid low-privilege account (CVSS 6.5 Medium, confidentiality-only); no public exploit identified at time of analysis.
Untrusted input that reaches Java's JGSS (GSS-API / Kerberos) security services can hang or repeatedly crash a JVM and, to a limited degree, alter data the component handles, affecting Oracle Java SE 8u503, 8u503-perf and 11.0.32.1, Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition 21.3.19.1.1. Oracle scores this 6.5 on an AV:N/AC:H/PR:N/UI:N vector with C:N/I:L/A:H - no credentials or user interaction are needed, but the high attack complexity means successful exploitation depends on crafted tokens combined with timing or state conditions rather than one deterministic request, and realistic exposure is confined to deployments that actually feed attacker-controlled data into the JGSS path (for example a web service supplying data to those APIs, or sandboxed Web Start/JApplet code loading untrusted content). No public exploit code and no CISA KEV entry were identified at time of analysis, so this reads as a lower-priority, difficult-to-exploit hardening item - availability-weighted but not an urgent, actively exploited threat.
Partial denial of service in Oracle Java SE affects the Libraries component in 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1, plus Oracle GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1. An unauthenticated, network-positioned attacker can degrade availability only by supplying crafted input to an application that exposes the affected Libraries API, such as a web service; no confidentiality or integrity impact or code execution is expected. No public exploit code or CISA KEV confirmation was identified at time of analysis, and the issue is a moderate availability risk rather than an emergency remote-code-execution class flaw.
Partial denial of service in Oracle Java SE 27's Networking component can be triggered by unauthenticated remote attackers who can reach an exposed Java API and supply crafted network data; the CVSS 3.1 score is 3.7 with AC:H and only A:L, so successful exploitation is difficult and produces limited, recoverable availability impact. The flaw also matters for deployments that run untrusted code in the Java sandbox, such as Java Web Start applications or applets. No public exploit was identified at time of analysis and there is no CISA KEV confirmation.
Local information disclosure in Oracle Outside In Technology 8.5.8 allows an attacker who already holds a logon to the host to read a restricted subset of data accessible to the Outside In PDF Export SDK, with no integrity or availability impact. The flaw sits in the PDF Export SDK component of Oracle Fusion Middleware and is rated CVSS 3.1 base 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting low confidentiality impact only and a hard dependency on local access. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; practical risk is limited to environments where applications embed the SDK to convert attacker-influenced documents on shared or insufficiently segmented hosts.
Information disclosure in Oracle JavaFX - and in the Oracle Java SE 8u503 and GraalVM Enterprise Edition 21.3.19.1.1 releases that ship it - allows an unauthenticated, network-positioned attacker to read a limited subset of data, but only when a human victim loads and runs attacker-supplied code inside a sandboxed Java applet or Java Web Start application. The CVSS 3.1 score is 3.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N), reflecting high attack complexity and mandatory user interaction; the issue does not affect server deployments that execute only administrator-installed trusted code. No public exploit code or active exploitation (CISA KEV) was identified at time of analysis, and the near-total retirement of the applet/Web Start model keeps real-world exposure very small.
A partial denial of service can be triggered in the Sound component of Oracle Java SE (8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) by an unauthenticated, network-positioned attacker who convinces a user to load and run untrusted code inside the Java sandbox. Oracle explicitly scopes the issue to client-side deployments using sandboxed Java Web Start applications or applets; servers that only execute administrator-installed trusted code are not affected, and the only achievable outcome is a partial loss of availability, with no confidentiality or integrity impact. The attack is rated high-complexity (AC:H) and requires victim interaction (UI:R), and no public exploit identified at time of analysis; given the deprecated applet/Web Start attack surface and the availability-only impact, this is a low-priority issue despite the ubiquity of the platform.
Post-authentication integrity tampering in Oracle Primavera P6 Enterprise Project Portfolio Management (Web Access component) allows a low-privileged user with ordinary HTTP/HTTPS reachability to update, insert, or delete data they should not be permitted to modify across the 21.12, 22.12, 23.12, 24.12, and 25.12 release trains. The flaw is low complexity with no user interaction required, but it is gated behind a valid low-tier account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3), so it is a post-login authorization gap rather than a remote unauthenticated compromise; confidentiality and availability are unaffected. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); metadata tags label it 'Authentication Bypass', but the assessed vector indicates the practical risk is unauthorized modification of project data by an already-authenticated low-privilege user.
Integrity-only manipulation of critical data in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27) and GraalVM for JDK/Enterprise Edition stems from SOCKS5 handling in the Networking component. An unauthenticated network attacker who can feed attacker-controlled data into the SOCKS5 code path may create, delete, or modify critical data, with a scope change that can affect additional products; Oracle rates exploitation as difficult (AC:H). No public exploit was identified at time of analysis, and no KEV confirmation is available.
Oracle Java SE and GraalVM deployments are exposed to limited integrity and availability impact through the Serviceability component. An unauthenticated attacker who can log on locally to the affected host-or who persuades another user to run a sandboxed Java Web Start application or sandboxed applet that feeds untrusted data to the vulnerable APIs-can cause unauthorized data modification and partial denial of service. Affected builds include Oracle Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, plus specified GraalVM releases; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated network attackers can cause partial integrity and availability impact in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1), and Oracle GraalVM Enterprise Edition (21.3.19.1.1) by supplying malicious input to Utility-component APIs. The CVSS 3.1 score is 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L; no public exploit was identified at time of analysis. Practical exploitation depends on an application exposing the affected APIs to untrusted data, or on legacy sandboxed Java Web Start/applet deployments that execute untrusted code.
Unauthenticated remote attackers can cause limited unauthorized data modification and partial denial of service in Oracle Java SE and GraalVM deployments by supplying crafted data to APIs in the Utility component. Affected releases include Oracle Java SE 8u503, 8u503-perf, and 11.0.32.1; Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1; and Oracle GraalVM Enterprise Edition 21.3.19.1.1. Oracle disclosed the issue in its October 2026 Critical Patch Update, and no public exploit has been identified at time of analysis.
A confidentiality-only information disclosure flaw exists in the Networking component of Oracle Java SE (11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27) and Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1), rated CVSS 3.1 base 5.9. Successful exploitation allows an unauthenticated network attacker to read critical data or gain complete access to all data reachable by the affected Java runtime, but Oracle classifies the issue as 'Difficult to exploit' (AC:H) because success depends on special conditions such as specific data flows into the Networking APIs, and no public exploit code or active exploitation has been identified at time of analysis. Exposure is greatest for applications or web services that pass untrusted input into the Networking component APIs, and for sandboxed Java Web Start or applet deployments that load untrusted code and rely on the Java sandbox for security.
Siebel CRM End User versions 17.0 through 26.9 contain an integrity-only flaw in the Open UI component that can let unauthenticated network attackers modify limited records if a legitimate user is induced to interact with attacker-controlled content. The CVSS 3.1 score is 3.1 with high attack complexity and a user-interaction requirement, and the supplied intelligence shows no public exploit code or CISA KEV confirmation. Practical risk is low because exploitation depends on tricking an active Siebel user and on conditions outside the attacker's control, with no confidentiality or availability impact.
Unauthorized update, insert, or delete access to some Oracle Siebel CRM End User data is possible through the Open UI component in versions 17.0 through 26.9. The issue is network-reachable over HTTP and requires no credentials or user interaction, but Oracle characterizes it as difficult to exploit because of high attack complexity; impact is integrity-only with a CVSS 3.1 base score of 3.7 and no confidentiality or availability effect. No public exploit code was identified at time of analysis.
Oracle Siebel CRM's Open UI component (End User product, versions 17.0 through 26.9) permits unauthenticated remote attackers with HTTP access to read a limited subset of application data, with no integrity or availability impact. Exploitation is rated high complexity (AC:H), meaning success hinges on specific conditions Oracle has not disclosed, so reliable attacks are difficult. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the CVSS 3.1 base score of 3.7 reflects the narrow confidentiality-only exposure.
Siebel CRM Open UI exposes a low-privileged, network-reachable weakness that lets an attacker with a valid low-privilege account craft HTTP content and rely on a different user, such as an agent or administrator, to interact with it, thereby gaining unauthorized read access and limited insert/update/delete capability in that victim's context. The scope change means the impact can extend to products integrated with Siebel, although confidentiality and integrity effects are partial and availability is unaffected. No public exploit was identified at time of analysis, so this is a moderate-severity, mid-tier-priority issue rather than a drop-everything emergency.
Oracle Siebel CRM's Open UI component (End User, versions 17.0 through 26.9) mishandles attacker-supplied content in a way that lets a low-privileged authenticated user cause unauthorized reads and limited insert/update/delete changes to data visible to a different user, with the impact crossing a security scope boundary into other products. Exploitation is over HTTP, requires a valid low-privileged Siebel account, and critically depends on a second user interacting with the crafted content in their own session (UI:R). No public exploit code or confirmed active exploitation was identified at time of analysis; Oracle addresses the issue in its October 2026 Critical Patch Update.
Unauthorized data modification and limited data disclosure in Oracle Siebel CRM End User (Open UI) can be triggered by an unauthenticated network attacker who convinces a legitimate user to interact with crafted content. Supported versions 17.0 through 26.9 are affected; Oracle rates the attack as high complexity and requires user interaction, with a scope change that may extend impact to integrated products. No public exploit code or CISA KEV entry is identified in the available data, and the 4.7 score reflects low confidentiality and integrity impact without availability loss.
Authenticated low-privileged users of Oracle Siebel CRM End User 17.0 through 26.9 can bypass intended Open UI access controls to read and modify data beyond their authorized scope. The issue is network-reachable over HTTP with low complexity and no user interaction, but requires a valid low-privilege session; impact is partial confidentiality and integrity loss with no availability impact (CVSS 5.4). This is a medium-severity authenticated access-control flaw rather than a top-priority emergency, and no public exploit or CISA KEV active-exploitation confirmation is present in the provided data.
Unauthenticated attackers with access to the same physical network segment as JD Edwards EnterpriseOne Orchestrator 9.2.0.0 through 9.2.26.5 can read and modify critical Orchestrator data, although high attack complexity limits practical exploitation. The issue is rated CVSS 3.1 6.8 Medium with vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. No public exploit was identified at time of analysis, and there is no CISA KEV entry.
Sandbox restrictions in Oracle Java SE 8u503, Oracle JavaFX 21.0.12/25.0.4/27, and Oracle GraalVM Enterprise Edition 21.3.19.1.1 can be bypassed by untrusted code that a victim loads through Java Web Start or Java applets, letting an unauthenticated network attacker read and modify some accessible data. The CVSS 3.1 score is 5.4 with UI:R, and the flaw does not affect server deployments that run only trusted code; no public exploit identified at time of analysis (not in CISA KEV).
Oracle JD Edwards EnterpriseOne Tools builds 9.2.0.0 through 9.2.26.5 expose a confidentiality weakness in the Web Runtime SEC component reachable over the JDENET protocol, letting an authenticated low-privileged attacker read data well beyond their intended authorisation scope - up to all EnterpriseOne Tools-accessible data. Rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the bug is easy to trigger once valid credentials and network access to JDENET exist, and no user interaction is required. Exploitation status: no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied in the available intelligence; the realistic risk is concentrated in deployments that expose JDENET broadly and permit loosely governed low-privilege ERP accounts.
JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 contains a difficult-to-exploit security weakness in the Monitoring and Diagnostics SEC component that lets a high-privileged attacker with HTTP network access read critical data and make limited updates, with scope change potentially affecting additional products. The CVSS 3.1 score is 6.6 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N), requiring an already privileged account and high attack complexity. No public exploit code or CISA KEV entry was identified at time of analysis; EPSS was not provided.
Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) contain an input-handling weakness in the 2D component that a remote, unauthenticated attacker can reach over the network through multiple protocols, resulting in unauthorized creation, deletion or modification of critical data plus a partial denial of service. Oracle rates the flaw 'difficult to exploit' (CVSS 3.1 6.5, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L), so success depends on conditions the attacker cannot directly control - in practice the target must route attacker-supplied data into the 2D APIs, or run untrusted code inside the Java sandbox via applets or Web Start. No public exploit code or active exploitation was identified at time of analysis, and this is a patch-on-normal-cycle issue rather than an emergency.
A hard-to-exploit integrity flaw in the 2D component of Oracle Java SE 8u503 and 8u503-perf, and Oracle GraalVM Enterprise Edition 21.3.19.1.1, allows an unauthenticated network attacker to make limited unauthorized modifications to data accessible to the Java runtime. Exploitation is not straightforward: it requires attacker-controlled data to reach the affected 2D APIs - typically through an application or web service that passes external input into graphics/2D routines, or through sandboxed Web Start applications and applets that load untrusted code - and success depends on conditions outside the attacker's control (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and impact is confined to limited integrity change with no confidentiality or availability effect (CVSS 3.7), so real-world priority is low.
Limited unauthorized read and modification of accessible data affects Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition through a difficult-to-exploit local flaw in the Utility component. Affected releases include Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27; GraalVM for JDK 17.0.20.1 and 21.0.12.1; and GraalVM Enterprise Edition 21.3.19.1.1. Exploitation requires prior local logon access, is assessed as high-complexity, and has no public exploit identified at time of analysis, making this a low-to-moderate priority despite the platform's criticality.
Integrity-only sandbox bypass in Oracle Java SE (8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27), GraalVM for JDK (17.0.20.1, 21.0.12.1) and GraalVM Enterprise Edition (21.3.19.1.1) lets an unauthenticated attacker who can log on to the host tamper with, create or delete data that the JVM can reach - but only in deployments that still load and execute untrusted sandboxed content such as Java Web Start applications or applets, and only after a victim is persuaded to launch that content. Attack complexity is High, no confidentiality or availability impact is possible, and ordinary server deployments that run only administrator-installed code are explicitly out of scope. No public exploit code identified at time of analysis, and fixes are delivered through the referenced Oracle Critical Patch Update (October 2026).
Oracle GoldenGate exposes critical data to any low-privileged user who can log on to the host running the product, through a weakness in the Vendor Access Module component. Affected builds span three release trains: 19.1.0.0.0 through 19.32.0.0, 21.3 through 21.23, and 23.4 through 23.26.3.0.0; successful exploitation yields high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 5.5). The attack path is strictly local and authenticated (AV:L/PR:L), so external unauthenticated attackers cannot reach it directly, and there is no public exploit identified at time of analysis - a moderate-severity data-exposure issue rather than a mass-exploitable emergency.
Unauthenticated HTTP access to PeopleSoft Financials 9.1 with the Brazil localization (FIN Common Objects) can allow remote attackers to make limited unauthorized updates, inserts, or deletes and cause a partial denial of service, with no confidentiality impact. Oracle rates this CVSS 3.1 base 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), and no public exploit identified at time of analysis. Exposure is limited to organizations running the affected Brazil Common Objects module on a PeopleSoft web tier reachable by the attacker.
Oracle SOA Suite Fabric Layer in versions 12.2.1.4.0 and 14.1.2.0.0 contains a difficult-to-exploit authenticated flaw that lets a low-privileged attacker with HTTPS network access read and modify limited SOA Suite data and cause partial denial of service. The CVSS 3.1 score is 5.0 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L), so exploitation requires a valid low-privileged account and a specialized condition rather than a reliable single request. No public exploit was identified at time of analysis, and impact is bounded to partial confidentiality, integrity, and availability effects.
Confidentiality exposure in Oracle GoldenGate 23.4 through 23.26.2.0.0 allows a high-privileged, authenticated attacker with HTTP access to the Admin Client Executable to read critical data. Oracle rates exploitation as difficult (AC:H) and the vector is confidentiality-only, so practical risk is low and limited to insiders or holders of compromised privileged credentials; no public exploit was identified at time of analysis.
Oracle BI Publisher 12.2.1.4.0 allows a low-privileged authenticated attacker with HTTPS network access to read a limited subset of data exposed through the BI Platform Security component, rated CVSS 4.3. The issue is not anonymously exploitable because the assessed vector requires PR:L, and impact is limited to confidentiality with no write or availability effect. No public exploit code was identified at time of analysis, and the vendor advisory is Oracle's October 2026 Critical Patch Update.
Oracle BI Publisher's Web Server component, in versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, exposes a CVSS 4.7 flaw through which a network-based, unauthenticated attacker can obtain limited unauthorized read access and perform limited insert/update/delete operations against BI Publisher data, with a scope change that may affect additional products. Successful exploitation requires the attacker to induce a user other than themselves to interact with a crafted HTTP request (UI:R) and is explicitly rated as difficult with high attack complexity (AC:H). No public exploit code and no CISA KEV entry were identified at time of analysis, and the mandatory victim interaction plus high complexity keep practical risk low-to-moderate despite network reachability.
Partial denial of service in Oracle BI EE 12.2.1.4.0 is a low-priority, authenticated-only availability issue affecting the BI Foundation component. A low-privileged attacker who already holds an account and can reach the service over HTTP can degrade availability, but the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, score 4.3) shows no confidentiality or integrity impact and no scope change. There is no public exploit identified at time of analysis and no CISA KEV confirmation in the supplied data.
Oracle BI EE 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 contains an HTTP-reachable flaw in the Analytics Web General component that enables a low-privileged authenticated attacker to read a subset of BI-accessible data and perform limited unauthorized updates, inserts, or deletes after inducing another user to interact with crafted content. The scope change raises the possibility of significant impact on additional products, although confidentiality and integrity effects are partial and availability is unaffected. This is a moderate-priority issue for routine patch cycles; no public exploit identified at time of analysis, and no active exploitation is confirmed by the supplied intelligence.
Authenticated data exposure in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a low-privileged user with HTTP access read critical data through the Report Distribution component. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confines impact to confidentiality, and a valid account is required. No public exploit was identified at time of analysis.
Authenticated low-privileged attackers with network access to Oracle BI Publisher's Security component can read a subset of data and perform unauthorized inserts, updates, or deletes on some accessible data in versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), with no availability impact and no user interaction required. At time of analysis, no public exploit identified; exploitation requires valid low-privileged credentials and HTTP access to the affected component.
Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 expose a confidentiality-only flaw in the Web Server component that lets an authenticated low-privileged attacker with HTTP reachability read critical data or all BI Publisher-accessible data. The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects low attack complexity and no user interaction, but the PR:L prerequisite means valid credentials are required, and there is no integrity, availability, or scope impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 contain a high-privilege local vulnerability in the Porting component that lets an attacker with existing elevated credentials and logon access to the host infrastructure read, create, delete, or modify critical PeopleTools data, affecting both confidentiality and integrity (CVSS 3.1 base 6.0). The local attack vector and PR:H requirement mean this is an insider-abuse or post-compromise impact-escalation scenario rather than a remotely reachable flaw, and no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis. Oracle addressed the issue in its October 2026 Critical Patch Update.
Local information disclosure in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged user who can log on to the host running OIM reach critical data through the Installer component, with a high confidentiality impact and no integrity or availability effect. Because the vector is strictly local (AV:L) and requires a valid low-privileged account (PR:L) with no user interaction (UI:N), this is primarily an insider or post-compromise risk rather than a remotely reachable attack surface. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update; it is rated medium severity at CVSS 3.1 base 5.5.
Unauthenticated HTTP requests against the Updates Environment Management component in PeopleSoft Enterprise PeopleTools 8.61-8.63 can modify a limited subset of application data, producing low integrity impact with no confidentiality or availability effect. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confirms that no privileges or user interaction are required, but practical exposure depends on whether the affected PeopleTools interface is network-reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, so the risk is moderate rather than critical.
Hard-to-exploit confidentiality and integrity exposure in Oracle Java SE's Compiler component affects the 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27 releases as well as Oracle GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1, letting a remote attacker who supplies data to the affected APIs read a subset of accessible data and perform unauthorized updates, inserts or deletes. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, base 4.8) reflects no authentication or user-interaction requirement but a high attack complexity that depends on conditions the attacker does not control, so practical exploitability is limited; no public exploit code and no confirmed active exploitation were identified at time of analysis, and Oracle explicitly excludes Untrusted Java Web Start applications and Untrusted Java applets as attack paths.
Local low-privileged users who can log on to a host running PeopleSoft Enterprise FIN General Ledger Brazil 9.1 can tamper with General Ledger data and degrade service availability, with integrity and partial denial-of-service impact but no confidentiality exposure (CVSS 3.1 base score 4.4). The flaw is easily triggered once an attacker already holds valid credentials on the hosting infrastructure, since exploitation requires local access (AV:L) and low privileges (PR:L) with no user interaction; the Brazil-specific GL localization is a narrow deployment, which limits exposure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is addressed through Oracle's October 2026 Critical Patch Update.
Oracle PeopleSoft Enterprise FIN Cash Management 9.2 (component: Cash Management) contains a low-severity flaw that lets an attacker who already holds a high-privileged account with logon access to the application server host tamper with, read, or partially disrupt Cash Management data. Because the vector is local (AV:L) with high attack complexity (AC:H), high privileges (PR:H), and a mandatory action by a separate human user (UI:R), successful exploitation yields only limited confidentiality, integrity, and availability impact (CVSS 3.1 base score 3.8). No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is best treated as an insider-risk and patch-hygiene item rather than an external attack path.
Information disclosure in Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 allows a low-privileged authenticated bidder or supplier account to read critical data beyond its intended scope through the Bidder Registration component over HTTP. Exploitation is straightforward (AC:L, UI:N) but gated by the need for a valid account, and the impact is confidentiality-only - data can be read, not altered or disrupted. No public exploit code or confirmed active exploitation has been identified at time of analysis; Oracle lists the fix in its October 2026 Critical Patch Update.
Oracle PeopleSoft Enterprise SCM Purchasing 9.2 has a medium-severity (CVSS 5.4) weakness in its Supplier Registration component that lets a low-privileged authenticated attacker use HTTP to persuade a different user to interact with malicious content, yielding partial read and limited insert/update/delete access to Purchasing data with possible scope change into connected products. The CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N vector confirms network reachability, low-privileged authentication, and required victim interaction; no public exploit identified at time of analysis and no CISA KEV entry was provided. This should be treated as a routine but non-urgent patch priority rather than an emergency.
Low-privileged authenticated users can read critical or all accessible data in PeopleSoft Enterprise SCM Strategic Sourcing 9.2 through an HTTP-reachable flaw, according to Oracle's October 2026 Critical Patch Update. The CVSS 6.5 rating is confidentiality-only (C:H/I:N/A:N) and requires a valid low-privilege account (PR:L), so it is not exploitable by unauthenticated remote attackers; no public exploit code or confirmed active exploitation is identified in the available intelligence, making this a moderate-priority issue rather than an emergency.
Adjacent-network attackers can trigger a hang or repeatable full crash of the Oracle Database Server RDBMS component in versions 23.4.0 through 23.26.3, producing a complete denial of service. The flaw is easily exploitable - low complexity, no authentication, and no user interaction - but is gated by a network-adjacency precondition: the attacker must sit on the same physical communication segment (Layer-2/local network) as the database hardware, so it is not reachable across routed or internet boundaries. Impact is availability-only (CVSS 3.1 6.5, AV:A/AC:L/PR:N/UI:N/C:N/I:N/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or KEV data was supplied.
Limited confidentiality exposure in Oracle JavaFX 25.0.4 and 27 stems from a high-complexity flaw in the JavaFX component that a network-positioned, unauthenticated attacker can only trigger after a victim loads and runs attacker-supplied sandboxed Java Web Start or applet code; a successful attack yields read access to a subset of JavaFX-accessible data, with no integrity or availability impact. The assessed CVSS 3.1 base score of 3.1 reflects the combined drag of high attack complexity (AC:H), mandatory user interaction (UI:R), and single-scope low confidentiality impact. This is a client-side-only issue that does not affect server deployments running solely administrator-installed trusted code, and no public exploit identified at time of analysis.
Unauthenticated HTTP access to the eProcurement component in PeopleSoft Enterprise FIN Common Objects Brazil 9.1 can disclose a subset of accessible data, with no integrity or availability impact. The issue is remotely exploitable with low complexity and no user interaction (CVSS 3.1 base 5.3), and exposure is limited to deployments of the Brazilian financials localization module that expose eProcurement over the network. No public exploit code or confirmed active exploitation was identified at time of analysis.
Local low-privileged users on hosts running Oracle Outside In Technology 8.5.8 can abuse the Clean Content SDK document-processing path to create, delete, or modify critical data, read a limited subset of accessible data, and cause a partial denial of service. The flaw carries a CVSS 3.1 base score of 6.6 with an integrity-heavy profile (I:H, C:L, A:L) and requires an existing local logon (AV:L, PR:L) without user interaction, making it a moderate local threat rather than a remotely reachable one. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1, specifically the eProcurement component, exposes critical data to a high-privileged attacker who can reach the server over the adjacent network segment. Successful exploitation lets that attacker create, delete, or modify critical records and read all data the module can access, with high confidentiality and integrity impact and no availability impact. The CVSS 3.1 score of 6.1 reflects severe data impact offset by demanding prerequisites: an existing high-privileged account (PR:H) plus physical or adjacent-network access (AV:A), no user interaction (UI:N), and low attack complexity (AC:L) once those are met. No public exploit code or confirmed active exploitation was identified at time of analysis, so risk is concentrated among insiders and attackers who already hold a strong foothold on the PeopleSoft deployment.
Unauthenticated HTTP access to PeopleSoft Enterprise CC Common Application Objects 9.2 can allow limited unauthorized update, insert, or delete operations within the BAM Framework component, but only when high-complexity preconditions are satisfied. The issue carries a CVSS 3.1 score of 3.7 with integrity-only impact and no confidentiality or availability effect; no public exploit identified at time of analysis, and there is no CISA KEV confirmation.
Unauthenticated HTTP requests can modify some data and cause a partial denial of service in the QAS component of PeopleSoft Enterprise PeopleTools 8.61 through 8.63. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), reflecting low integrity and availability impact with no confidentiality impact. No public exploit was identified at time of analysis, and real-world exposure depends on whether the QAS HTTP interface is reachable from untrusted networks.
Physical-access attackers who can convince a legitimate operator to interact with a crafted element can achieve complete takeover of Oracle Fusion Middleware Control 12.2.1.4.0 and 14.1.2.0.0 (Framework component), with high confidentiality, integrity and availability impact under CVSS 3.1 scoring of 6.6. The moderate score is driven almost entirely by the attack vector (AV:P) and the required victim interaction (UI:R) rather than by any weakness in the impact, and no attacker authentication (PR:N) is needed once those two preconditions are met. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; Oracle ships the fix through its October 2026 Critical Patch Update cycle.
High-privileged users of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 can abuse the Asset Management component over HTTP to create, delete, or modify critical records, read data they should not reach, and partially disrupt availability of the module (CVSS 3.1 6.4, Medium). Exploitation is gated by two hard preconditions: the attacker must already hold a high-privilege authenticated account (PR:H) and a separate victim must be induced to interact with the attack (UI:R), so this cannot be triggered unauthenticated or fully automated. No public exploit code was identified and there is no CISA KEV confirmation of active exploitation at time of analysis; the practical exposure is confined to organizations running the Argentina localization of FIN Common Objects on version 9.1.
Unauthorized access to sensitive data in Oracle Java SE (8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) becomes possible when a Java client runtime executes attacker-supplied code inside the sandbox - typically a sandboxed Java Web Start application or applet loaded from the internet - and the JGSS component fails to enforce an intended security boundary. The CVSS 3.1 score is 5.3 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N): reachable over the network by an unauthenticated attacker, but gated by required human interaction and explicitly rated difficult to exploit, with confidentiality-only impact and no integrity or availability effect. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and realistic exposure is sharply limited because the vulnerable configuration (browser applets and Web Start) is deprecated and disabled or absent in most modern environments; server deployments running only administrator-installed trusted code are explicitly out of scope.
Unauthorized access to critical data in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27), Oracle GraalVM for JDK (17.0.20.1 and 21.0.12.1), and Oracle GraalVM Enterprise Edition (21.3.19.1.1) is possible through the JGSS component, but only in client deployments that run sandboxed Java Web Start applications or applets loading untrusted code; servers running only trusted administrator-installed code are explicitly not affected. Oracle describes the flaw as difficult to exploit (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N), requiring no privileges but needing a victim to interact with the malicious application, and no public exploit was identified at time of analysis. Despite the low real-world priority, organizations still using applet or Web Start sandboxes should apply the October 2026 CPU.
Unauthorized modification of critical data in Oracle Java SE's JGSS component affects Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, as well as GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1, allowing a remote, unauthenticated attacker to alter data accessible through the JVM. The flaw is difficult to exploit (CVSS 3.1 base 5.9, AC:H) and requires an application or web service that supplies attacker-controlled network data to JGSS APIs; Oracle states it is not reachable through untrusted Java Web Start applications or applets. No public exploit identified at time of analysis and no CISA KEV active exploitation is confirmed, with impact limited to integrity and no confidentiality or availability effect.
Low-impact integrity modification in Oracle Java SE's JSSE component is possible when an unauthenticated remote attacker can feed crafted data into TLS-handling APIs, but exploitation requires high-complexity, hard-to-control conditions and affects only limited accessible data. The affected releases span Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, plus GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1. No public exploit identified at time of analysis, and the CVSS 3.1 score is 3.7 with no confidentiality or availability impact.
Oracle JD Edwards EnterpriseOne Tools (E1 Dev Platform Tech - UNIX), versions 9.2.0.0 through 9.2.26.5, exposes an HTTP-reachable weakness that lets an unauthenticated remote attacker achieve limited read and limited insert/update/delete access to application-accessible data. Exploitation is not direct: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) shows no authentication barrier but a mandatory human-interaction step, meaning a legitimate user must be induced to engage with attacker-supplied content before the payload succeeds, and there is no availability impact. At CVSS 3.1 base 5.4 this is a routine patch-cycle item rather than an emergency; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated remote attackers can achieve limited, unauthorized modification of data (insert/update/delete) in applications built on the JDK's Lightweight HTTP Server (com.sun.net.httpserver / jdk.httpserver module), affecting Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, as well as Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1 and Oracle GraalVM Enterprise Edition 21.3.19.1.1. The flaw is rated CVSS 3.1 base 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no credentials, no user interaction and no special conditions beyond network reachability, but with impact confined to partial integrity - there is no confidentiality or availability impact and no scope change. Exploitation is only possible where an application actually exposes a reachable service built on this opt-in component and accepts attacker-supplied data through its APIs (for example a web service), not through Untrusted Java Web Start applications or applets, which Oracle explicitly excludes. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied; the practical risk is concentrated in deployments that use the built-in HTTP server as an internet-facing endpoint rather than in general-purpose JDK installations.
Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition can allow an unauthenticated, network-reachable attacker to cause unauthorized updates, inserts, or deletes of data accessible to affected Java Networking APIs. The issue is integrity-only (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) and affects specific Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27 releases, GraalVM for JDK 17.0.20.1 and 21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1. Exploitation requires an application to feed attacker-controlled data into the Networking component server-side, not through untrusted Java Web Start applications or applets; this is a low-to-moderate priority issue despite the ubiquitous affected software. No public exploit identified at time of analysis.
Unauthenticated network attackers can cause limited integrity modification of data in Oracle Java SE and GraalVM deployments that pass attacker-controlled input to the Networking component, affecting specific 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1 releases. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning only partial unauthorized data updates, inserts, or deletes are possible, with no confidentiality or availability impact; exploitation is constrained by the need to reach the affected networking API path outside applet or Java Web Start contexts, such as through a web service. No public exploit code or CISA KEV entry was identified in the provided data, so there is no public exploit identified at time of analysis.
Local privilege escalation in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.9) lets an attacker who already holds high-privileged logon access on the deployment host take over the Siebel CRM Deployment instance, with full confidentiality, integrity, and availability impact confined to that component. The attack is local (AV:L), requires high privileges (PR:H), and needs no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score of 6.7 reflects a moderate-priority issue whose real-world risk is strongly constrained by the mandatory prior privileged foothold on the server.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.9, can be fully compromised - confidentiality, integrity and availability - by an attacker who already holds a high-privileged logon on the host where the deployment component runs. The flaw is not remotely reachable: exploitation requires local access plus administrative credentials (CVSS 3.1 6.7, AV:L/PR:H/UI:N), but once those prerequisites are met, attack complexity is low and no user interaction is needed, making it a realistic post-compromise or insider escalation path rather than an external entry point. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS data was supplied.
Information disclosure in Oracle Siebel CRM Deployment (Server Infrastructure) versions 17.0 through 26.9 allows a low-privileged authenticated attacker with HTTP network access to read critical data accessible to the Siebel CRM Deployment component. The vendor CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is limited to confidentiality with no integrity or availability effect; no public exploit was identified at time of analysis and no CISA KEV entry is present. Although the source tags call this an authentication bypass, the assessed vector requires a valid low-privileged Siebel account, making network exposure and account privilege the primary risk factors.
Oracle Siebel CRM's Customer Order Management component (versions 17.0 through 26.9) contains a medium-severity (CVSS 6.5) flaw that requires a low-privileged authenticated attacker and interaction by another user. Successful exploitation over HTTP can let an attacker read and modify limited Order Management data, cause partial denial of service, and potentially affect additional products because of the scope-change metric. No public exploit was identified at time of analysis; Oracle addressed the issue in its October 2026 Critical Patch Update.
Unauthenticated remote access to Oracle Siebel CRM Deployment Server Infrastructure in versions 17.0 through 26.9 can allow a network attacker to read a limited subset of deployment data and update, insert, or delete some records over HTTP. The CVSS 3.1 score is 6.5 with low confidentiality and integrity impact and no availability impact, and the available Oracle tagging identifies an authentication-bypass condition. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a moderate patching priority rather than an emergency.
Information disclosure in Siebel CRM Deployment 17.0 through 26.9 lets a low-privileged attacker who can log on locally to the deployment server read critical data accessible to the Server Infrastructure component. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms local, authenticated access is required and that only confidentiality is affected; there is no remote or unauthenticated path. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE.
Limited unauthorized read/write access and partial denial of service in Oracle Siebel CRM Deployment 17.0 through 26.9 require an attacker to already hold high-privileged logon access to the infrastructure host running the Server Infrastructure component. The CVSS 3.9 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) confirms a local, difficult-to-exploit path with low confidentiality, integrity, and availability impact, so practical risk is confined to privileged local operators or an adversary who has already compromised such an account. No public exploit identified at time of analysis; the vendor reference is Oracle's October 2026 Critical Patch Update advisory.
Authenticated low-privileged HTTP requests to Oracle Siebel CRM Deployment's Server Infrastructure component can hang or repeatedly crash the service, producing a complete denial of service across all supported releases 17.0 through 26.9 (CVSS 3.1 base 6.5). The attack is network-reachable and low-complexity with no user interaction, but it requires valid low-privileged credentials (PR:L), so risk is bounded to authenticated users, compromised accounts, and malicious insiders rather than anonymous internet attackers. Impact is availability-only - no data disclosure or modification - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 can be taken over by an attacker who already holds a high-privileged account and has interactive logon access to the infrastructure host where the component executes. The issue is rated CVSS 3.1 base 6.7 with high confidentiality, integrity, and availability impact, but the local attack vector (AV:L) and high-privilege prerequisite (PR:H) sharply constrain the realistic attacker population to insiders or actors who already have a foothold. No public exploit identified at time of analysis; no CISA KEV entry is present in the provided data.
Unauthenticated HTTP access to Oracle Siebel CRM's Open UI in versions 17.0 through 26.9 can let an attacker read and modify a limited subset of application data, with CVSS 6.5 reflecting partial confidentiality and integrity impact and no availability effect. The flaw is remotely reachable without credentials or user interaction, so exposed Open UI endpoints are the main exposure point; Oracle's October 2026 Critical Patch Update advisory is the listed vendor reference, and no public exploit has been identified at time of analysis.
Confidential data disclosure in Oracle Siebel CRM's End User Open UI affects versions 17.0 through 26.9, allowing a low-privileged user with local logon access to the Siebel infrastructure to read critical data. The CVSS 3.1 score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so the issue is local, requires valid credentials, and has no integrity or availability impact. No public exploit was identified at time of analysis.
Unauthorized access to critical data in Oracle Siebel CRM's Siebel Apps - Financial Services (Financial Accounts component) is possible for unauthenticated remote attackers in versions 17.0 through 26.9, although Oracle rates exploitation as difficult due to AC:H. Successful attacks could expose all accessible Financial Services data and permit limited unauthorized inserts, updates, or deletes, producing a CVSS 3.1 score of 6.5. No public exploit identified at time of analysis, and no CISA KEV entry was provided; risk is materially higher where the Financial Accounts HTTP interface is internet-facing rather than restricted to internal or VPN access.
Oracle Siebel CRM Deployment 17.0 through 26.9 contains a hard-to-exploit, unauthenticated HTTP-exposed weakness in the Server Infrastructure component that can give an attacker high confidentiality access and limited integrity impact. With CVSS 3.1 score 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N), the issue is constrained by high attack complexity and has no availability impact. No public exploit identified at time of analysis, and no CISA KEV entry was provided; Oracle's October 2026 Critical Patch Update is the vendor fix.
Unauthenticated remote attackers can trick a logged-in Siebel CRM End User into an action that results in unauthorized insert, update, or delete of a limited subset of that user's accessible data in the Open UI component (versions 17.0 through 26.9). The attack is delivered over HTTP with low complexity, but requires victim interaction (UI:R) and affects only integrity - confidentiality and availability are untouched, keeping the CVSS 3.1 base score at 4.3. No public exploit code or confirmed active exploitation was identified at time of analysis, and the mandatory human-interaction prerequisite plus the narrowly scoped write-only impact make this a low-priority item relative to other Siebel issues.
A locally reachable flaw in Oracle Siebel CRM Deployment's Server Infrastructure component lets an attacker who already holds high privileges and can log on to the host cause a partial denial of service, degrading availability of the deployment service. Only supported Siebel CRM Deployment releases 17.0 through 26.9 are affected, and the CVSS 3.1 base score is 2.3 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), reflecting a local-only attack path, a high pre-existing privilege requirement, and no confidentiality or integrity impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a low-priority hardening item rather than an urgent exposure, though it should still be closed out in the routine Oracle Critical Patch Update cycle.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 expose confidential data to any low-privileged user who can log on locally to the host where the Siebel server infrastructure runs. No user interaction or elevated privileges are needed, and a successful attack yields read access to critical Siebel CRM Deployment data with no integrity or availability impact (CVSS 3.1 base 5.5, C:H/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical barrier remains that the attacker must already hold a local account on the Siebel server host.
Oracle Siebel CRM Deployment releases 17.0 through 26.9 expose a Server Infrastructure weakness that lets a low-privilege user with HTTP access hang or repeatedly crash the component while also reading and modifying a limited subset of data it manages. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, base 6.4) shows the attack is remote but gated by a valid low-privilege Siebel account and by a high-complexity precondition such as a race window or a particular server state the attacker does not fully control, so the availability impact dominates (A:H) while confidentiality and integrity effects stay low. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation; this is a moderate-severity, moderate-priority issue rather than a top-tier emergency, with the highest practical risk in deployments where the Siebel server is internet-facing or broadly reachable from the corporate network and low-privilege accounts are liberally provisioned.
Oracle Siebel CRM Deployment 17.0 through 26.9 contains a local high-privilege access-control weakness that can let an attacker who already has logon access to the Siebel host read and modify critical deployment data. Exploitation is not network-reachable and requires a pre-existing high-privileged local foothold, so realistic risk is limited to malicious insiders or attackers who have already compromised a privileged account. No public exploit code or CISA KEV entry was identified at time of analysis.
Low-privileged authenticated users can tamper with critical deployment data in Oracle Siebel CRM Deployment (Server Infrastructure) versions 17.0 through 26.9 via HTTP, although high attack complexity makes reliable exploitation difficult. The flaw affects integrity only, with no confidentiality or availability impact, and requires a valid account on the target instance. No public exploit code or CISA KEV entry was identified at time of analysis; CVSS 3.1 base score is 5.3.
Denial of service affecting Oracle Siebel CRM Deployment versions 17.0 through 26.9 allows an unauthenticated, network-positioned attacker to hang or repeatedly crash the Deployment Server Infrastructure over HTTP. The CVSS 3.1 score is 5.9 with a high attack-complexity rating, meaning success depends on server-state, timing, or request characteristics outside the attacker's direct control, and impact is limited to availability with no confidentiality, integrity, or code-execution effect. No public exploit code was identified at time of analysis, and this is a moderate-severity availability issue rather than a top-priority compromise risk.
Authenticated low-privileged users can create, modify, or delete critical data in the Siebel CRM Deployment Server Infrastructure component of Oracle Siebel CRM versions 17.0 through 26.9 by sending crafted requests over the HTTP interface. The flaw is rated CVSS 3.1 6.5 with an integrity-only impact (C:N/I:H/A:N) and is easily exploitable once a valid low-privilege credential or session is obtained - it is not confirmed as unauthenticated despite the 'Authentication Bypass' tag attached to the report. No public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis, making this a moderate-priority integrity risk concentrated on internet-facing Siebel application servers.
Partial denial of service in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle JavaFX (21.0.12, 25.0.4, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) is reachable by unauthenticated remote attackers who can get attacker-controlled image data into the ImageIO component, either through a web service or API that decodes supplied data or through sandboxed Web Start/applet code loading untrusted content. Impact is confined to availability - a partial denial of service (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L) with no confidentiality or integrity effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is limited to JVMs that actually parse untrusted images.
Partial denial of service in Oracle Java SE 8u503/8u503-perf and Oracle GraalVM Enterprise Edition 21.3.19.1.1 is reachable by unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base score 5.3) who can supply crafted data into the CORBA component's APIs, typically through a CORBA/IIOP-based service or a web service that passes untrusted input to those APIs. The flaw cannot be triggered via untrusted Java Web Start applications or applets, so only server-side or service-side CORBA data paths are in scope; confidentiality and integrity are unaffected and the impact stops at a partial availability loss. No public exploit code or CISA KEV entry was identified at time of analysis, and the practical attack surface is narrow because CORBA is legacy and rarely network-exposed in modern Java deployments.
Oracle Siebel CRM Deployment (Server Infrastructure) versions 17.0 through 26.9 expose critical data to unauthenticated network attackers who can persuade another user to take an action, such as opening an attacker-supplied link or request. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a high-complexity, confidentiality-only issue: no attacker credentials are required, but success depends on victim interaction and additional conditions outside the attacker's control, so unattended mass exploitation is unlikely. No public exploit identified at time of analysis; Oracle's October 2026 Critical Patch Update is the remediation reference.
High-privileged attackers with network access to the CORBA interface can hang or repeatedly crash Oracle Siebel CRM Development versions 17.0 through 26.9 through the Integration - Scripting component, while also obtaining limited read and write access to a subset of application data. The CVSS 3.1 base score is 6.0 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H), and no public exploit was identified at the time of analysis.
Critical data exposure in Oracle Siebel CRM's Open UI component affects versions 17.0 through 26.9, where an authenticated low-privileged attacker with HTTP access can read critical or all user-accessible data. The flaw is low-complexity and needs no user interaction but requires a valid low-privilege account (CVSS 6.5 Medium, confidentiality-only); no public exploit identified at time of analysis.
Untrusted input that reaches Java's JGSS (GSS-API / Kerberos) security services can hang or repeatedly crash a JVM and, to a limited degree, alter data the component handles, affecting Oracle Java SE 8u503, 8u503-perf and 11.0.32.1, Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition 21.3.19.1.1. Oracle scores this 6.5 on an AV:N/AC:H/PR:N/UI:N vector with C:N/I:L/A:H - no credentials or user interaction are needed, but the high attack complexity means successful exploitation depends on crafted tokens combined with timing or state conditions rather than one deterministic request, and realistic exposure is confined to deployments that actually feed attacker-controlled data into the JGSS path (for example a web service supplying data to those APIs, or sandboxed Web Start/JApplet code loading untrusted content). No public exploit code and no CISA KEV entry were identified at time of analysis, so this reads as a lower-priority, difficult-to-exploit hardening item - availability-weighted but not an urgent, actively exploited threat.
Partial denial of service in Oracle Java SE affects the Libraries component in 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1, plus Oracle GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1. An unauthenticated, network-positioned attacker can degrade availability only by supplying crafted input to an application that exposes the affected Libraries API, such as a web service; no confidentiality or integrity impact or code execution is expected. No public exploit code or CISA KEV confirmation was identified at time of analysis, and the issue is a moderate availability risk rather than an emergency remote-code-execution class flaw.
Partial denial of service in Oracle Java SE 27's Networking component can be triggered by unauthenticated remote attackers who can reach an exposed Java API and supply crafted network data; the CVSS 3.1 score is 3.7 with AC:H and only A:L, so successful exploitation is difficult and produces limited, recoverable availability impact. The flaw also matters for deployments that run untrusted code in the Java sandbox, such as Java Web Start applications or applets. No public exploit was identified at time of analysis and there is no CISA KEV confirmation.
Local information disclosure in Oracle Outside In Technology 8.5.8 allows an attacker who already holds a logon to the host to read a restricted subset of data accessible to the Outside In PDF Export SDK, with no integrity or availability impact. The flaw sits in the PDF Export SDK component of Oracle Fusion Middleware and is rated CVSS 3.1 base 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting low confidentiality impact only and a hard dependency on local access. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; practical risk is limited to environments where applications embed the SDK to convert attacker-influenced documents on shared or insufficiently segmented hosts.
Information disclosure in Oracle JavaFX - and in the Oracle Java SE 8u503 and GraalVM Enterprise Edition 21.3.19.1.1 releases that ship it - allows an unauthenticated, network-positioned attacker to read a limited subset of data, but only when a human victim loads and runs attacker-supplied code inside a sandboxed Java applet or Java Web Start application. The CVSS 3.1 score is 3.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N), reflecting high attack complexity and mandatory user interaction; the issue does not affect server deployments that execute only administrator-installed trusted code. No public exploit code or active exploitation (CISA KEV) was identified at time of analysis, and the near-total retirement of the applet/Web Start model keeps real-world exposure very small.
A partial denial of service can be triggered in the Sound component of Oracle Java SE (8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) by an unauthenticated, network-positioned attacker who convinces a user to load and run untrusted code inside the Java sandbox. Oracle explicitly scopes the issue to client-side deployments using sandboxed Java Web Start applications or applets; servers that only execute administrator-installed trusted code are not affected, and the only achievable outcome is a partial loss of availability, with no confidentiality or integrity impact. The attack is rated high-complexity (AC:H) and requires victim interaction (UI:R), and no public exploit identified at time of analysis; given the deprecated applet/Web Start attack surface and the availability-only impact, this is a low-priority issue despite the ubiquity of the platform.
Post-authentication integrity tampering in Oracle Primavera P6 Enterprise Project Portfolio Management (Web Access component) allows a low-privileged user with ordinary HTTP/HTTPS reachability to update, insert, or delete data they should not be permitted to modify across the 21.12, 22.12, 23.12, 24.12, and 25.12 release trains. The flaw is low complexity with no user interaction required, but it is gated behind a valid low-tier account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3), so it is a post-login authorization gap rather than a remote unauthenticated compromise; confidentiality and availability are unaffected. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); metadata tags label it 'Authentication Bypass', but the assessed vector indicates the practical risk is unauthorized modification of project data by an already-authenticated low-privilege user.
Integrity-only manipulation of critical data in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27) and GraalVM for JDK/Enterprise Edition stems from SOCKS5 handling in the Networking component. An unauthenticated network attacker who can feed attacker-controlled data into the SOCKS5 code path may create, delete, or modify critical data, with a scope change that can affect additional products; Oracle rates exploitation as difficult (AC:H). No public exploit was identified at time of analysis, and no KEV confirmation is available.
Oracle Java SE and GraalVM deployments are exposed to limited integrity and availability impact through the Serviceability component. An unauthenticated attacker who can log on locally to the affected host-or who persuades another user to run a sandboxed Java Web Start application or sandboxed applet that feeds untrusted data to the vulnerable APIs-can cause unauthorized data modification and partial denial of service. Affected builds include Oracle Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, plus specified GraalVM releases; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated network attackers can cause partial integrity and availability impact in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1), and Oracle GraalVM Enterprise Edition (21.3.19.1.1) by supplying malicious input to Utility-component APIs. The CVSS 3.1 score is 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L; no public exploit was identified at time of analysis. Practical exploitation depends on an application exposing the affected APIs to untrusted data, or on legacy sandboxed Java Web Start/applet deployments that execute untrusted code.
Unauthenticated remote attackers can cause limited unauthorized data modification and partial denial of service in Oracle Java SE and GraalVM deployments by supplying crafted data to APIs in the Utility component. Affected releases include Oracle Java SE 8u503, 8u503-perf, and 11.0.32.1; Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1; and Oracle GraalVM Enterprise Edition 21.3.19.1.1. Oracle disclosed the issue in its October 2026 Critical Patch Update, and no public exploit has been identified at time of analysis.
A confidentiality-only information disclosure flaw exists in the Networking component of Oracle Java SE (11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27) and Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1), rated CVSS 3.1 base 5.9. Successful exploitation allows an unauthenticated network attacker to read critical data or gain complete access to all data reachable by the affected Java runtime, but Oracle classifies the issue as 'Difficult to exploit' (AC:H) because success depends on special conditions such as specific data flows into the Networking APIs, and no public exploit code or active exploitation has been identified at time of analysis. Exposure is greatest for applications or web services that pass untrusted input into the Networking component APIs, and for sandboxed Java Web Start or applet deployments that load untrusted code and rely on the Java sandbox for security.
Siebel CRM End User versions 17.0 through 26.9 contain an integrity-only flaw in the Open UI component that can let unauthenticated network attackers modify limited records if a legitimate user is induced to interact with attacker-controlled content. The CVSS 3.1 score is 3.1 with high attack complexity and a user-interaction requirement, and the supplied intelligence shows no public exploit code or CISA KEV confirmation. Practical risk is low because exploitation depends on tricking an active Siebel user and on conditions outside the attacker's control, with no confidentiality or availability impact.
Unauthorized update, insert, or delete access to some Oracle Siebel CRM End User data is possible through the Open UI component in versions 17.0 through 26.9. The issue is network-reachable over HTTP and requires no credentials or user interaction, but Oracle characterizes it as difficult to exploit because of high attack complexity; impact is integrity-only with a CVSS 3.1 base score of 3.7 and no confidentiality or availability effect. No public exploit code was identified at time of analysis.
Oracle Siebel CRM's Open UI component (End User product, versions 17.0 through 26.9) permits unauthenticated remote attackers with HTTP access to read a limited subset of application data, with no integrity or availability impact. Exploitation is rated high complexity (AC:H), meaning success hinges on specific conditions Oracle has not disclosed, so reliable attacks are difficult. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the CVSS 3.1 base score of 3.7 reflects the narrow confidentiality-only exposure.
Siebel CRM Open UI exposes a low-privileged, network-reachable weakness that lets an attacker with a valid low-privilege account craft HTTP content and rely on a different user, such as an agent or administrator, to interact with it, thereby gaining unauthorized read access and limited insert/update/delete capability in that victim's context. The scope change means the impact can extend to products integrated with Siebel, although confidentiality and integrity effects are partial and availability is unaffected. No public exploit was identified at time of analysis, so this is a moderate-severity, mid-tier-priority issue rather than a drop-everything emergency.
Oracle Siebel CRM's Open UI component (End User, versions 17.0 through 26.9) mishandles attacker-supplied content in a way that lets a low-privileged authenticated user cause unauthorized reads and limited insert/update/delete changes to data visible to a different user, with the impact crossing a security scope boundary into other products. Exploitation is over HTTP, requires a valid low-privileged Siebel account, and critically depends on a second user interacting with the crafted content in their own session (UI:R). No public exploit code or confirmed active exploitation was identified at time of analysis; Oracle addresses the issue in its October 2026 Critical Patch Update.
Unauthorized data modification and limited data disclosure in Oracle Siebel CRM End User (Open UI) can be triggered by an unauthenticated network attacker who convinces a legitimate user to interact with crafted content. Supported versions 17.0 through 26.9 are affected; Oracle rates the attack as high complexity and requires user interaction, with a scope change that may extend impact to integrated products. No public exploit code or CISA KEV entry is identified in the available data, and the 4.7 score reflects low confidentiality and integrity impact without availability loss.
Authenticated low-privileged users of Oracle Siebel CRM End User 17.0 through 26.9 can bypass intended Open UI access controls to read and modify data beyond their authorized scope. The issue is network-reachable over HTTP with low complexity and no user interaction, but requires a valid low-privilege session; impact is partial confidentiality and integrity loss with no availability impact (CVSS 5.4). This is a medium-severity authenticated access-control flaw rather than a top-priority emergency, and no public exploit or CISA KEV active-exploitation confirmation is present in the provided data.
Unauthenticated attackers with access to the same physical network segment as JD Edwards EnterpriseOne Orchestrator 9.2.0.0 through 9.2.26.5 can read and modify critical Orchestrator data, although high attack complexity limits practical exploitation. The issue is rated CVSS 3.1 6.8 Medium with vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. No public exploit was identified at time of analysis, and there is no CISA KEV entry.
Sandbox restrictions in Oracle Java SE 8u503, Oracle JavaFX 21.0.12/25.0.4/27, and Oracle GraalVM Enterprise Edition 21.3.19.1.1 can be bypassed by untrusted code that a victim loads through Java Web Start or Java applets, letting an unauthenticated network attacker read and modify some accessible data. The CVSS 3.1 score is 5.4 with UI:R, and the flaw does not affect server deployments that run only trusted code; no public exploit identified at time of analysis (not in CISA KEV).
Oracle JD Edwards EnterpriseOne Tools builds 9.2.0.0 through 9.2.26.5 expose a confidentiality weakness in the Web Runtime SEC component reachable over the JDENET protocol, letting an authenticated low-privileged attacker read data well beyond their intended authorisation scope - up to all EnterpriseOne Tools-accessible data. Rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the bug is easy to trigger once valid credentials and network access to JDENET exist, and no user interaction is required. Exploitation status: no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied in the available intelligence; the realistic risk is concentrated in deployments that expose JDENET broadly and permit loosely governed low-privilege ERP accounts.
JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 contains a difficult-to-exploit security weakness in the Monitoring and Diagnostics SEC component that lets a high-privileged attacker with HTTP network access read critical data and make limited updates, with scope change potentially affecting additional products. The CVSS 3.1 score is 6.6 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N), requiring an already privileged account and high attack complexity. No public exploit code or CISA KEV entry was identified at time of analysis; EPSS was not provided.
Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) contain an input-handling weakness in the 2D component that a remote, unauthenticated attacker can reach over the network through multiple protocols, resulting in unauthorized creation, deletion or modification of critical data plus a partial denial of service. Oracle rates the flaw 'difficult to exploit' (CVSS 3.1 6.5, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L), so success depends on conditions the attacker cannot directly control - in practice the target must route attacker-supplied data into the 2D APIs, or run untrusted code inside the Java sandbox via applets or Web Start. No public exploit code or active exploitation was identified at time of analysis, and this is a patch-on-normal-cycle issue rather than an emergency.
A hard-to-exploit integrity flaw in the 2D component of Oracle Java SE 8u503 and 8u503-perf, and Oracle GraalVM Enterprise Edition 21.3.19.1.1, allows an unauthenticated network attacker to make limited unauthorized modifications to data accessible to the Java runtime. Exploitation is not straightforward: it requires attacker-controlled data to reach the affected 2D APIs - typically through an application or web service that passes external input into graphics/2D routines, or through sandboxed Web Start applications and applets that load untrusted code - and success depends on conditions outside the attacker's control (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and impact is confined to limited integrity change with no confidentiality or availability effect (CVSS 3.7), so real-world priority is low.
Limited unauthorized read and modification of accessible data affects Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition through a difficult-to-exploit local flaw in the Utility component. Affected releases include Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27; GraalVM for JDK 17.0.20.1 and 21.0.12.1; and GraalVM Enterprise Edition 21.3.19.1.1. Exploitation requires prior local logon access, is assessed as high-complexity, and has no public exploit identified at time of analysis, making this a low-to-moderate priority despite the platform's criticality.
Integrity-only sandbox bypass in Oracle Java SE (8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27), GraalVM for JDK (17.0.20.1, 21.0.12.1) and GraalVM Enterprise Edition (21.3.19.1.1) lets an unauthenticated attacker who can log on to the host tamper with, create or delete data that the JVM can reach - but only in deployments that still load and execute untrusted sandboxed content such as Java Web Start applications or applets, and only after a victim is persuaded to launch that content. Attack complexity is High, no confidentiality or availability impact is possible, and ordinary server deployments that run only administrator-installed code are explicitly out of scope. No public exploit code identified at time of analysis, and fixes are delivered through the referenced Oracle Critical Patch Update (October 2026).