Oracle
Monthly
Local confidentiality exposure in Oracle PeopleSoft Enterprise FIN eSettlements 9.2 permits a high-privileged attacker with infrastructure-level logon access to read a subset of financial settlement data beyond their authorization. Disclosed via Oracle's July 2026 Critical Patch Update with a CVSS 3.1 score of 2.3 (Low), this vulnerability's real-world impact is significantly constrained by the local attack vector and high-privilege prerequisite. No active exploitation or public proof-of-concept has been identified at time of analysis.
Local information disclosure in Oracle PeopleSoft Enterprise FIN Pay/Bill Management 9.2 allows a low-privileged user with logon access to the hosting infrastructure to access all financial data within the Pay/Bill Management component. The vulnerability is tagged as an Authentication Bypass, suggesting a low-privileged account holder can circumvent internal access controls to read data beyond their authorization level. No public exploit code exists and it is not listed in the CISA KEV catalog, but the CVSS vector rates it as easily exploitable once local access is obtained.
Oracle Enterprise Asset Management (EAM) versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains an authorization control weakness in its Work Definition Issues component that permits low-privileged authenticated network attackers to partially compromise data integrity and confidentiality over HTTPS. Successful exploitation enables unauthorized read access to a subset of EAM-accessible data as well as unauthorized update, insert, or delete operations against EAM records. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the 'Authentication Bypass' intelligence tag suggests the flaw involves insufficient privilege enforcement within the Work Definition Issues component rather than a full pre-authentication bypass.
Oracle Project Foundation's Project Definition component in E-Business Suite versions 12.2.3 through 12.2.15 allows any low-privileged authenticated user to exploit HTTP-accessible endpoints, resulting in unauthorized read, insert, update, or delete of project data and partial denial of service. Disclosed in Oracle's Critical Patch Update for July 2026 and described by Oracle as 'easily exploitable,' the flaw's low attack complexity and absence of required user interaction broaden the practical attacker population to any valid EBS credential holder. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS signal is available from the provided intelligence.
Full takeover of Oracle MySQL Server and MySQL Cluster is achievable through the Server: Replication component by a highly privileged network attacker who can satisfy difficult exploitation conditions. Affected deployments include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, with complete confidentiality, integrity, and availability impact upon successful exploitation. Oracle disclosed this through the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Oracle Workflow's Notification Mailer component within E-Business Suite 12.2.3-12.2.15 is exploitable by network-authenticated low-privileged users to partially read, modify, and disrupt workflow data over HTTP without user interaction. The CVSS 3.1 score of 6.3 (Medium) reflects constrained but multi-dimensional CIA impact (C:L/I:L/A:L) with low attack complexity, making exploitation straightforward for any valid EBS account holder. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; remediation is available through the Oracle Critical Patch Update for July 2026.
Oracle Content Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite expose a medium-severity flaw in the Cover Letter component, exploitable by any low-privileged authenticated user over HTTP without user interaction. Successful exploitation allows unauthorized read access to a subset of Content Manager data, unauthorized insert/update/delete of accessible records, and partial denial of service against the component. No public exploit code and no CISA KEV listing have been identified at time of analysis; this vulnerability was disclosed as part of Oracle's July 2026 Critical Patch Update.
Partial confidentiality, integrity, and availability compromise in Oracle Partner Management's Partner Dashboard component (E-Business Suite 12.2.3-12.2.15) is reachable over HTTPS by any low-privileged account holder without user interaction. Successful exploitation allows unauthorized read access to a subset of partner data, unauthorized modification or insertion of records, and partial denial of service against the affected component. No public exploit code or CISA KEV listing exists at time of analysis; the July 2026 Oracle Critical Patch Update addresses the issue.
Network-exploitable integrity, confidentiality, and availability compromise in Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3 through 12.2.15) allows low-privileged authenticated attackers over HTTP to read, modify, or partially disrupt accessible data within the Web Service Provider component. Oracle rates this CVSS 6.3 Medium, with all three security pillars impacted at a low level and no scope change beyond the affected component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a credible threat for any internet- or intranet-reachable EBS deployment running the affected version range.
Oracle SDP Number Portability versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes a medium-severity flaw in its Installation sub-component that permits low-privileged authenticated network attackers to manipulate accessible data and partially disrupt service availability via HTTP. The CVSS 3.1 score of 5.4 reflects limited scope - no confidentiality impact and only partial integrity and availability degradation - with no confirmed active exploitation (not listed in CISA KEV) and no publicly available proof-of-concept at time of analysis. Oracle disclosed this vulnerability as part of the Critical Patch Update for July 2026, classifying it as 'easily exploitable' given the low attack complexity and absence of required user interaction.
MySQL Cluster's NDB Operator component allows a local, unauthenticated attacker with logon access to the infrastructure host to bypass authentication controls and gain complete read access to all MySQL Cluster data. Three active release lines are affected - 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1 - as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) together with the local-only access vector (AV:L) substantially constrain realistic exploitation, though the data-exposure consequence remains significant for environments handling sensitive workloads.
Unauthorized read access to all WebCenter Sites data is achievable by unauthenticated remote attackers via HTTP against Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 - two currently supported versions of Oracle Fusion Middleware's web content management component. The vulnerability is tagged as an Authentication Bypass requiring one-time victim interaction (UI:R), suggesting an attacker-controlled HTTP trigger that a legitimate user must initiate (e.g., by visiting a crafted URL or link), after which the attacker gains complete confidentiality access to all CMS data. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Full takeover of Oracle Java SE 8u491 and 8u491-perf is achievable by a low-privileged local attacker exploiting a flaw in the Installation component, disclosed as part of Oracle's July 2026 Critical Patch Update. The attack chain requires high complexity - indicating race conditions or precise timing - combined with human interaction from a third party, likely a privileged user performing installation or update activity. No public exploit code has been identified and CISA KEV listing is absent at time of analysis, but the C:H/I:H/A:H impact triad makes successful exploitation fully destructive to the affected Java SE instance.
Unauthenticated remote exploitation of Oracle Advanced Pricing (E-Business Suite 12.2.3-12.2.15) via HTTP allows attackers to read and tamper with price list data without any credentials. The 'Authentication Bypass' tag and PR:N CVSS vector together confirm that the Price List component exposes sensitive pricing operations to the network without enforcing authentication. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a straightforward target for opportunistic actors with network access to the EBS HTTP interface.
Oracle Service Delivery Platform's Messaging Enabler component in versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged local users to perform unauthorized read and write operations on platform data, with a documented scope change that extends impact to additional co-deployed Oracle Fusion Middleware products. The vulnerability requires only a low-privileged local account on the hosting infrastructure, making insider threats and compromised service accounts the primary risk vector. No public exploit has been identified at time of analysis; this was disclosed as part of Oracle's July 2026 Critical Patch Update.
Partial data compromise and service disruption in Oracle Advanced Inbound Telephony 12.2.3-12.2.15 (SDK client integration component) is exploitable by a low-privileged attacker over HTTP without requiring user interaction. Successful exploitation allows unauthorized read access to a subset of telephony data, unauthorized insert, update, or delete operations on accessible data, and partial denial of service against the affected module. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS data was not available in the provided intelligence.
Unauthorized data exposure in Oracle Transportation Management 6.5.3 allows low-privileged remote attackers to read a subset of application data via HTTP, exploiting a flaw in the Authentication component. The vulnerability is tagged as an Authentication Bypass and is rated easily exploitable by Oracle, requiring only a low-privilege account and network access - no user interaction or complex conditions apply. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a constrained confidentiality-only impact.
Critical data exposure and unauthorized modification in Oracle Transportation Management 6.5.3 allows a high-privileged network attacker to fully compromise the confidentiality and integrity of all data accessible within the platform. The vulnerability resides in the Integration component, accessible over HTTP, and enables complete read and write access to sensitive supply chain data including shipment records, carrier contracts, and operational logistics data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 'Authentication Bypass' tag alongside PR:H CVSS metrics suggests an authorization bypass rather than a full authentication bypass - warranting close review of privileged account hygiene.
Denial-of-service in Oracle TimesTen In-Memory Database 26.1.1.1.0 allows unauthenticated attackers on the same network segment to crash or indefinitely hang the database service via the ttcserver component. The adjacent-network vector (AV:A) constrains reachability to the local physical or logical segment, but once positioned, exploitation requires no credentials and no user interaction, making the crash frequently repeatable. No public exploit code or active exploitation has been identified at time of analysis.
Partial denial-of-service exposure in Oracle TimesTen In-Memory Database's Kubernetes Operator component (version 26.1.1.1.0) allows a low-privileged, network-authenticated attacker to degrade database availability via crafted HTTPS requests. The attack requires no user interaction and is rated easily exploitable by Oracle, though impact is limited to partial availability loss with no confidentiality or integrity effects. No public exploit code or CISA KEV listing has been identified at time of analysis.
TimesTen In-Memory Database 26.1.1.1.0 contains a medium-severity flaw in its Kubernetes Operator component, exploitable by local high-privileged attackers to gain partial unauthorized read, write, and denial-of-service capability against database data. Critically, the CVSS scope change (S:C) signals that a successful attack may cascade to additional products sharing the Kubernetes cluster, elevating the real-world blast radius beyond the individual component score. No public exploit code and no CISA KEV listing have been identified at time of analysis; Oracle confirmed the issue in the July 2026 Critical Patch Update.
Unauthorized data read in Oracle TimesTen In-Memory Database 26.1.1.1.0 is possible through the Kubernetes Operator component via HTTPS, allowing low-privileged authenticated network attackers to access a subset of database data they should not be authorized to read. The ENISA EUVD threat intelligence tags this as 'Authentication Bypass,' suggesting the Kubernetes Operator fails to enforce proper authorization controls after initial authentication, effectively allowing privilege overreach within an authenticated session. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Confidentiality breach in Oracle TimesTen In-Memory Database 26.1.1.1.0 allows a low-privileged local attacker to gain complete read access to all database-accessible data through the Kubernetes Operator component via an authentication bypass. The scope-change CVSS metric indicates successful exploitation can cascade to co-located Kubernetes resources beyond the database itself. No public exploit or CISA KEV listing exists; exploitation is constrained by the requirement of local infrastructure access and high attack complexity, making this a post-compromise or insider-threat vector rather than a remote exposure.
Full takeover of Oracle TimesTen In-Memory Database 26.1.1.1.0 is achievable by a high-privileged attacker with local logon access to the infrastructure through a flaw in the Kubernetes Operator component. The attack requires no user interaction and is characterized by Oracle as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local information disclosure in Oracle TimesTen In-Memory Database 26.1.1.1.0 (Kubernetes Operator component) permits a low-privileged local attacker to read a subset of database-accessible data. The CVSS scope change (S:C) indicates exploitation can extend impact beyond the vulnerable component itself, potentially affecting other workloads or namespaces co-located in the same Kubernetes cluster. No public exploit code exists and no active exploitation has been confirmed at time of analysis; overall real-world risk is constrained by the requirement for local infrastructure access.
Denial-of-service in Oracle TimesTen In-Memory Database 26.1.1.1.0 allows low-privileged remote attackers to crash or hang the database via crafted HTTPS requests to the Kubernetes Operator component. The vulnerability is network-accessible with low complexity, requiring only low-level credentials, and results in complete availability loss with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle has disclosed this through the July 2026 Critical Patch Update.
Denial-of-service in Oracle TimesTen In-Memory Database 26.1.1.1.0 via the Kubernetes Operator component allows a low-privileged, network-authenticated attacker to repeatedly crash or hang the database over HTTPS. The attack is classified as easily exploitable with low complexity and no user interaction required, making it a straightforward availability threat in Kubernetes-managed deployments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity elevates practical risk for environments where low-privileged accounts are broadly provisioned.
Local authentication bypass in the Kubernetes Operator component of Oracle TimesTen In-Memory Database 26.1.1.1.0 allows a low-privileged attacker with infrastructure access to read all data managed by the database, including critical application data. The CVSS scope change (S:C) confirms that exploitation can cascade beyond the target instance, impacting additional workloads or containers sharing the Kubernetes environment - a meaningful amplifier in multi-tenant deployments. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the Authentication Bypass tag suggests the Operator fails to enforce access controls on a locally accessible interface or API, making exploitation straightforward once infrastructure access is established.
Denial-of-service conditions in Oracle GoldenGate's Receiver Service Executable allow a low-privileged attacker with HTTP network access to crash or indefinitely hang the replication service. Three major version lines are affected - 19.x, 21.x, and 23.x - covering a broad enterprise installed base. No public exploit code or active exploitation has been identified at time of analysis; risk is moderated by the low-privilege authentication requirement but elevated by low attack complexity and the business-critical role GoldenGate plays in continuous database replication pipelines.
Partial denial of service in Oracle GoldenGate's Admin Server Executable component is reachable by unauthenticated attackers with access to the adjacent physical communication segment. Three major release trains are affected - 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.1 - making this broadly relevant across GoldenGate deployments. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is bounded by the adjacent-network requirement.
Unauthorized read access to Oracle GoldenGate data is possible through a flaw in the Admin Server Executable component, affecting three major release trains spanning versions 19.1.0.0.0 through 23.26.1. A low-privileged network attacker can exploit this Authentication Bypass issue over HTTP without user interaction to read a subset of GoldenGate-accessible data. No public exploit code and no CISA KEV listing have been identified at time of analysis; risk is elevated primarily for deployments exposing the Admin Server to untrusted networks.
Remote unauthenticated information disclosure in Oracle GoldenGate's Admin Server Executable allows network-accessible attackers to read a subset of GoldenGate-accessible data over HTTPS without any credentials. Affected versions span two active branches: 21.3-21.21 and 23.4-23.26.1. No public exploit or CISA KEV listing has been identified at time of analysis; Oracle classifies this as easily exploitable with a CVSS 5.3 Medium score reflecting limited confidentiality impact and no integrity or availability consequence.
Unauthorized data manipulation via authentication bypass in Oracle Siebel CRM Integration's Siebel Server Sync for Exchange component allows unauthenticated remote attackers to insert, update, or delete a subset of CRM-accessible data over HTTP. All versions from 17.0 through 26.5 are affected, with exploitation constrained by high attack complexity that substantially reduces real-world risk. No public exploit code or active exploitation has been identified at time of analysis, consistent with the low CVSS score of 3.7 reflecting limited, integrity-only impact.
Unauthorized data read in Oracle JDeveloper's Data Visualization Tools component exposes a subset of accessible application data to remote unauthenticated attackers via HTTP. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, with Oracle tagging this as an authentication bypass class issue. Despite the network-accessible attack vector with no privilege requirement, the high attack complexity (AC:H) and limited confidentiality impact (C:L) anchor this at CVSS 3.7 (Low). No public exploit code exists and it is not listed in the CISA KEV catalog.
Partial data disclosure in Oracle JDeveloper's ADF Faces component (versions 12.2.1.4.0 and 14.1.2.0.0) allows low-privileged network-authenticated attackers to read a subset of JDeveloper-accessible data via crafted HTTP requests. Despite the 'Authentication Bypass' tag, the CVSS PR:L metric confirms full authentication is required - the bypass is best understood as an authorization or access-control bypass within ADF Faces rather than full session bypass. No public exploit has been identified and no CISA KEV listing exists; the low CVSS score of 3.1 reflects high exploit complexity and limited impact scope.
Unauthorized read access to a subset of Oracle JDeveloper data is possible via an unauthenticated HTTP-based attack against the ADF Faces component in Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, and while exploitation requires high attack complexity, no authentication is needed. No public exploit code has been identified at time of analysis, no active exploitation is confirmed, and the CVSS 3.1 score of 3.7 (Low) reflects the limited confidentiality impact and elevated exploitation difficulty.
Oracle JDeveloper's ADF Faces component on versions 12.2.1.4.0 and 14.1.2.0.0 is susceptible to an authentication bypass exploitable over HTTP by unauthenticated network attackers. Successful exploitation yields partial unauthorized read and write/insert/delete access to data accessible within the JDeveloper context - confidentiality and integrity are both impacted at a limited scope. No public exploit has been identified at time of analysis, and the CVSS AC:H rating indicates meaningful technical barriers to exploitation, reducing the practical threat level despite the unauthenticated attack vector.
Local authentication bypass in Oracle JDeveloper's ADF Faces component exposes critical data to low-privileged local users on versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope change (S:C) indicates successful exploitation can extend beyond JDeveloper itself to impact additional Oracle Fusion Middleware products sharing the same infrastructure. No public exploit has been identified at time of analysis, and neither EPSS data nor a CISA KEV listing is available - however, the low attack complexity and no user interaction requirement make exploitation straightforward once local access is established.
Oracle JDeveloper's Java Business Objects component exposes a network-accessible confidentiality and availability flaw in versions 12.2.1.4.0 and 14.1.2.0.0, allowing low-privileged remote attackers to gain unauthorized access to critical or all JDeveloper-accessible data alongside a partial denial of service. The attack complexity is rated high, requiring specific conditions to be met, but no user interaction is needed beyond initial low-privilege authentication. No public exploit code or active exploitation has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Unauthenticated network exploitation of the ADF Faces component in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 enables complete confidentiality compromise of all data accessible within the IDE environment via HTTP. Tagged explicitly as an Authentication Bypass by Oracle's security team (secalert_us@oracle.com), the flaw allows a remote attacker with no credentials to circumvent access controls, though the CVSS AC:H rating constrains opportunistic exploitation by requiring attacker-controlled preconditions to be met. No public exploit or CISA KEV listing exists at time of analysis, and the impact is limited strictly to data exfiltration - no integrity or availability risk is present.
Local privilege abuse in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 allows a low-privileged attacker with infrastructure logon access to perform unauthorized data modifications and induce a partial denial of service against the Enterprise Infrastructure Security component. The attack complexity is rated High, meaning specific conditions beyond the attacker's direct control must be met. No public exploit code exists and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, placing it in a low operational risk tier despite the ERP-critical nature of the platform.
Partial denial of service in JD Edwards EnterpriseOne Tools 9.2.26.3 is achievable by an unauthenticated remote attacker via the JDENET protocol, specifically through the Interoperability Security component. The vulnerability carries a low CVSS base score of 3.7 driven by high attack complexity and limited availability-only impact, with no confidentiality or integrity consequences. No public exploit code or active exploitation has been identified at time of analysis, placing this at low operational priority for most organizations.
Unauthorized data access and manipulation in the French HR Payroll component of Oracle HRMS (France) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a network-based, low-privileged authenticated attacker to read, insert, update, or delete sensitive payroll data via HTTP. The 'Authentication Bypass' tag from multi-source intelligence suggests the root mechanism involves insufficient authorization controls within the payroll component, enabling privilege escalation beyond the attacker's assigned role. No confirmed active exploitation (KEV) or public exploit code exists at time of analysis, but the sensitivity of French HR payroll data - salaries, tax records, employee details - elevates real-world business risk well above what the moderate CVSS score of 5.4 alone conveys.
Unauthorized data disclosure in Oracle Access Manager's Authentication Engine allows unauthenticated remote attackers to read a subset of OAM-accessible data over HTTP. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's OAM component. Tagged as an Authentication Bypass, the flaw carries a CVSS 5.3 (Medium) rating with low confidentiality impact and no integrity or availability consequences; no public exploit or KEV listing has been identified at time of analysis.
Unauthorized read access to a subset of project manufacturing data is possible via the PJM Command Center component in Oracle Project Manufacturing V16, exploitable over HTTP by a low-privileged authenticated network attacker. Despite the 'Authentication Bypass' tag from EUVD, the CVSS vector (PR:L) confirms valid credentials are required, indicating the bypass operates at the authorization layer within PJM Command Center rather than bypassing the EBS login mechanism entirely. Exploitation is significantly constrained by high attack complexity (AC:H), the confidentiality impact is limited (C:L), and no public exploit or active exploitation has been identified at time of analysis.
Oracle Project Manufacturing V16's PJM Command Center component exposes a low-severity local vulnerability requiring infrastructure-level access and high attack complexity. A low-privileged attacker with logon access to the host infrastructure can, under difficult exploitation conditions, perform unauthorized data modification or deletion against accessible Project Manufacturing records and induce a partial denial of service against the component. No public exploit code exists and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, placing practical risk well below the already-low CVSS score of 3.6 suggests.
Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component, part of Oracle E-Business Suite) permits a highly privileged, locally authenticated attacker to bypass access controls and gain unauthorized read access to all Oracle Project Manufacturing data as well as limited write access. The CVSS vector (AV:L/AC:H/PR:H) confirms this is neither remotely exploitable nor accessible to low-privileged users, substantially constraining real-world impact despite the High confidentiality impact rating. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component of Oracle E-Business Suite) enables a high-privileged attacker with local infrastructure access to achieve unauthorized read and write access to critical application data. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector explicitly requires high privileges (PR:H) and local access (AV:L), suggesting the bypass operates within application-layer authorization controls rather than at the authentication perimeter. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Full takeover of Oracle MySQL Server and MySQL Cluster is achievable by a high-privileged local attacker exploiting a flaw in the Group Replication Group Communication System (GCS) component across multiple supported release trains. Affected deployments span MySQL Server 8.4.x and 9.7.x, and MySQL Cluster 8.0.x, 8.4.x, and 9.7.x. Despite the CVSS score of 6.4 being mid-range, the CIA impact triple (C:H/I:H/A:H) indicates complete compromise of the database instance; however, the local attack vector (AV:L), high complexity (AC:H), and high privilege requirement (PR:H) substantially constrain real-world exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit flaw in the Server: Replication component, affecting MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Despite a moderate CVSS base score of 6.4, the impact triad is complete (C:H/I:H/A:H), meaning successful exploitation grants an attacker full control over data confidentiality, integrity, and service availability. No public exploit code exists and no confirmed active exploitation has been identified at time of analysis, with exploitation gated by local infrastructure access and high privilege requirements.
Cross-repository information disclosure in Gitea's org-level Actions API exposes workflow run and job metadata from private repositories to any authenticated organization member, regardless of per-repository access rights. The endpoints GET /api/v1/orgs/{org}/actions/runs and GET /api/v1/orgs/{org}/actions/jobs bypass per-repo ACL checks entirely, allowing low-privileged org members with no team or repository assignments to enumerate private repo names, commit SHAs, branch names, workflow file paths, contributor identities, CI timing, and commit messages across the entire organization. No CISA KEV listing or separately published exploit tool has been identified, but the detailed advisory with curl reproduction commands substantially lowers the exploitation barrier.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows any low-privileged, network-accessible attacker to crash or hang the database server by exploiting a flaw in the Optimizer component. The attack requires only valid database credentials and can be executed via multiple supported protocols (e.g., classic MySQL protocol, X Protocol), with no additional user interaction or elevated permissions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but Oracle's own language - 'easily exploitable' - and the CVSS AC:L rating indicate low barrier to triggering the condition once credentials are obtained.
Unauthenticated remote data exposure and manipulation affects Oracle Applications Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite, via the Oracle Diagnostics Interfaces component. An attacker with HTTP network access can bypass authentication to read a subset of OAM-accessible data and perform unauthorized insert, update, or delete operations against OAM data - no credentials or user interaction required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the low attack complexity and unauthenticated vector raise real-world concern for internet-facing or poorly segmented EBS deployments.
Oracle Project Manufacturing V16 (PJM Command Center component) exposes a local privilege-abuse flaw allowing a high-privileged attacker with infrastructure logon access to bypass authorization controls and gain unauthorized read and write access to all Project Manufacturing data. The CVSS vector (AV:L/AC:H/PR:H) constrains real-world risk significantly - exploitation requires existing elevated access on the host infrastructure and high attack complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping this vulnerability in a watchlist rather than emergency-response category for most organizations.
Local privilege escalation in Oracle Data Integrator's Patchset Assistant component allows low-privileged users with host logon access to bypass internal authorization controls and gain complete read access to all data accessible by the ODI process across versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope change designation (S:C) confirms that successful exploitation can cascade beyond ODI itself to impact additional Oracle Fusion Middleware products and any data systems connected through ODI integration pipelines. No public exploit code has been identified at time of analysis, and exploitation is constrained to attackers with existing local host access.
Local unauthorized data read in Oracle Data Integrator's Patchset Assistant component allows a low-privileged user with local logon access to the ODI host to read a subset of data they are not entitled to access. Affected versions are 12.2.1.4.0 and 14.1.2.0.0 as confirmed by Oracle's July 2026 Critical Patch Update. With a CVSS 3.1 score of 3.3, no KEV listing, and no public exploit identified at time of analysis, real-world risk is low and constrained to insider threat or compromised local account scenarios on ODI infrastructure hosts.
MySQL Server and MySQL Cluster versions 9.0.0 through 9.7.1 are vulnerable to a network-reachable denial-of-service condition in the query Optimizer component, exploitable by any low-privileged authenticated user. A successful attack causes a complete, repeatable hang or crash of the database server process, disrupting all connected clients. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthorized data access and modification in Oracle Performance Management (E-Business Suite Appraisals component, versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated user with HTTP network access. The flaw enables partial reads of restricted appraisal data and unauthorized insert, update, or delete operations within the accessible data scope - an insider threat or compromised low-privilege account scenario. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing real-world urgency at moderate levels for enterprises running Oracle E-Business Suite with the Performance Management module active.
Unauthorized data read in Oracle Coherence Core component affects all four supported release lines (12.2.1.4.0 through 15.1.1.0.0) via HTTP, allowing a low-privileged network attacker to access a subset of cached data without proper authorization. The vendor-assigned 'Authentication Bypass' tag suggests the root cause is an authorization control deficiency in the HTTP-facing Core layer rather than a complete absence of authentication - low-privilege credentials appear sufficient to bypass higher-tier access controls. No public exploit or active exploitation has been identified at time of analysis; EPSS data was not provided in the input.
Denial of service in Oracle Coherence's Core component allows a low-privileged network attacker to cause a hang or repeatable crash of the service via TCP, affecting all four currently supported release lines (12.2.1.4.0 through 15.1.1.0.0). Oracle classifies this as easily exploitable - low attack complexity and no user interaction required - making it accessible to any authenticated user with TCP connectivity to the cluster. No public exploit has been identified at time of analysis, and Oracle disclosed this through its July 2026 Critical Patch Update; the CVE is not listed in CISA KEV.
Partial denial of service in Oracle Coherence's Core component allows a low-privileged, network-connected attacker to degrade availability across four supported release lines (12.2.1.4.0 through 15.1.1.0.0) via HTTP with low attack complexity. The CVSS 3.1 vector confirms a straightforward network path requiring only a valid low-privilege account and no user interaction, with impact strictly bounded to partial availability loss - confidentiality and integrity are unaffected. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog.
Unauthorized read access to Oracle Coherence data is achievable by unauthenticated network attackers targeting the Core component via HTTP across all current supported releases (12.2.1.4.0 through 15.1.1.0.0). The 'Authentication Bypass' tag combined with a PR:N CVSS vector confirms that no credentials are required, but impact is bounded to a partial subset of accessible data (C:L), not full cluster compromise. No public exploit or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the trivially low exploitation complexity.
Unauthorized data access in Oracle Coherence allows a low-privileged, network-adjacent attacker to read, insert, update, or delete data within the Coherence data grid via TCP. Affected versions span the current supported lifecycle: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Despite a moderate CVSS score of 5.4, the 'easily exploitable' descriptor and Authentication Bypass tag suggest the barrier to exploitation is low once an attacker holds any valid low-privileged credential or session token - making this a meaningful data integrity and confidentiality risk in multi-tenant or externally-accessible Coherence deployments. No public exploit code or CISA KEV listing identified at time of analysis.
Oracle Coherence's Core component across all currently-supported Fusion Middleware releases is exploitable by high-privileged network attackers over HTTP to exfiltrate critical in-memory grid data and perform limited unauthorized data modification. Intelligence sources tag this as an authentication bypass class issue, suggesting that a legitimate high-privileged account can circumvent Coherence's internal data-scope access controls to reach data partitions or records beyond its authorized boundary. No public exploit code exists and the vulnerability does not appear in the CISA KEV catalog at time of analysis, placing this in the planned-maintenance remediation tier rather than emergency response.
Unauthenticated confidentiality breach in Oracle Coherence's Core component exposes complete cached data over TLS to network attackers across all current supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The flaw is tagged as an Authentication Bypass, allowing a remote unauthenticated attacker reachable via TLS to read all data accessible within the Coherence grid - including potentially sensitive application state, session data, and business records. No active exploitation is confirmed (not in CISA KEV) and no public exploit code exists at time of analysis; however, the PR:N/UI:N profile combined with complete confidentiality loss makes this a material concern for enterprises running exposed Coherence clusters.
Oracle Coherence Core in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 exposes a confidentiality flaw that allows a high-privileged local attacker to gain complete unauthorized read access to all data accessible by the Coherence service, with scope change potential extending that breach to additional Oracle Fusion Middleware products sharing the same infrastructure. The CVSS scope change metric (S:C) is the most operationally significant signal here - exploitation is not contained within Oracle Coherence and may expose data in adjacent Oracle products. No public exploit code and no CISA KEV listing exist at time of analysis, and the local attack vector with high-privilege prerequisite significantly constrains real-world exploitability to insider threat or post-compromise scenarios.
Unauthenticated remote read access in Oracle Coherence's Core component allows network attackers to retrieve a subset of data via HTTP without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable network access with no authentication barrier, consistent with the 'Authentication Bypass' tag applied to this CVE. All four current supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected; no public exploit or confirmed active exploitation has been identified at time of analysis.
Denial of service in Oracle Coherence's Core component allows a low-privileged network attacker to crash or indefinitely hang affected instances across four active release branches via crafted TCP communication. The attack requires no user interaction and only low privileges, making it a realistic and automatable threat for any enterprise environment where Coherence cluster ports are reachable by authenticated or low-privileged users. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Oracle's own assessment rates this as network-accessible with low complexity.
Unauthenticated network exploitation of Oracle Coherence's Core component via HTTP allows partial unauthorized read and write access to Coherence-managed data, with a confirmed scope change indicating impact can extend to additional products beyond the directly targeted instance. Affecting four supported versions (12.2.1.4.0 through 15.1.1.0.0), the flaw is tagged as an Authentication Bypass, suggesting the HTTP-facing interface can be accessed without valid credentials under high-complexity attack conditions. No public exploit code has been identified at time of analysis, and Oracle disclosed this through its July 2026 Critical Patch Update.
Unauthorized data read in Oracle Coherence Core enables unauthenticated remote attackers to access a subset of data stored within the in-memory data grid via TCP, with no credentials or user interaction required. Affected versions span the three current release trains: 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, all part of Oracle Fusion Middleware. No public exploit identified at time of analysis; the 'Authentication Bypass' tag combined with a PR:N vector confirms the Core component fails to enforce access controls on inbound TCP connections.
Partial denial-of-service in Oracle Coherence 15.1.1.0.0 (Core component) allows a low-privileged attacker with TCP network access to intermittently degrade availability of the in-memory data grid. The CVSS 3.1 score of 4.3 reflects constrained impact - confidentiality and integrity are unaffected, and no complete service outage is possible. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; Oracle addressed this vulnerability in the July 2026 Critical Patch Update.
Oracle Coherence (Core component) across all currently supported versions exposes authenticated low-privileged network attackers to unauthorized data access and manipulation over HTTP, enabling both partial read access and unauthorized insert, update, or delete operations on Coherence-accessible cached data. Disclosed as part of Oracle's July 2026 Critical Patch Update, this medium-severity flaw is tagged as an Authentication Bypass, suggesting that a low-privileged credential confers data access beyond its intended authorization scope rather than enforcing proper boundary controls. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction mean exploitation is straightforward for any attacker holding valid Coherence credentials.
Denial-of-service and partial data integrity compromise in Oracle Coherence's Core component allows unauthenticated network attackers to hang or crash the service or manipulate a subset of accessible data via HTTP. Affected are three actively supported versions - 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - spanning the current Oracle Fusion Middleware release train. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the zero-confidentiality-impact, high-availability-impact profile is consistent with a resource exhaustion or malformed-request crash class of flaw that may attract opportunistic targeting of exposed Coherence cluster endpoints.
Denial of service in Oracle MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged authenticated attacker to cause a complete, repeatable crash or hang of the database service by exploiting a flaw in the Server: JSON Duality component over any supported network protocol. The vulnerability is rated medium severity (CVSS 4.9) due to the high privilege prerequisite, limiting real-world exposure primarily to environments where privileged credentials have been compromised or where insider threat is a concern. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network attacker to cause a complete hang or repeatable crash of the database server via the JSON Duality component. The vulnerability is rated CVSS 4.9, with the PR:H requirement substantially limiting real-world exposure to authenticated administrators or compromised high-privilege accounts. No public exploit code or active exploitation has been identified at time of analysis.
Denial-of-service exposure in MySQL Server and MySQL Cluster's Replication component allows a high-privileged local attacker to repeatedly crash or hang the database service under difficult-to-reproduce conditions. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit code or active exploitation has been identified at time of analysis.
Partial denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component affects multiple supported release lines, exploitable only by highly privileged, authenticated attackers over the network under difficult conditions. The attack yields only a partial availability impact with no confidentiality or integrity exposure, and no public exploit code has been identified at time of analysis. Given the CVSS score of 2.2 and the combination of high complexity and high privilege requirements, this represents a low-priority, low-impact finding in the context of Oracle's July 2026 Critical Patch Update.
Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged network attacker to cause a complete, repeatable crash or hang of the database service. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis; the CVSS 3.1 score of 4.4 (Medium) accurately reflects the high privilege requirement and elevated attack complexity that substantially constrain real-world risk.
Denial of service in Oracle MySQL Server and MySQL Cluster's replication component allows a high-privileged network attacker to cause a complete hang or repeatedly crash the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code and no confirmed active exploitation have been identified; the high privilege and high complexity requirements substantially constrain real-world risk to insider threats or compromised DBA-level accounts.
Denial-of-service exposure in the MySQL Server and MySQL Cluster Replication component allows a high-privileged, network-connected attacker to crash or hang the database instance repeatedly. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update and ENISA EUVD-2026-46593. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, its presence in a broadly deployed database product warrants patch prioritization within normal maintenance cycles for affected installations.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Group Replication Plugin allows a high-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing exist at time of analysis; the high attack complexity and high privilege requirement substantially limit real-world exploitation reach.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause a complete hang or frequently repeatable crash of the database server. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the combination of high attack complexity and high privilege requirements substantially limits realistic exploitation risk.
Denial-of-service in MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-based attacker to cause a repeatable server hang or crash under difficult-to-reproduce conditions. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47 and the same 8.4/9.7 ranges, with Oracle issuing a fix via the July 2026 Critical Patch Update. No public exploit has been identified and this CVE is not listed in CISA KEV, but the broad version coverage across active MySQL release trains warrants timely patching for environments running MySQL replication.
Full takeover of Oracle MySQL Server and MySQL Cluster is possible through a local, high-complexity vulnerability in the Clone Plugin component, affecting MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Exploitation requires an attacker with high privileges and local logon access to the host infrastructure where MySQL executes, under difficult-to-achieve conditions, limiting realistic risk despite the full confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, and Oracle disclosed this via the July 2026 Critical Patch Update.
Denial-of-service exploitation in Oracle MySQL Server and MySQL Cluster via the Clone Plugin allows a high-privileged, network-connected attacker to cause a complete hang or repeatedly repeatable crash of the database server. Affected version ranges span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed in Oracle's July 2026 Critical Patch Update. No public exploit or active exploitation has been identified; attack complexity is high and requires pre-existing high database privileges, significantly constraining real-world risk to insider or post-breach scenarios.
Full takeover of MySQL Server and MySQL Cluster 9.7.0-9.7.1 is achievable via a local, low-privileged attacker exploiting a flaw in the Server: Configurator component, provided a second user interacts during the attack window. The CVSS 3.1 score of 6.7 reflects the high attack complexity and local-only vector, which meaningfully constrain real-world exploitability despite the high-impact outcome (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent.
Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit vulnerability in the Clone Plugin component, requiring a high-privileged attacker with network access via multiple protocols. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is tempered by the AC:H/PR:H exploitation prerequisites, though the full CIA:H/H/H impact warrants priority patching in environments using the Clone Plugin.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Clone Plugin allows a high-privileged, network-connected attacker to crash or hang the database server through a difficult-to-exploit attack path. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and Oracle disclosed this via its July 2026 Critical Patch Update; exploitation would result in complete availability loss for the targeted database instance.
Denial-of-service via the Optimizer component in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-authenticated attacker to cause a complete, repeatable hang or crash of the database service. The flaw is network-reachable over multiple protocols and requires no user interaction, making it straightforward to trigger by any user holding even minimal database credentials. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this in the Critical Patch Update for July 2026.
Full takeover of Oracle Autonomous Health Framework is achievable by a highly privileged local attacker under difficult exploitation conditions in versions 26.0.0 through 26.2.0, specifically within the Developer triaging platform component. Successful exploitation requires both high infrastructure privileges and active human interaction from a separate user, making opportunistic attacks unlikely. No public exploit code or CISA KEV listing has been identified; this vulnerability appears to be a low-frequency, targeted risk rather than a widespread exploitation concern.
Local confidentiality exposure in Oracle PeopleSoft Enterprise FIN eSettlements 9.2 permits a high-privileged attacker with infrastructure-level logon access to read a subset of financial settlement data beyond their authorization. Disclosed via Oracle's July 2026 Critical Patch Update with a CVSS 3.1 score of 2.3 (Low), this vulnerability's real-world impact is significantly constrained by the local attack vector and high-privilege prerequisite. No active exploitation or public proof-of-concept has been identified at time of analysis.
Local information disclosure in Oracle PeopleSoft Enterprise FIN Pay/Bill Management 9.2 allows a low-privileged user with logon access to the hosting infrastructure to access all financial data within the Pay/Bill Management component. The vulnerability is tagged as an Authentication Bypass, suggesting a low-privileged account holder can circumvent internal access controls to read data beyond their authorization level. No public exploit code exists and it is not listed in the CISA KEV catalog, but the CVSS vector rates it as easily exploitable once local access is obtained.
Oracle Enterprise Asset Management (EAM) versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains an authorization control weakness in its Work Definition Issues component that permits low-privileged authenticated network attackers to partially compromise data integrity and confidentiality over HTTPS. Successful exploitation enables unauthorized read access to a subset of EAM-accessible data as well as unauthorized update, insert, or delete operations against EAM records. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the 'Authentication Bypass' intelligence tag suggests the flaw involves insufficient privilege enforcement within the Work Definition Issues component rather than a full pre-authentication bypass.
Oracle Project Foundation's Project Definition component in E-Business Suite versions 12.2.3 through 12.2.15 allows any low-privileged authenticated user to exploit HTTP-accessible endpoints, resulting in unauthorized read, insert, update, or delete of project data and partial denial of service. Disclosed in Oracle's Critical Patch Update for July 2026 and described by Oracle as 'easily exploitable,' the flaw's low attack complexity and absence of required user interaction broaden the practical attacker population to any valid EBS credential holder. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS signal is available from the provided intelligence.
Full takeover of Oracle MySQL Server and MySQL Cluster is achievable through the Server: Replication component by a highly privileged network attacker who can satisfy difficult exploitation conditions. Affected deployments include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, with complete confidentiality, integrity, and availability impact upon successful exploitation. Oracle disclosed this through the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Oracle Workflow's Notification Mailer component within E-Business Suite 12.2.3-12.2.15 is exploitable by network-authenticated low-privileged users to partially read, modify, and disrupt workflow data over HTTP without user interaction. The CVSS 3.1 score of 6.3 (Medium) reflects constrained but multi-dimensional CIA impact (C:L/I:L/A:L) with low attack complexity, making exploitation straightforward for any valid EBS account holder. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; remediation is available through the Oracle Critical Patch Update for July 2026.
Oracle Content Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite expose a medium-severity flaw in the Cover Letter component, exploitable by any low-privileged authenticated user over HTTP without user interaction. Successful exploitation allows unauthorized read access to a subset of Content Manager data, unauthorized insert/update/delete of accessible records, and partial denial of service against the component. No public exploit code and no CISA KEV listing have been identified at time of analysis; this vulnerability was disclosed as part of Oracle's July 2026 Critical Patch Update.
Partial confidentiality, integrity, and availability compromise in Oracle Partner Management's Partner Dashboard component (E-Business Suite 12.2.3-12.2.15) is reachable over HTTPS by any low-privileged account holder without user interaction. Successful exploitation allows unauthorized read access to a subset of partner data, unauthorized modification or insertion of records, and partial denial of service against the affected component. No public exploit code or CISA KEV listing exists at time of analysis; the July 2026 Oracle Critical Patch Update addresses the issue.
Network-exploitable integrity, confidentiality, and availability compromise in Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3 through 12.2.15) allows low-privileged authenticated attackers over HTTP to read, modify, or partially disrupt accessible data within the Web Service Provider component. Oracle rates this CVSS 6.3 Medium, with all three security pillars impacted at a low level and no scope change beyond the affected component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a credible threat for any internet- or intranet-reachable EBS deployment running the affected version range.
Oracle SDP Number Portability versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes a medium-severity flaw in its Installation sub-component that permits low-privileged authenticated network attackers to manipulate accessible data and partially disrupt service availability via HTTP. The CVSS 3.1 score of 5.4 reflects limited scope - no confidentiality impact and only partial integrity and availability degradation - with no confirmed active exploitation (not listed in CISA KEV) and no publicly available proof-of-concept at time of analysis. Oracle disclosed this vulnerability as part of the Critical Patch Update for July 2026, classifying it as 'easily exploitable' given the low attack complexity and absence of required user interaction.
MySQL Cluster's NDB Operator component allows a local, unauthenticated attacker with logon access to the infrastructure host to bypass authentication controls and gain complete read access to all MySQL Cluster data. Three active release lines are affected - 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1 - as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) together with the local-only access vector (AV:L) substantially constrain realistic exploitation, though the data-exposure consequence remains significant for environments handling sensitive workloads.
Unauthorized read access to all WebCenter Sites data is achievable by unauthenticated remote attackers via HTTP against Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 - two currently supported versions of Oracle Fusion Middleware's web content management component. The vulnerability is tagged as an Authentication Bypass requiring one-time victim interaction (UI:R), suggesting an attacker-controlled HTTP trigger that a legitimate user must initiate (e.g., by visiting a crafted URL or link), after which the attacker gains complete confidentiality access to all CMS data. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Full takeover of Oracle Java SE 8u491 and 8u491-perf is achievable by a low-privileged local attacker exploiting a flaw in the Installation component, disclosed as part of Oracle's July 2026 Critical Patch Update. The attack chain requires high complexity - indicating race conditions or precise timing - combined with human interaction from a third party, likely a privileged user performing installation or update activity. No public exploit code has been identified and CISA KEV listing is absent at time of analysis, but the C:H/I:H/A:H impact triad makes successful exploitation fully destructive to the affected Java SE instance.
Unauthenticated remote exploitation of Oracle Advanced Pricing (E-Business Suite 12.2.3-12.2.15) via HTTP allows attackers to read and tamper with price list data without any credentials. The 'Authentication Bypass' tag and PR:N CVSS vector together confirm that the Price List component exposes sensitive pricing operations to the network without enforcing authentication. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a straightforward target for opportunistic actors with network access to the EBS HTTP interface.
Oracle Service Delivery Platform's Messaging Enabler component in versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged local users to perform unauthorized read and write operations on platform data, with a documented scope change that extends impact to additional co-deployed Oracle Fusion Middleware products. The vulnerability requires only a low-privileged local account on the hosting infrastructure, making insider threats and compromised service accounts the primary risk vector. No public exploit has been identified at time of analysis; this was disclosed as part of Oracle's July 2026 Critical Patch Update.
Partial data compromise and service disruption in Oracle Advanced Inbound Telephony 12.2.3-12.2.15 (SDK client integration component) is exploitable by a low-privileged attacker over HTTP without requiring user interaction. Successful exploitation allows unauthorized read access to a subset of telephony data, unauthorized insert, update, or delete operations on accessible data, and partial denial of service against the affected module. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS data was not available in the provided intelligence.
Unauthorized data exposure in Oracle Transportation Management 6.5.3 allows low-privileged remote attackers to read a subset of application data via HTTP, exploiting a flaw in the Authentication component. The vulnerability is tagged as an Authentication Bypass and is rated easily exploitable by Oracle, requiring only a low-privilege account and network access - no user interaction or complex conditions apply. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a constrained confidentiality-only impact.
Critical data exposure and unauthorized modification in Oracle Transportation Management 6.5.3 allows a high-privileged network attacker to fully compromise the confidentiality and integrity of all data accessible within the platform. The vulnerability resides in the Integration component, accessible over HTTP, and enables complete read and write access to sensitive supply chain data including shipment records, carrier contracts, and operational logistics data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 'Authentication Bypass' tag alongside PR:H CVSS metrics suggests an authorization bypass rather than a full authentication bypass - warranting close review of privileged account hygiene.
Denial-of-service in Oracle TimesTen In-Memory Database 26.1.1.1.0 allows unauthenticated attackers on the same network segment to crash or indefinitely hang the database service via the ttcserver component. The adjacent-network vector (AV:A) constrains reachability to the local physical or logical segment, but once positioned, exploitation requires no credentials and no user interaction, making the crash frequently repeatable. No public exploit code or active exploitation has been identified at time of analysis.
Partial denial-of-service exposure in Oracle TimesTen In-Memory Database's Kubernetes Operator component (version 26.1.1.1.0) allows a low-privileged, network-authenticated attacker to degrade database availability via crafted HTTPS requests. The attack requires no user interaction and is rated easily exploitable by Oracle, though impact is limited to partial availability loss with no confidentiality or integrity effects. No public exploit code or CISA KEV listing has been identified at time of analysis.
TimesTen In-Memory Database 26.1.1.1.0 contains a medium-severity flaw in its Kubernetes Operator component, exploitable by local high-privileged attackers to gain partial unauthorized read, write, and denial-of-service capability against database data. Critically, the CVSS scope change (S:C) signals that a successful attack may cascade to additional products sharing the Kubernetes cluster, elevating the real-world blast radius beyond the individual component score. No public exploit code and no CISA KEV listing have been identified at time of analysis; Oracle confirmed the issue in the July 2026 Critical Patch Update.
Unauthorized data read in Oracle TimesTen In-Memory Database 26.1.1.1.0 is possible through the Kubernetes Operator component via HTTPS, allowing low-privileged authenticated network attackers to access a subset of database data they should not be authorized to read. The ENISA EUVD threat intelligence tags this as 'Authentication Bypass,' suggesting the Kubernetes Operator fails to enforce proper authorization controls after initial authentication, effectively allowing privilege overreach within an authenticated session. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Confidentiality breach in Oracle TimesTen In-Memory Database 26.1.1.1.0 allows a low-privileged local attacker to gain complete read access to all database-accessible data through the Kubernetes Operator component via an authentication bypass. The scope-change CVSS metric indicates successful exploitation can cascade to co-located Kubernetes resources beyond the database itself. No public exploit or CISA KEV listing exists; exploitation is constrained by the requirement of local infrastructure access and high attack complexity, making this a post-compromise or insider-threat vector rather than a remote exposure.
Full takeover of Oracle TimesTen In-Memory Database 26.1.1.1.0 is achievable by a high-privileged attacker with local logon access to the infrastructure through a flaw in the Kubernetes Operator component. The attack requires no user interaction and is characterized by Oracle as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local information disclosure in Oracle TimesTen In-Memory Database 26.1.1.1.0 (Kubernetes Operator component) permits a low-privileged local attacker to read a subset of database-accessible data. The CVSS scope change (S:C) indicates exploitation can extend impact beyond the vulnerable component itself, potentially affecting other workloads or namespaces co-located in the same Kubernetes cluster. No public exploit code exists and no active exploitation has been confirmed at time of analysis; overall real-world risk is constrained by the requirement for local infrastructure access.
Denial-of-service in Oracle TimesTen In-Memory Database 26.1.1.1.0 allows low-privileged remote attackers to crash or hang the database via crafted HTTPS requests to the Kubernetes Operator component. The vulnerability is network-accessible with low complexity, requiring only low-level credentials, and results in complete availability loss with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle has disclosed this through the July 2026 Critical Patch Update.
Denial-of-service in Oracle TimesTen In-Memory Database 26.1.1.1.0 via the Kubernetes Operator component allows a low-privileged, network-authenticated attacker to repeatedly crash or hang the database over HTTPS. The attack is classified as easily exploitable with low complexity and no user interaction required, making it a straightforward availability threat in Kubernetes-managed deployments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity elevates practical risk for environments where low-privileged accounts are broadly provisioned.
Local authentication bypass in the Kubernetes Operator component of Oracle TimesTen In-Memory Database 26.1.1.1.0 allows a low-privileged attacker with infrastructure access to read all data managed by the database, including critical application data. The CVSS scope change (S:C) confirms that exploitation can cascade beyond the target instance, impacting additional workloads or containers sharing the Kubernetes environment - a meaningful amplifier in multi-tenant deployments. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the Authentication Bypass tag suggests the Operator fails to enforce access controls on a locally accessible interface or API, making exploitation straightforward once infrastructure access is established.
Denial-of-service conditions in Oracle GoldenGate's Receiver Service Executable allow a low-privileged attacker with HTTP network access to crash or indefinitely hang the replication service. Three major version lines are affected - 19.x, 21.x, and 23.x - covering a broad enterprise installed base. No public exploit code or active exploitation has been identified at time of analysis; risk is moderated by the low-privilege authentication requirement but elevated by low attack complexity and the business-critical role GoldenGate plays in continuous database replication pipelines.
Partial denial of service in Oracle GoldenGate's Admin Server Executable component is reachable by unauthenticated attackers with access to the adjacent physical communication segment. Three major release trains are affected - 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.1 - making this broadly relevant across GoldenGate deployments. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is bounded by the adjacent-network requirement.
Unauthorized read access to Oracle GoldenGate data is possible through a flaw in the Admin Server Executable component, affecting three major release trains spanning versions 19.1.0.0.0 through 23.26.1. A low-privileged network attacker can exploit this Authentication Bypass issue over HTTP without user interaction to read a subset of GoldenGate-accessible data. No public exploit code and no CISA KEV listing have been identified at time of analysis; risk is elevated primarily for deployments exposing the Admin Server to untrusted networks.
Remote unauthenticated information disclosure in Oracle GoldenGate's Admin Server Executable allows network-accessible attackers to read a subset of GoldenGate-accessible data over HTTPS without any credentials. Affected versions span two active branches: 21.3-21.21 and 23.4-23.26.1. No public exploit or CISA KEV listing has been identified at time of analysis; Oracle classifies this as easily exploitable with a CVSS 5.3 Medium score reflecting limited confidentiality impact and no integrity or availability consequence.
Unauthorized data manipulation via authentication bypass in Oracle Siebel CRM Integration's Siebel Server Sync for Exchange component allows unauthenticated remote attackers to insert, update, or delete a subset of CRM-accessible data over HTTP. All versions from 17.0 through 26.5 are affected, with exploitation constrained by high attack complexity that substantially reduces real-world risk. No public exploit code or active exploitation has been identified at time of analysis, consistent with the low CVSS score of 3.7 reflecting limited, integrity-only impact.
Unauthorized data read in Oracle JDeveloper's Data Visualization Tools component exposes a subset of accessible application data to remote unauthenticated attackers via HTTP. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, with Oracle tagging this as an authentication bypass class issue. Despite the network-accessible attack vector with no privilege requirement, the high attack complexity (AC:H) and limited confidentiality impact (C:L) anchor this at CVSS 3.7 (Low). No public exploit code exists and it is not listed in the CISA KEV catalog.
Partial data disclosure in Oracle JDeveloper's ADF Faces component (versions 12.2.1.4.0 and 14.1.2.0.0) allows low-privileged network-authenticated attackers to read a subset of JDeveloper-accessible data via crafted HTTP requests. Despite the 'Authentication Bypass' tag, the CVSS PR:L metric confirms full authentication is required - the bypass is best understood as an authorization or access-control bypass within ADF Faces rather than full session bypass. No public exploit has been identified and no CISA KEV listing exists; the low CVSS score of 3.1 reflects high exploit complexity and limited impact scope.
Unauthorized read access to a subset of Oracle JDeveloper data is possible via an unauthenticated HTTP-based attack against the ADF Faces component in Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, and while exploitation requires high attack complexity, no authentication is needed. No public exploit code has been identified at time of analysis, no active exploitation is confirmed, and the CVSS 3.1 score of 3.7 (Low) reflects the limited confidentiality impact and elevated exploitation difficulty.
Oracle JDeveloper's ADF Faces component on versions 12.2.1.4.0 and 14.1.2.0.0 is susceptible to an authentication bypass exploitable over HTTP by unauthenticated network attackers. Successful exploitation yields partial unauthorized read and write/insert/delete access to data accessible within the JDeveloper context - confidentiality and integrity are both impacted at a limited scope. No public exploit has been identified at time of analysis, and the CVSS AC:H rating indicates meaningful technical barriers to exploitation, reducing the practical threat level despite the unauthenticated attack vector.
Local authentication bypass in Oracle JDeveloper's ADF Faces component exposes critical data to low-privileged local users on versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope change (S:C) indicates successful exploitation can extend beyond JDeveloper itself to impact additional Oracle Fusion Middleware products sharing the same infrastructure. No public exploit has been identified at time of analysis, and neither EPSS data nor a CISA KEV listing is available - however, the low attack complexity and no user interaction requirement make exploitation straightforward once local access is established.
Oracle JDeveloper's Java Business Objects component exposes a network-accessible confidentiality and availability flaw in versions 12.2.1.4.0 and 14.1.2.0.0, allowing low-privileged remote attackers to gain unauthorized access to critical or all JDeveloper-accessible data alongside a partial denial of service. The attack complexity is rated high, requiring specific conditions to be met, but no user interaction is needed beyond initial low-privilege authentication. No public exploit code or active exploitation has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Unauthenticated network exploitation of the ADF Faces component in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 enables complete confidentiality compromise of all data accessible within the IDE environment via HTTP. Tagged explicitly as an Authentication Bypass by Oracle's security team (secalert_us@oracle.com), the flaw allows a remote attacker with no credentials to circumvent access controls, though the CVSS AC:H rating constrains opportunistic exploitation by requiring attacker-controlled preconditions to be met. No public exploit or CISA KEV listing exists at time of analysis, and the impact is limited strictly to data exfiltration - no integrity or availability risk is present.
Local privilege abuse in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 allows a low-privileged attacker with infrastructure logon access to perform unauthorized data modifications and induce a partial denial of service against the Enterprise Infrastructure Security component. The attack complexity is rated High, meaning specific conditions beyond the attacker's direct control must be met. No public exploit code exists and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, placing it in a low operational risk tier despite the ERP-critical nature of the platform.
Partial denial of service in JD Edwards EnterpriseOne Tools 9.2.26.3 is achievable by an unauthenticated remote attacker via the JDENET protocol, specifically through the Interoperability Security component. The vulnerability carries a low CVSS base score of 3.7 driven by high attack complexity and limited availability-only impact, with no confidentiality or integrity consequences. No public exploit code or active exploitation has been identified at time of analysis, placing this at low operational priority for most organizations.
Unauthorized data access and manipulation in the French HR Payroll component of Oracle HRMS (France) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a network-based, low-privileged authenticated attacker to read, insert, update, or delete sensitive payroll data via HTTP. The 'Authentication Bypass' tag from multi-source intelligence suggests the root mechanism involves insufficient authorization controls within the payroll component, enabling privilege escalation beyond the attacker's assigned role. No confirmed active exploitation (KEV) or public exploit code exists at time of analysis, but the sensitivity of French HR payroll data - salaries, tax records, employee details - elevates real-world business risk well above what the moderate CVSS score of 5.4 alone conveys.
Unauthorized data disclosure in Oracle Access Manager's Authentication Engine allows unauthenticated remote attackers to read a subset of OAM-accessible data over HTTP. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's OAM component. Tagged as an Authentication Bypass, the flaw carries a CVSS 5.3 (Medium) rating with low confidentiality impact and no integrity or availability consequences; no public exploit or KEV listing has been identified at time of analysis.
Unauthorized read access to a subset of project manufacturing data is possible via the PJM Command Center component in Oracle Project Manufacturing V16, exploitable over HTTP by a low-privileged authenticated network attacker. Despite the 'Authentication Bypass' tag from EUVD, the CVSS vector (PR:L) confirms valid credentials are required, indicating the bypass operates at the authorization layer within PJM Command Center rather than bypassing the EBS login mechanism entirely. Exploitation is significantly constrained by high attack complexity (AC:H), the confidentiality impact is limited (C:L), and no public exploit or active exploitation has been identified at time of analysis.
Oracle Project Manufacturing V16's PJM Command Center component exposes a low-severity local vulnerability requiring infrastructure-level access and high attack complexity. A low-privileged attacker with logon access to the host infrastructure can, under difficult exploitation conditions, perform unauthorized data modification or deletion against accessible Project Manufacturing records and induce a partial denial of service against the component. No public exploit code exists and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, placing practical risk well below the already-low CVSS score of 3.6 suggests.
Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component, part of Oracle E-Business Suite) permits a highly privileged, locally authenticated attacker to bypass access controls and gain unauthorized read access to all Oracle Project Manufacturing data as well as limited write access. The CVSS vector (AV:L/AC:H/PR:H) confirms this is neither remotely exploitable nor accessible to low-privileged users, substantially constraining real-world impact despite the High confidentiality impact rating. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component of Oracle E-Business Suite) enables a high-privileged attacker with local infrastructure access to achieve unauthorized read and write access to critical application data. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector explicitly requires high privileges (PR:H) and local access (AV:L), suggesting the bypass operates within application-layer authorization controls rather than at the authentication perimeter. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Full takeover of Oracle MySQL Server and MySQL Cluster is achievable by a high-privileged local attacker exploiting a flaw in the Group Replication Group Communication System (GCS) component across multiple supported release trains. Affected deployments span MySQL Server 8.4.x and 9.7.x, and MySQL Cluster 8.0.x, 8.4.x, and 9.7.x. Despite the CVSS score of 6.4 being mid-range, the CIA impact triple (C:H/I:H/A:H) indicates complete compromise of the database instance; however, the local attack vector (AV:L), high complexity (AC:H), and high privilege requirement (PR:H) substantially constrain real-world exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit flaw in the Server: Replication component, affecting MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Despite a moderate CVSS base score of 6.4, the impact triad is complete (C:H/I:H/A:H), meaning successful exploitation grants an attacker full control over data confidentiality, integrity, and service availability. No public exploit code exists and no confirmed active exploitation has been identified at time of analysis, with exploitation gated by local infrastructure access and high privilege requirements.
Cross-repository information disclosure in Gitea's org-level Actions API exposes workflow run and job metadata from private repositories to any authenticated organization member, regardless of per-repository access rights. The endpoints GET /api/v1/orgs/{org}/actions/runs and GET /api/v1/orgs/{org}/actions/jobs bypass per-repo ACL checks entirely, allowing low-privileged org members with no team or repository assignments to enumerate private repo names, commit SHAs, branch names, workflow file paths, contributor identities, CI timing, and commit messages across the entire organization. No CISA KEV listing or separately published exploit tool has been identified, but the detailed advisory with curl reproduction commands substantially lowers the exploitation barrier.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows any low-privileged, network-accessible attacker to crash or hang the database server by exploiting a flaw in the Optimizer component. The attack requires only valid database credentials and can be executed via multiple supported protocols (e.g., classic MySQL protocol, X Protocol), with no additional user interaction or elevated permissions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but Oracle's own language - 'easily exploitable' - and the CVSS AC:L rating indicate low barrier to triggering the condition once credentials are obtained.
Unauthenticated remote data exposure and manipulation affects Oracle Applications Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite, via the Oracle Diagnostics Interfaces component. An attacker with HTTP network access can bypass authentication to read a subset of OAM-accessible data and perform unauthorized insert, update, or delete operations against OAM data - no credentials or user interaction required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the low attack complexity and unauthenticated vector raise real-world concern for internet-facing or poorly segmented EBS deployments.
Oracle Project Manufacturing V16 (PJM Command Center component) exposes a local privilege-abuse flaw allowing a high-privileged attacker with infrastructure logon access to bypass authorization controls and gain unauthorized read and write access to all Project Manufacturing data. The CVSS vector (AV:L/AC:H/PR:H) constrains real-world risk significantly - exploitation requires existing elevated access on the host infrastructure and high attack complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping this vulnerability in a watchlist rather than emergency-response category for most organizations.
Local privilege escalation in Oracle Data Integrator's Patchset Assistant component allows low-privileged users with host logon access to bypass internal authorization controls and gain complete read access to all data accessible by the ODI process across versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope change designation (S:C) confirms that successful exploitation can cascade beyond ODI itself to impact additional Oracle Fusion Middleware products and any data systems connected through ODI integration pipelines. No public exploit code has been identified at time of analysis, and exploitation is constrained to attackers with existing local host access.
Local unauthorized data read in Oracle Data Integrator's Patchset Assistant component allows a low-privileged user with local logon access to the ODI host to read a subset of data they are not entitled to access. Affected versions are 12.2.1.4.0 and 14.1.2.0.0 as confirmed by Oracle's July 2026 Critical Patch Update. With a CVSS 3.1 score of 3.3, no KEV listing, and no public exploit identified at time of analysis, real-world risk is low and constrained to insider threat or compromised local account scenarios on ODI infrastructure hosts.
MySQL Server and MySQL Cluster versions 9.0.0 through 9.7.1 are vulnerable to a network-reachable denial-of-service condition in the query Optimizer component, exploitable by any low-privileged authenticated user. A successful attack causes a complete, repeatable hang or crash of the database server process, disrupting all connected clients. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthorized data access and modification in Oracle Performance Management (E-Business Suite Appraisals component, versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated user with HTTP network access. The flaw enables partial reads of restricted appraisal data and unauthorized insert, update, or delete operations within the accessible data scope - an insider threat or compromised low-privilege account scenario. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing real-world urgency at moderate levels for enterprises running Oracle E-Business Suite with the Performance Management module active.
Unauthorized data read in Oracle Coherence Core component affects all four supported release lines (12.2.1.4.0 through 15.1.1.0.0) via HTTP, allowing a low-privileged network attacker to access a subset of cached data without proper authorization. The vendor-assigned 'Authentication Bypass' tag suggests the root cause is an authorization control deficiency in the HTTP-facing Core layer rather than a complete absence of authentication - low-privilege credentials appear sufficient to bypass higher-tier access controls. No public exploit or active exploitation has been identified at time of analysis; EPSS data was not provided in the input.
Denial of service in Oracle Coherence's Core component allows a low-privileged network attacker to cause a hang or repeatable crash of the service via TCP, affecting all four currently supported release lines (12.2.1.4.0 through 15.1.1.0.0). Oracle classifies this as easily exploitable - low attack complexity and no user interaction required - making it accessible to any authenticated user with TCP connectivity to the cluster. No public exploit has been identified at time of analysis, and Oracle disclosed this through its July 2026 Critical Patch Update; the CVE is not listed in CISA KEV.
Partial denial of service in Oracle Coherence's Core component allows a low-privileged, network-connected attacker to degrade availability across four supported release lines (12.2.1.4.0 through 15.1.1.0.0) via HTTP with low attack complexity. The CVSS 3.1 vector confirms a straightforward network path requiring only a valid low-privilege account and no user interaction, with impact strictly bounded to partial availability loss - confidentiality and integrity are unaffected. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog.
Unauthorized read access to Oracle Coherence data is achievable by unauthenticated network attackers targeting the Core component via HTTP across all current supported releases (12.2.1.4.0 through 15.1.1.0.0). The 'Authentication Bypass' tag combined with a PR:N CVSS vector confirms that no credentials are required, but impact is bounded to a partial subset of accessible data (C:L), not full cluster compromise. No public exploit or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the trivially low exploitation complexity.
Unauthorized data access in Oracle Coherence allows a low-privileged, network-adjacent attacker to read, insert, update, or delete data within the Coherence data grid via TCP. Affected versions span the current supported lifecycle: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Despite a moderate CVSS score of 5.4, the 'easily exploitable' descriptor and Authentication Bypass tag suggest the barrier to exploitation is low once an attacker holds any valid low-privileged credential or session token - making this a meaningful data integrity and confidentiality risk in multi-tenant or externally-accessible Coherence deployments. No public exploit code or CISA KEV listing identified at time of analysis.
Oracle Coherence's Core component across all currently-supported Fusion Middleware releases is exploitable by high-privileged network attackers over HTTP to exfiltrate critical in-memory grid data and perform limited unauthorized data modification. Intelligence sources tag this as an authentication bypass class issue, suggesting that a legitimate high-privileged account can circumvent Coherence's internal data-scope access controls to reach data partitions or records beyond its authorized boundary. No public exploit code exists and the vulnerability does not appear in the CISA KEV catalog at time of analysis, placing this in the planned-maintenance remediation tier rather than emergency response.
Unauthenticated confidentiality breach in Oracle Coherence's Core component exposes complete cached data over TLS to network attackers across all current supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The flaw is tagged as an Authentication Bypass, allowing a remote unauthenticated attacker reachable via TLS to read all data accessible within the Coherence grid - including potentially sensitive application state, session data, and business records. No active exploitation is confirmed (not in CISA KEV) and no public exploit code exists at time of analysis; however, the PR:N/UI:N profile combined with complete confidentiality loss makes this a material concern for enterprises running exposed Coherence clusters.
Oracle Coherence Core in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 exposes a confidentiality flaw that allows a high-privileged local attacker to gain complete unauthorized read access to all data accessible by the Coherence service, with scope change potential extending that breach to additional Oracle Fusion Middleware products sharing the same infrastructure. The CVSS scope change metric (S:C) is the most operationally significant signal here - exploitation is not contained within Oracle Coherence and may expose data in adjacent Oracle products. No public exploit code and no CISA KEV listing exist at time of analysis, and the local attack vector with high-privilege prerequisite significantly constrains real-world exploitability to insider threat or post-compromise scenarios.
Unauthenticated remote read access in Oracle Coherence's Core component allows network attackers to retrieve a subset of data via HTTP without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable network access with no authentication barrier, consistent with the 'Authentication Bypass' tag applied to this CVE. All four current supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected; no public exploit or confirmed active exploitation has been identified at time of analysis.
Denial of service in Oracle Coherence's Core component allows a low-privileged network attacker to crash or indefinitely hang affected instances across four active release branches via crafted TCP communication. The attack requires no user interaction and only low privileges, making it a realistic and automatable threat for any enterprise environment where Coherence cluster ports are reachable by authenticated or low-privileged users. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Oracle's own assessment rates this as network-accessible with low complexity.
Unauthenticated network exploitation of Oracle Coherence's Core component via HTTP allows partial unauthorized read and write access to Coherence-managed data, with a confirmed scope change indicating impact can extend to additional products beyond the directly targeted instance. Affecting four supported versions (12.2.1.4.0 through 15.1.1.0.0), the flaw is tagged as an Authentication Bypass, suggesting the HTTP-facing interface can be accessed without valid credentials under high-complexity attack conditions. No public exploit code has been identified at time of analysis, and Oracle disclosed this through its July 2026 Critical Patch Update.
Unauthorized data read in Oracle Coherence Core enables unauthenticated remote attackers to access a subset of data stored within the in-memory data grid via TCP, with no credentials or user interaction required. Affected versions span the three current release trains: 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, all part of Oracle Fusion Middleware. No public exploit identified at time of analysis; the 'Authentication Bypass' tag combined with a PR:N vector confirms the Core component fails to enforce access controls on inbound TCP connections.
Partial denial-of-service in Oracle Coherence 15.1.1.0.0 (Core component) allows a low-privileged attacker with TCP network access to intermittently degrade availability of the in-memory data grid. The CVSS 3.1 score of 4.3 reflects constrained impact - confidentiality and integrity are unaffected, and no complete service outage is possible. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; Oracle addressed this vulnerability in the July 2026 Critical Patch Update.
Oracle Coherence (Core component) across all currently supported versions exposes authenticated low-privileged network attackers to unauthorized data access and manipulation over HTTP, enabling both partial read access and unauthorized insert, update, or delete operations on Coherence-accessible cached data. Disclosed as part of Oracle's July 2026 Critical Patch Update, this medium-severity flaw is tagged as an Authentication Bypass, suggesting that a low-privileged credential confers data access beyond its intended authorization scope rather than enforcing proper boundary controls. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction mean exploitation is straightforward for any attacker holding valid Coherence credentials.
Denial-of-service and partial data integrity compromise in Oracle Coherence's Core component allows unauthenticated network attackers to hang or crash the service or manipulate a subset of accessible data via HTTP. Affected are three actively supported versions - 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - spanning the current Oracle Fusion Middleware release train. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the zero-confidentiality-impact, high-availability-impact profile is consistent with a resource exhaustion or malformed-request crash class of flaw that may attract opportunistic targeting of exposed Coherence cluster endpoints.
Denial of service in Oracle MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged authenticated attacker to cause a complete, repeatable crash or hang of the database service by exploiting a flaw in the Server: JSON Duality component over any supported network protocol. The vulnerability is rated medium severity (CVSS 4.9) due to the high privilege prerequisite, limiting real-world exposure primarily to environments where privileged credentials have been compromised or where insider threat is a concern. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network attacker to cause a complete hang or repeatable crash of the database server via the JSON Duality component. The vulnerability is rated CVSS 4.9, with the PR:H requirement substantially limiting real-world exposure to authenticated administrators or compromised high-privilege accounts. No public exploit code or active exploitation has been identified at time of analysis.
Denial-of-service exposure in MySQL Server and MySQL Cluster's Replication component allows a high-privileged local attacker to repeatedly crash or hang the database service under difficult-to-reproduce conditions. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit code or active exploitation has been identified at time of analysis.
Partial denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component affects multiple supported release lines, exploitable only by highly privileged, authenticated attackers over the network under difficult conditions. The attack yields only a partial availability impact with no confidentiality or integrity exposure, and no public exploit code has been identified at time of analysis. Given the CVSS score of 2.2 and the combination of high complexity and high privilege requirements, this represents a low-priority, low-impact finding in the context of Oracle's July 2026 Critical Patch Update.
Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged network attacker to cause a complete, repeatable crash or hang of the database service. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis; the CVSS 3.1 score of 4.4 (Medium) accurately reflects the high privilege requirement and elevated attack complexity that substantially constrain real-world risk.
Denial of service in Oracle MySQL Server and MySQL Cluster's replication component allows a high-privileged network attacker to cause a complete hang or repeatedly crash the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code and no confirmed active exploitation have been identified; the high privilege and high complexity requirements substantially constrain real-world risk to insider threats or compromised DBA-level accounts.
Denial-of-service exposure in the MySQL Server and MySQL Cluster Replication component allows a high-privileged, network-connected attacker to crash or hang the database instance repeatedly. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update and ENISA EUVD-2026-46593. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, its presence in a broadly deployed database product warrants patch prioritization within normal maintenance cycles for affected installations.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Group Replication Plugin allows a high-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code and no CISA KEV listing exist at time of analysis; the high attack complexity and high privilege requirement substantially limit real-world exploitation reach.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-connected attacker to cause a complete hang or frequently repeatable crash of the database server. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the combination of high attack complexity and high privilege requirements substantially limits realistic exploitation risk.
Denial-of-service in MySQL Server and MySQL Cluster's Replication component allows a high-privileged, network-based attacker to cause a repeatable server hang or crash under difficult-to-reproduce conditions. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47 and the same 8.4/9.7 ranges, with Oracle issuing a fix via the July 2026 Critical Patch Update. No public exploit has been identified and this CVE is not listed in CISA KEV, but the broad version coverage across active MySQL release trains warrants timely patching for environments running MySQL replication.
Full takeover of Oracle MySQL Server and MySQL Cluster is possible through a local, high-complexity vulnerability in the Clone Plugin component, affecting MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Exploitation requires an attacker with high privileges and local logon access to the host infrastructure where MySQL executes, under difficult-to-achieve conditions, limiting realistic risk despite the full confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, and Oracle disclosed this via the July 2026 Critical Patch Update.
Denial-of-service exploitation in Oracle MySQL Server and MySQL Cluster via the Clone Plugin allows a high-privileged, network-connected attacker to cause a complete hang or repeatedly repeatable crash of the database server. Affected version ranges span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, disclosed in Oracle's July 2026 Critical Patch Update. No public exploit or active exploitation has been identified; attack complexity is high and requires pre-existing high database privileges, significantly constraining real-world risk to insider or post-breach scenarios.
Full takeover of MySQL Server and MySQL Cluster 9.7.0-9.7.1 is achievable via a local, low-privileged attacker exploiting a flaw in the Server: Configurator component, provided a second user interacts during the attack window. The CVSS 3.1 score of 6.7 reflects the high attack complexity and local-only vector, which meaningfully constrain real-world exploitability despite the high-impact outcome (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent.
Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit vulnerability in the Clone Plugin component, requiring a high-privileged attacker with network access via multiple protocols. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is tempered by the AC:H/PR:H exploitation prerequisites, though the full CIA:H/H/H impact warrants priority patching in environments using the Clone Plugin.
Denial-of-service in Oracle MySQL Server and MySQL Cluster's Clone Plugin allows a high-privileged, network-connected attacker to crash or hang the database server through a difficult-to-exploit attack path. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and Oracle disclosed this via its July 2026 Critical Patch Update; exploitation would result in complete availability loss for the targeted database instance.
Denial-of-service via the Optimizer component in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-authenticated attacker to cause a complete, repeatable hang or crash of the database service. The flaw is network-reachable over multiple protocols and requires no user interaction, making it straightforward to trigger by any user holding even minimal database credentials. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this in the Critical Patch Update for July 2026.
Full takeover of Oracle Autonomous Health Framework is achievable by a highly privileged local attacker under difficult exploitation conditions in versions 26.0.0 through 26.2.0, specifically within the Developer triaging platform component. Successful exploitation requires both high infrastructure privileges and active human interaction from a separate user, making opportunistic attacks unlikely. No public exploit code or CISA KEV listing has been identified; this vulnerability appears to be a low-frequency, targeted risk rather than a widespread exploitation concern.