Oracle
Monthly
Oracle Siebel CRM Integration 25.12 through 26.9 is exposed through its Open Integration component to unauthenticated, HTTP-based attacks that succeed only when a legitimate user interacts with attacker-supplied content. A successful attack gives limited read access plus unauthorized insert, update, or delete capability within the integration scope, and the scope change means other products can be affected. At CVSS 3.1 base 6.1, the required user interaction is the main barrier to automated exploitation, and no public exploit was identified at the time of analysis.
Critical project data exposure and limited data tampering in Primavera P6 Enterprise Project Portfolio Management Web Access can occur when a low-privileged authenticated user persuades another user to interact with crafted HTTP content. Affected releases span 21.12.0.0 through 25.12.8, and the CVSS scope change means a successful attack may also affect connected Oracle products. Exploitation is rated difficult, requires valid credentials and a second human victim; no public exploit identified at time of analysis, and there is no CISA KEV entry.
Oracle Java SE (Libraries component) can be induced to improperly allow modification of critical or otherwise protected data, giving an attacker an integrity-only impact across JDK 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, plus Oracle GraalVM for JDK 17.0.20.1 / 21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1. Although the CVSS vector shows PR:N (no privileges required), exploitation is heavily constrained: the attacker must already have local logon access to the host running Java (AV:L), the attack is difficult to reproduce (AC:H), and it requires a user other than the attacker to interact with the malicious content (UI:R), yielding a 4.7 base score with no confidentiality or availability impact. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; real exposure is largely limited to deployments that execute untrusted code through Java APIs (for example a web service feeding data into the Libraries APIs) or legacy sandbox-dependent Java Web Start / applet scenarios. The third-party 'Authentication Bypass' tag should be treated with caution - the assessed vector describes a local, human-triggered integrity bug, not a remote authentication bypass.
Partial confidentiality and integrity compromise in Oracle Java SE (8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27) and the corresponding Oracle GraalVM for JDK and GraalVM Enterprise Edition releases arises from weaknesses in the Serviceability component's APIs, which an unauthenticated, network-reachable attacker can reach by supplying crafted data through a web service or another supported protocol. Oracle rates the issue as difficult to exploit due to high attack complexity, and the impact is bounded to unauthorized read of a subset of data plus unauthorized update, insert, or delete access to some data, with no effect on availability. No public exploit code and no CISA KEV listing were identified at time of analysis, and despite the ubiquity of the Java platform this scores only 4.8 - a genuinely moderate-severity, low-priority issue that still merits routine patch-cycle handling.
Partial denial of service in Oracle Java SE and Oracle GraalVM JDK occurs when the JSSE component processes attacker-supplied TLS data reachable over the network. Affected releases include Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1 and 25.0.4.1, plus GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1. Unauthenticated remote attackers can cause only a partial availability impact (CVSS 5.3, A:L); no public exploit was identified at time of analysis.
Local users holding a valid low-privileged login on the infrastructure hosting Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.9) can read a limited subset of application data they should not be entitled to see. The flaw is confined to a local attack vector with required authentication (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 3.3), so it offers no network or unauthenticated path and cannot modify data or disrupt service. There is no public exploit identified at time of analysis and no KEV listing, making this a genuinely low-priority issue whose realistic exposure is limited to insiders or attackers who already hold a foothold on the host. Note that the feed-supplied 'Authentication Bypass' tag is not supported by the assessed vector, which explicitly requires credentials.
Unauthenticated network attackers can read a limited subset of Oracle Siebel CRM Cloud Applications data through the Siebel Cloud Manager component in versions 22.3 through 26.9. Oracle rates this CVSS 3.1 5.8 (Medium) with AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, reflecting a low-complexity HTTP attack that requires no credentials or user interaction and can affect resources beyond the vulnerable component while only exposing confidentiality. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated information disclosure in Oracle Siebel CRM Cloud Applications 22.3 through 26.9 allows network attackers to read a limited subset of data through the Siebel Cloud Manager component over HTTP. Oracle rates the flaw as easily exploitable with CVSS 5.3 and confidentiality-only impact; no public exploit identified at time of analysis, and no CISA KEV status was supplied.
Integrity compromise in Oracle Siebel CRM Cloud Applications 22.3 through 26.9 lets an authenticated low-privileged attacker with HTTP network access to the Siebel Cloud Manager component create, delete, or modify critical data. Oracle rates this CVSS 5.3 and describes it as difficult to exploit because of high attack complexity, and the supplied intelligence shows no public exploit identified at time of analysis and no CISA KEV entry. User interaction is not required, but confidentiality and availability are unaffected, making this a moderate-severity, moderate-priority issue rather than an urgent one.
Local high-privileged attackers can read critical data from Siebel CRM Cloud Applications 22.3 through 26.9 by exploiting a flaw in the Siebel Cloud Manager component. The issue is rated CVSS 4.1 with a local, high-complexity, high-privilege vector (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N), so it is not remotely exploitable and requires an attacker who already has logon access to the infrastructure hosting the product. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided.
Local low-privileged users with logon access to a Siebel CRM Cloud Applications host can read critical application data beyond their intended scope through a flaw in the Siebel Cloud Manager component, affecting supported versions 22.3 through 26.9. The CVSS 3.1 score is 6.5 (Medium) with AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, meaning exploitation requires authenticated local access, needs no user interaction, changes scope, and impacts confidentiality only. No public exploit code or CISA KEV entry was identified at time of analysis.
Adjacent-network attackers with presence on the physical communication segment of the hardware hosting Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.9) can achieve limited unauthorized read access and update/insert/delete access to application data. Oracle's October 2026 CPU rates this 4.7 with a scope change (S:C), meaning downstream products may also be affected, but the attack is explicitly difficult to exploit (AC:H) and requires adjacent-segment positioning - not internet reachability - so no public exploit is identified at time of analysis and the CVE is not in CISA KEV. The practical risk is confined to insiders, compromised adjacent hosts, or parties with data-center/VLAN presence.
Attackers positioned on the physical or adjacent communication segment serving Siebel Cloud Manager can bypass authentication and reach critical data held in Oracle Siebel CRM Cloud Applications 22.3 through 26.9. No credentials and no user interaction are needed (PR:N/UI:N), but the vendor rates the attack as difficult (AC:H) and confines it to AV:A, so it is not reachable over the open internet and the impact is scored at 5.9 with high confidentiality and low integrity consequences. No public exploit code was identified and the issue is not listed on CISA KEV at the time of analysis, making mass or remote exploitation impractical.
Siebel Cloud Manager, the cloud provisioning and management component of Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9, exposes critical data to unauthenticated attackers who can reach the deployment over an adjacent network segment. Successful exploitation yields full confidentiality and integrity impact - unauthorized creation, deletion, modification, and disclosure of all data accessible to the Siebel CRM Cloud Applications instance - though the CVSS 3.1 score of 6.8 reflects a deliberately high attack complexity and an AV:A adjacency requirement that rules out internet-based exploitation. No public exploit code has been identified at time of analysis and the issue does not appear on CISA KEV, so the realistic threat is confined to attackers who already hold a foothold on the underlying physical or layer-2 communication segment.
Siebel Cloud Manager, the management component of Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9, can be reached over HTTP by an unauthenticated attacker and, under difficult-to-satisfy conditions, disclose a limited subset of application data. The CVSS 3.1 score is 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), with no integrity or availability impact and no public exploit code or CISA KEV confirmation identified at time of analysis. Because exploitation depends on conditions outside the attacker's control and only read access is exposed, signals converge on low real-world priority despite network reachability; Oracle's October 2026 CPU advisory is the reference for fixes.
Unauthenticated HTTP requests to the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.9) can return a limited subset of application data to any attacker who can reach that interface, producing a confidentiality-only impact rated CVSS 3.1 base 5.3. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) requires no credentials, no user interaction, and no special configuration, so real-world exposure is governed almost entirely by whether Cloud Manager is network-reachable rather than by privilege level. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update advisory.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications 22.3 through 26.9 can be reached over HTTP by unauthenticated remote attackers and abused to update, insert, or delete selected data. The CVSS 3.1 score is 5.3 with integrity-only impact, no confidentiality or availability effect, and no user interaction required. No public exploit was identified at time of analysis.
Oracle Siebel CRM Cloud Applications 22.3 through 26.9 can expose sensitive tenant data, potentially all data accessible to that tenant, to an authenticated low-privilege user through the Siebel Cloud Manager component. The issue is remotely reachable over HTTP with low attack complexity and no user interaction, and impact is confidentiality-only (CVSS 3.1 base 6.5; PR:L). No public exploit identified at time of analysis.
Unauthenticated HTTP access to the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications 22.3 through 26.9 can expose a limited subset of application data. The flaw is rated CVSS 3.1 5.3 with low confidentiality impact and no integrity or availability impact, and exploitation requires only network reachability to the affected component. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Confidentiality exposure in Oracle E-Business Suite Order Management (Transaction Entry component) affecting releases 12.2.3 through 12.2.15 lets a low-privileged, HTTP-reachable user read critical order and transaction data they should not be able to see. The CVSS 3.1 base score is 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N): a valid EBS account is required, no user interaction is needed, and Oracle itself describes the flaw as 'difficult to exploit,' so reliability is constrained by conditions outside the attacker's control. There is no integrity or availability impact, and no public exploit code exists - no public exploit identified at time of analysis - so risk is primarily relevant to environments with large populations of low-privileged EBS users or broad HTTP exposure of the Order Management tier.
Unauthorized data modification, limited data disclosure and partial denial of service in Oracle PeopleSoft Enterprise HCM Global Payroll Switzerland 9.2 require an attacker who already holds high-privileged logon access to the infrastructure where the component executes. The CVSS 3.1 score of 4.2 (AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) reflects a local-only attack path with no user interaction and no unauthenticated or remote vector, so the realistic threat actor is a malicious insider or someone who has already achieved privileged compromise on the application or process-scheduler host. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, which keeps operational priority low.
Partial denial of service in Oracle Outside In Technology 8.5.8 (Outside In Clean Content SDK) allows unauthenticated remote attackers to degrade content parsing and conversion availability by supplying crafted input over HTTP. The CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), with no confidentiality or integrity impact, and no public exploit code or CISA KEV entry was identified at time of analysis. Because Outside In is an embedded SDK, actual exposure depends on whether a host application routes untrusted files or data into the Clean Content parser and exposes that path over HTTP.
Local, authenticated low-privileged users on hosts running Oracle Outside In Technology 8.5.8 can abuse the Outside In Clean Content SDK to corrupt or delete critical data and trigger a partial denial of service, with no confidentiality impact. The CVSS 3.1 score is 6.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L), so exposure is limited to environments where an attacker can both log on locally and get crafted content processed by the SDK. No public exploit code or confirmed active exploitation was identified at time of analysis.
Information disclosure in Oracle iSupport, the customer self-service module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), lets a low-privilege account holder read data well beyond their intended scope - up to and including all data the iSupport Service Requests component can reach - over plain HTTP. Oracle's October 2026 Critical Patch Update credits the flaw with a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction and no special conditions beyond a valid self-service login; there is no integrity or availability impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so the practical risk scales with how many low-privilege iSupport accounts exist and whether the portal is internet-facing - this is a moderate, authenticated data-exposure issue rather than an unauthenticated emergency.
Local integrity compromise in Oracle Solaris 11.4's Utility component allows a low-privileged user with an existing logon to create, delete, or modify critical data, with scope change potentially affecting additional products. Oracle rates this CVSS 3.1 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N); no public exploit code or CISA KEV confirmation was identified in the available intelligence. The flaw is not remotely exploitable and requires authenticated local access, narrowing realistic risk to insiders or attackers who already have a foothold.
Unauthorized read access in Oracle Java SE's AWT component affects client-side sandboxed Java deployments that execute untrusted code, and it requires victim interaction plus high attack complexity to succeed. Affected releases include Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, as well as GraalVM for JDK 17.0.20.1 and 21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1; this is a low-priority, low-severity issue despite the network vector, and no public exploit was identified at time of analysis. Real-world exposure is narrow because the Java applet and Web Start sandbox model is deprecated and rarely enabled, and server deployments running only trusted administrator-installed code are explicitly outside the vulnerability's scope.
ImageIO in Oracle Java SE (including 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27) and related GraalVM releases can expose a limited subset of process-accessible data when attacker-controlled image content is decoded through the affected component. The CVSS vector describes a network-reachable, unauthenticated issue (PR:N) but with high attack complexity and only low confidentiality impact; there is no integrity or availability effect. No public exploit was identified at time of analysis, and practical risk is concentrated in services or sandboxed Java deployments that actually pass untrusted images to ImageIO.
Oracle Java SE 21.0.12.1, 25.0.4.1, and 27 contain an integrity-only flaw in the Security component that remote attackers can reach through multiple protocols, potentially causing limited unauthorized update, insert, or delete access to some accessible data. Exploitation is difficult because high attack complexity requires conditions outside the attacker's control, and successful attacks do not affect confidentiality or availability. No public exploit code or CISA KEV entry was identified at time of analysis, making this a low-severity issue despite the ubiquitous product.
Remote attackers can cause limited unauthorized integrity modification of data accessible to Oracle Java SE’s Networking component in specific update releases (8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, plus listed GraalVM builds). Exploitation is unauthenticated (PR:N), requires no user interaction, and depends on attacker-controlled data reaching the Networking APIs-typically through an application web service-or on sandboxed Java Web Start or applet code running untrusted input; no public exploit identified at time of analysis.
PeopleSoft Enterprise CC Common Application Objects 9.2 exposes low-complexity HTTP functionality that lets an attacker who already holds a high-privileged account read and modify a limited subset of application data. Oracle's October 2026 CPU rates this CVSS 3.1 3.8 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N); no public exploit identified at time of analysis and no CISA KEV confirmation. Realistic exposure is therefore malicious or compromised privileged insiders rather than unauthenticated remote attackers.
Partial denial of service in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affects versions 9.2.0.0 through 9.2.26.5 and requires an attacker who already holds a low-privileged logon on the infrastructure where the product executes. Successful exploitation degrades availability only - confidentiality and integrity are unaffected - and because the vector is local (AV:L) with low attack complexity (AC:L) and no user interaction (UI:N), the CVSS 3.1 base score stays at 3.3. No public exploit identified at time of analysis, there is no CISA KEV entry, and no EPSS score was supplied; the Oracle October 2026 Critical Patch Update provides the fix.
Local attackers who already hold an interactive logon on a JD Edwards EnterpriseOne Tools host can leverage a separate privileged user's installation or security-configuration action to gain unauthorized modification of critical data, limited read access, and denial of service in versions 9.2.0.0 through 9.2.26.5 (CVSS 6.5). Exploitation is constrained by high attack complexity, the need for a second human actor, and local access; no public exploit identified at time of analysis.
Oracle Solaris 11.4 contains a denial-of-service flaw in its Libraries component that lets an attacker with local logon access hang or repeatedly crash the operating system, with no confidentiality or integrity impact. Exploitation is difficult: the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R) requires local access, conditions outside the attacker's control, and a separate legitimate user or operator to perform a triggering action. No public exploit code or confirmed active exploitation was identified at time of analysis, and the 4.7 MEDIUM base score appropriately reflects a low-to-moderate priority issue.
Unauthorized read access to a subset of data accessible to Oracle JDeveloper is possible for authenticated low-privileged attackers who already have interactive logon to the host running affected versions 12.2.1.4.0 or 14.1.2.0.0. The vector is strictly local (AV:L, PR:L, UI:N) with confidentiality-only impact (C:L) and no integrity or availability effect, so there is no remote or unauthenticated path. No public exploit identified at time of analysis, and the issue is low priority given the mandatory local access and valid credentials.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 allows a high-privileged local attacker who can log on to the host to modify or delete critical data and cause a hang or repeatable crash, while confidentiality is not impacted. Exploitation is assessed as difficult (AC:H) and requires prior high-privileged logon access to the infrastructure where JDeveloper executes; no public exploit identified at time of analysis.
Data modification in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical or all JDeveloper-accessible data through the Java Business Objects component over HTTP, but Oracle and the CVSS vector classify exploitation as difficult because of high attack complexity and preconditions outside attacker control. The flaw is integrity-only (CVSS 3.1 base 5.9; C:N/I:H/A:N) with no confidentiality or availability impact, and no public exploit code has been identified at time of analysis. Realistic exposure is limited because JDeveloper is a developer tool that is not typically internet-exposed in production.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 expose confidentiality-sensitive data through a flaw in the product's Security Framework, reachable over HTTP by an unauthenticated attacker (CVSS 3.1 base score 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). The attacker must persuade a JDeveloper user - a person other than the attacker - to interact with attacker-controlled content, which is the single factor that keeps the flaw from being trivially remote-exploitable. Successful exploitation yields unauthorized access to critical data or complete access to all data the JDeveloper instance can reach, with no integrity or availability impact; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 expose an ADF Databinding flaw that lets a low-privileged authenticated user reach critical data over the network via SOAP, with a secondary ability to cause a partial denial of service. Oracle rates the issue 'difficult to exploit' (AC:H), so success hinges on configuration or environmental conditions rather than a straightforward single request; integrity is unaffected, and the realistic risk is confidential-data disclosure by an insider or a compromised low-privilege account. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, making this a moderate, lower-priority item for patch planning.
Local, authenticated low-privileged users on a JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 host can exploit the Installation Security component to bypass controls and gain unauthorized read access to critical data, with scope change potentially exposing co-located products. The issue requires prior logon to the infrastructure (AV:L/PR:L) and has no integrity or availability impact, making it a moderate insider-risk concern rather than a remote emergency. No public exploit was identified at time of analysis, and no KEV or EPSS data was supplied.
Unauthorized read access to critical data in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) is possible for unauthenticated remote attackers through the Interoperability SEC component's HTTPS interface. Oracle characterizes the flaw as difficult to exploit (AC:H) and limits impact to confidentiality only, for a CVSS 3.1 base score of 5.9. No public exploit identified at time of analysis, and no CISA KEV activity is associated with this CVE.
Local user-assisted denial of service in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 allows an unauthenticated-at-the-application-layer attacker who already holds a local logon on the hosting infrastructure to degrade availability, but only if another legitimate user performs an interaction. The CVSS 3.1 score is 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), with no confidentiality or integrity impact; no public exploit code was identified at time of analysis, and Oracle's October 2026 Critical Patch Update is the vendor remediation reference.
Low-privileged users who can log on interactively to a host running Oracle JD Edwards EnterpriseOne Tools can abuse the Monitoring and Diagnostics SEC component to modify or delete some restricted EnterpriseOne data and to degrade service availability. Only Tools releases 9.2.0.0 through 9.2.26.5 are affected, and the CVSS 3.1 base score is 3.6 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L), reflecting a local, high-complexity path that yields limited integrity and availability impact with no confidentiality exposure. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires an attacker to already hold a valid low-privileged account with logon access to the EnterpriseOne infrastructure, so the realistic threat is insider misuse or post-compromise lateral activity rather than remote attack. All available signals point to a low-priority issue best handled through routine quarterly patch cycles.
Low-severity integrity tampering in Oracle JD Edwards EnterpriseOne Tools (Web Runtime SEC component) affects versions 9.2.0.0 through 9.2.26.5. An unauthenticated remote attacker can exploit this difficult-to-exploit flaw only if a victim is tricked into interacting with malicious content, resulting in unauthorized update, insert, or delete access to a subset of accessible data. No public exploit code or active exploitation has been identified; the CVSS 3.1 base score is 3.1.
Stored/reflected cross-site scripting in the Web Runtime SEC component of JD Edwards EnterpriseOne Tools (9.2.0.0 through 9.2.26.5) lets a low-privileged authenticated attacker inject content that executes when a different user loads the affected page, producing limited confidentiality and integrity impact and a scope change beyond the vulnerable component. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); exploitation requires both a valid low-privileged account and victim interaction, so unattended mass exploitation is unlikely. No public exploit identified at time of analysis.
Unauthorized data modification and limited data disclosure in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can be triggered by an unauthenticated network attacker who convinces a victim to interact with a crafted HTTP request; the pattern is consistent with a cross-site-scripting-class issue in the Monitoring and Diagnostics SEC component. Successful exploitation can update, insert, or delete some accessible data and read a subset, with a scope change that may affect additional products, but no public exploit was identified at time of analysis and it is not confirmed actively exploited. This is a moderate-severity issue (CVSS 3.1 base 6.1) whose primary limiting factor is the required victim interaction.
A low-privileged authenticated user with network reachability to the JDENET service can degrade availability of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5, producing a partial denial of service against the affected component (Business Logic Infra SEC). The issue scores CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), so there is no confidentiality or integrity impact and no privilege escalation - only a limited availability effect against the tooling itself. There is no public exploit identified at time of analysis and no CISA KEV listing; this is a genuine but low-priority issue that requires prior authentication and is best handled through the scheduled Oracle Critical Patch Update cycle.
Authenticated low-privileged users of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can read a limited subset of application data and partially degrade service availability by sending crafted requests to the JDENET business-logic infrastructure component. The weakness is trivially reachable over the network once a valid low-privilege EnterpriseOne account exists, but its blast radius is bounded: confidentiality and availability impacts are both rated Low and there is no integrity impact, giving a CVSS 3.1 base score of 5.4. No public exploit code or confirmed active exploitation was identified at time of analysis, and no CISA KEV listing exists for this CVE.
Authenticated low-privileged attackers can read a limited subset of data and cause a partial denial of service in Oracle JD Edwards EnterpriseOne Localizations 9.2 through the JDENET protocol. Oracle rates it CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L), so exploitation requires valid low-privilege credentials and network reachability to the JDENET listener; impact is confined to confidentiality and availability, with no integrity effect. No public exploit was identified at time of analysis.
Low-privileged users who already hold interactive logon to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can, under narrowly specific conditions, read and modify a limited subset of the application's data through the Business Logic Infra SEC component. Impact is confined to partial confidentiality and integrity loss (CVSS 3.1 base 3.6, AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) with no availability effect, and exploitation is neither remote nor unauthenticated. No public exploit code or confirmed active exploitation was identified at time of analysis, and the overall risk picture is genuinely low priority.
Local, authenticated low-privileged access to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can be abused through the Web Runtime SEC component to disclose critical or all accessible application data (CVSS 3.1 score 5.5, confidentiality-only). The attacker must already have a valid low-privileged account with logon access to the infrastructure, so there is no unauthenticated network path and no integrity or availability impact; no public exploit code was identified at time of analysis.
Unauthenticated attackers positioned on the same physical or adjacent network segment as a JD Edwards EnterpriseOne Tools host can obtain critical data from the Monitoring and Diagnostics SEC component in versions 9.2.0.0 through 9.2.26.5, with impact limited to confidentiality. Exploitation is rated difficult - success depends on conditions outside the attacker's direct control and requires local segment presence rather than a routed or internet path - and no public exploit code has been identified at time of analysis; the CVSS 3.1 base score is 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Unauthorized disclosure of critical JD Edwards EnterpriseOne Orchestrator data is possible in versions 9.2.0.0 through 9.2.26.5 when a low-privilege authenticated attacker can reach the Orchestrator over HTTP. The flaw is rated CVSS 6.5 with confidentiality-only impact; integrity and availability are unaffected, and no user interaction is needed. No public exploit code or CISA KEV confirmation was present in the supplied intelligence, so risk is moderate and contingent on prior valid Orchestrator access.
Authenticated low-privileged attackers with network reachability to the JDENET service can crash or repeatedly hang Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 (E1 Dev Platform Tech on UNIX), producing a complete denial of service. The CVSS 3.1 score is 6.5, with impact confined to availability (A:H) and no confidentiality or integrity effect; exploitation requires valid low-privileged credentials (PR:L) and no user interaction (UI:N). No public exploit code identified at time of analysis, and the CVE is not reported in CISA KEV; EPSS was not supplied.
Unauthenticated HTTP traffic against Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can leak a limited subset of application data through the Web Runtime SEC component, but only if a victim is first persuaded to interact with attacker-controlled content (UI:R), so there is no self-contained server-side exploitation path. CVSS 3.1 scores it 4.3 with confidentiality-only impact (C:L) and no effect on integrity or availability. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and it is rated a genuinely low-priority issue despite the network-reachable, unauthenticated vector. Oracle addresses it in the October 2026 Critical Patch Update.
Unauthenticated attackers with HTTP network access to the Portal security (Portal SEC) component of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 may be able to read critical data, including potentially all data accessible through the Portal, via an authentication-bypass weakness. The CVSS 3.1 score of 5.9 reflects confidentiality-only impact (C:H/I:N/A:N) tempered by high attack complexity (AC:H), meaning exploitation depends on conditions outside the attacker's control such as specific configuration or environmental state, so the flaw is difficult rather than trivial to exploit reliably. No public exploit code and no CISA KEV confirmed active exploitation were identified at time of analysis.
Unauthenticated, user-assisted attacks against the JD Edwards EnterpriseOne Tools web interface (supported versions 9.2.0.0 through 9.2.26.5) let a remote attacker lure a victim into interacting with attacker-supplied HTTP content, yielding low-impact read and write access to a subset of application data, with scope change extending the impact to additional connected products. Oracle scores this 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) - the UI:R requirement for a tricked human victim is the main limiting factor, so it cannot be triggered automatically. No public exploit code and no CISA KEV entry are identified at time of analysis, and no EPSS data was supplied; treat this as a schedule-the-patch item rather than an emergency.
A cross-site scripting-style injection flaw in the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) can be triggered over HTTP by an unauthenticated remote attacker, but only succeeds if a victim other than the attacker interacts with attacker-supplied content (UI:R). CVSS 3.1 scores it 6.1 with scope change, low confidentiality and low integrity impact on the affected and possibly additional products, and no availability impact; the practical delivery vehicle is a targeted JD Edwards user session rather than mass-automated scanning. Exploitation requires social engineering of a legitimate user's browser, there is no confirmed active exploitation (not in CISA KEV), and no public exploit code was identified at time of analysis.
Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 contain a flaw in the Web Runtime SEC component that allows an unauthenticated, network-positioned attacker to deliver HTTP content which a legitimate logged-in user must be lured into interacting with, yielding partial read plus unauthorized insert/update/delete against that user's accessible data (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The scope change (S:C) means the impact can extend beyond EnterpriseOne Tools into other products that share the victim's browser session and trust context, but confidentiality and integrity effects are each rated Low and there is no availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, and a vendor fix is published in Oracle's October 2026 Critical Patch Update.
Low-privileged local users can read critical data from JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 via the Monitoring and Diagnostics SEC component, according to the Oracle October 2026 CPU. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires an existing interactive logon on the host running the affected Tools, so this is not a remote or unauthenticated authentication bypass despite the supplied 'Authentication Bypass' tag. No public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
Unauthenticated information disclosure in Oracle JD Edwards EnterpriseOne Orchestrator (supported releases 9.2.0.0 through 9.2.26.5) lets any party able to reach the Orchestrator over HTTP read a subset of Orchestrator-accessible data without credentials, privileges, or user interaction (CVSS 3.1 base 5.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The flaw sits in the E1 IOT Orchestrator Security component and is best characterized as an access-control/authentication bypass that yields confidentiality-only impact - no integrity or availability effect - so the practical exposure is bounded to whatever data the reachable endpoint returns. Exploitation requires only network reachability, making risk dominated by whether the Orchestrator tier is internet-exposed or reachable from untrusted segments; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation. Oracle addresses the issue in its October 2026 Critical Patch Update.
Unauthenticated information disclosure in Oracle JD Edwards EnterpriseOne Orchestrator (E1 IOT Orchestrator Security) affects releases 9.2.0.0 through 9.2.26.5, allowing a network attacker to read critical data or effectively all Orchestrator-accessible data. Oracle scores it 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N): no attacker credentials are required, but the attack is rated difficult and depends on a legitimate user other than the attacker being induced to perform an action, and there is no integrity or availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and the high attack complexity plus mandatory victim interaction substantially limit real-world exploitability for what is otherwise a confidentiality-only flaw.
High-privileged SQL access to the Monitoring and Diagnostics SEC component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) can yield unauthorized read of critical data and limited insert/update/delete capability, with a scope change that lets the impact propagate to additional connected products. Exploitation is explicitly rated difficult (AC:H) and is gated behind an attacker who already holds high privileges (PR:H) plus network reachability; no user interaction is required (UI:N). The CVSS 3.1 base score is 6.6, and no public exploit identified at time of analysis. Risk is therefore concentrated in environments where administrative or otherwise highly privileged JD Edwards accounts are shared, weakly controlled, or exposed to untrusted networks.
Unauthenticated network attackers can access or modify data in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 through the Monitoring and Diagnostics SEC component, although high attack complexity makes reliable exploitation difficult. The issue is reachable over HTTP and carries a CVSS 3.1 score of 6.5 with high confidentiality and low integrity impact; no public exploit identified at time of analysis and no CISA KEV entry is present in the provided data.
Unauthenticated network attackers can make limited unauthorized data changes in Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 through an HTTP-reachable security flaw, but exploitation is difficult because it depends on high-complexity conditions outside the attacker's control. The impact is integrity-only, with no confidentiality or availability effect, and no public exploit was identified at time of analysis. Oracle's October 2026 Critical Patch Update advisory is the reference for fixes, and exposure is lower where the SCM Manufacturing HTTP interface is not reachable from untrusted networks.
Low-privileged authenticated users of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Notification Configuration component over HTTP to read a limited subset of application data and to update, insert, or delete some of it, with a scope change that can extend impact to integrated PeopleSoft products. Oracle scores this 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N): a valid account is mandatory, no victim interaction is required, and there is no availability impact, but the high attack complexity means success hinges on conditions outside the attacker's control, making this a moderate rather than high-urgency issue. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Oracle WebCenter Content 14.1.2.0.0 (Content Server component) exposes an HTTP-reachable path that lets an unauthenticated remote attacker cause limited unauthorized reads and writes of Content Server data - but only if a human victim is lured into performing an interaction (CVSS 3.1 5.4, AV:N/AC:L/PR:N/UI:R/C:L/I:L/A:N). The mandatory user-interaction prerequisite and the bounded confidentiality/integrity impact (no availability effect) keep this a moderate-priority item rather than an emergency: without victim action the attack does not succeed, and the flaw cannot by itself disrupt service. No public exploit code or confirmed active exploitation was identified at time of analysis; Oracle addressed the issue through its Critical Patch Update referenced in the October 2026 security advisory.
Oracle WebCenter Content 14.1.2.0.0 (Content Server component of Oracle Fusion Middleware) allows a low-privileged authenticated user with network access over HTTP to read a limited subset of content the account should not be able to see, but only when a high-complexity condition is satisfied - Oracle itself classifies the issue as 'difficult to exploit.' The impact is confidentiality-only (CVSS 3.1 base score 3.1, AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), with no write, integrity, or availability effect, and exploitation requires a pre-existing valid account despite a third-party tag labeling it an authentication bypass. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the available intelligence at time of analysis, and this is a genuinely low-priority issue across nearly every risk signal.
Oracle E-Business Suite iSupport 12.2.3 through 12.2.15 allows an authenticated low-privileged user with HTTP access to the Service Requests component to read critical data and potentially all iSupport-accessible records, producing a confidentiality-only impact at CVSS 3.1 6.5. No public exploit was identified at time of analysis, and exposure is highest where the iSupport portal is internet-facing or broadly accessible to external or customer accounts.
Oracle Solaris 11.4 contains a local information-disclosure weakness in its Libraries component that allows an attacker with an existing low-privileged logon to read a limited subset of system-accessible data. The assessed CVSS vector is strictly local (AV:L), requires low privileges (PR:L), needs no user interaction, and has confidentiality-only impact (C:L), with no integrity or availability effect. The referenced vendor advisory is Oracle's October 2026 Critical Patch Update, and no public exploit code has been identified at time of analysis.
Information disclosure in Oracle WebCenter Portal (Runtime Tools component) allows unauthenticated, network-positioned attackers to read a subset of accessible data from versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 score is 5.3 with AV:N/AC:L/PR:N/UI:N, indicating low-complexity remote exploitation without credentials or user interaction, but impact is limited to confidentiality (C:L) with no integrity or availability effect. No public exploit code was identified at time of analysis, and exploitation requires the portal's HTTP interface to be reachable.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allow a remote, unauthenticated attacker to tamper with or delete critical portal data and to partially degrade service availability through a flaw in the Runtime Tools component reachable over HTTP. Exploitation is not straightforward: the CVSS vector (AC:H, UI:R) means preconditions outside the attacker's control must line up and a legitimate user other than the attacker must be induced to perform an action, which sharply limits opportunistic or automated mass exploitation, and there is no confidentiality impact. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS score supplied, so this is a moderate-severity (5.9) issue to schedule on a normal patch cycle rather than an emergency; Oracle's October 2026 Critical Patch Update advisory is the reference for remediation.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 are affected by a moderate-severity Runtime Tools flaw that lets remote unauthenticated attackers obtain partial read access and limited update/insert/delete capability against portal data, with potential scope change into integrated products. Exploitation requires a victim other than the attacker to interact with crafted content (UI:R), which limits unattended mass exploitation, and the CVSS 3.1 score is 6.1; no public exploit code was identified at time of analysis.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can disclose critical portal-accessible data to an unauthenticated, network-positioned attacker who convinces a separate user to interact with a crafted HTTP request against the Runtime Tools component. Rated CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), the flaw is purely a confidentiality problem - there is no integrity or availability impact - and the mandatory victim-interaction step is the main practical barrier to exploitation. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority issue that warrants timely patching rather than emergency response.
Local denial of service in Oracle Solaris 11.4 allows an authenticated low-privileged user with logon access to the host to cause a hang or frequently repeatable crash of the operating system by targeting the Services component. The issue is availability-only, requires local access and high attack complexity, and Oracle describes it as difficult to exploit; no public exploit code was identified at time of analysis. With a CVSS 3.1 base score of 4.7, it is most relevant to shared or multi-user Solaris systems exposed to untrusted local accounts.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain an unauthenticated HTTP-accessible flaw that can disclose critical or all application-accessible data. The vendor rates attack complexity as high (AC:H), meaning exploitation depends on conditions the attacker does not control and is not reliably repeatable, and impact is limited to confidentiality with no modification or denial of service. No public exploit code or confirmed active exploitation was identified at time of analysis.
Critical data exposure in Oracle WebCenter Content 14.1.2.0.0 requires a low-privileged authenticated attacker, network access via HTTP, and interaction by a separate user, and is rated difficult to exploit. Successful exploitation can give unauthorized read access to critical WebCenter Content data and limited update, insert, or delete access, with scope change potentially affecting additional Oracle products. No public exploit code was identified at time of analysis.
Local, low-privileged users on Oracle Solaris 11.4 can abuse the bundled X Window System component to gain limited unauthorized read and write access to data outside their own scope, plus a partial denial-of-service condition, provided they can convince a second, different user to interact with attacker-influenced X content. The attack surface is narrow: the vector is strictly local (AV:L) with high attack complexity (AC:H) and a required human-interaction step performed by a victim other than the attacker, yielding a CVSS 3.1 score of 4.2. No public exploit code was identified at time of analysis and the issue has not been added to CISA KEV, so practical risk is concentrated in multi-user Solaris hosts where untrusted local accounts coexist with interactive graphical sessions; single-user or tightly access-controlled deployments face negligible exposure.
Denial of service in Oracle Solaris 11.4's Services component can be triggered by an attacker who already holds an interactive local logon, causing a hang or frequently repeatable crash of the affected host. The CVSS 3.1 vector is AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, meaning exploitation is local rather than remote, does not require credentials beyond the local logon, needs no user interaction, and depends on specific runtime conditions that make reliable success difficult. No public exploit code or CISA KEV entry was identified at time of analysis, and impact is confined to availability on the single affected system.
A local low-privilege user on Oracle Solaris 11.4 can abuse a flaw in the X Window System component to read and modify a subset of system data and cause a partial denial of service. Exploitation requires an interactive logon to the affected host and is gated by high attack complexity, meaning success depends on winning a race or hitting a specific non-deterministic runtime state, and the impact stays capped at partial confidentiality, integrity, and availability loss with no privilege escalation. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score of 4.5 reflects the significant practical barriers to abuse.
Oracle Solaris 11.4 exposes a low-severity integrity flaw in its Services component: an attacker with local logon access and no additional privileges (PR:N) can, under high-complexity conditions and with the involvement of a second user, cause unauthorized update, insert, or delete operations against some Solaris-accessible data. The CVSS 3.1 score is 2.5 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N), reflecting no confidentiality or availability impact and a narrowly bounded modification-only effect; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation. The requirement for local logon plus human interaction from someone other than the attacker keeps realistic risk well below that of a network-facing service flaw.
Unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools 8.61-8.63 data is possible for a low-privileged attacker who already has local logon access to the infrastructure hosting PeopleTools and can interact with the Updates Environment Mgmt component under difficult-to-meet conditions. The issue is local-only, high-complexity, and confidentiality-only in impact (CVSS 2.5), and no public exploit has been identified at time of analysis. It is not listed in CISA KEV, so there is no confirmed active exploitation.
Unauthenticated read access to a subset of PeopleSoft Enterprise PeopleTools data is exposed through the Report Distribution component in versions 8.61 through 8.63, reachable over HTTP, but Oracle characterizes exploitation as difficult (AC:H) and scores the issue only 3.7. No user interaction is required per the CVSS vector, and the impact is confidentiality-only with no integrity or availability effect. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied.
Unauthorized read access to critical report data is possible in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Report Distribution component, which can be reached over HTTP without credentials. Exploitation is deliberately constrained: Oracle rates it 'difficult to exploit' (AC:H) and the attacker must persuade a legitimate user other than themselves to perform an action (UI:R), so a successful attack yields confidentiality loss only, with no integrity or availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor CVSS 3.1 base score of 5.3 reflects the combination of high impact on confidentiality with substantial exploitation barriers.
Integrity manipulation in Oracle Solaris 11.4's Image Packaging System (IPS) requires a network attacker to influence TLS-delivered package content and a separate user to perform a packaging action that processes it. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, score 3.1) limits impact to unauthorized update, insert, or delete access to some Solaris-accessible data, with no confidentiality or availability effect. No public exploit identified at time of analysis, and the supplied data does not confirm active exploitation.
Low-privileged local users can crash Oracle Solaris 11.4 through a flaw in the Filesystems component, causing a hang or repeatable complete denial of service. The issue requires a valid local logon (CVSS 5.5, AV:L/PR:L) and affects availability only, with no confidentiality or integrity impact; no public exploit code or confirmed active exploitation was identified at time of analysis. It is a routine-patching priority rather than an emergency remote threat.
Unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools data (versions 8.61 through 8.63, Report Distribution component) is possible when a high-privileged, authenticated attacker sends crafted HTTP requests; CVSS 3.1 score 2.7 reflects confidentiality-only impact. Exploitation requires an existing privileged PeopleTools account, sharply limiting exposure, and no public exploit code or confirmed active exploitation was identified at time of analysis.
A local availability flaw in the Filesystems component of Oracle Solaris 11.4 lets a low-privileged user who already holds a logon on the host hang or repeatedly crash the operating system, producing a complete denial of service. The CVSS 3.1 score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so there is no remote vector, no user interaction, and no confidentiality or integrity impact - the only meaningful precondition is existing local account access, which confines practical exposure to insider, shared-host, and post-compromise scenarios. There is no public exploit identified at time of analysis and no evidence of active exploitation, so this is a routine patch-cycle item rather than an emergency: moderate risk, availability only, gated behind local credentials.
Unauthenticated data exposure in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a network-positioned attacker read critical application data over HTTP, with the scope flag indicating that exposed data may extend into other PeopleSoft products built on the same platform. The 6.8 CVSS 3.1 score (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) is driven by a high attack-complexity metric - Oracle describes the flaw as difficult to exploit, so success depends on server state, timing, or other conditions the attacker does not fully control rather than a single crafted request - and there is no integrity or availability impact. No public exploit identified at time of analysis, the issue is not on CISA KEV, and no EPSS score was supplied; practical risk concentrates on internet-reachable PeopleTools deployments rather than a broad mass-exploitation threat.
Information disclosure in Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 allows an authenticated low-privileged user with HTTP access to the nVision component to read data beyond their intended privileges, up to all PeopleTools-accessible data. The flaw is rated CVSS 6.5 with confidentiality-only impact and requires a valid account, so it is not exploitable pre-authentication. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and the primary remediation is Oracle's October 2026 Critical Patch Update.
Unauthenticated disclosure of critical Oracle Applications Framework data in Oracle E-Business Suite 12.2.3 through 12.2.15 lets a network-positioned attacker reach OAF HTTP endpoints and read data the victim user is authorized to see, but only after that user is induced into a human interaction such as following an attacker-supplied link. The CVSS 3.1 score of 6.5 reflects confidentiality-only impact (C:H/I:N/A:N) with no integrity or availability effect, and no public exploit code has been identified at time of analysis. Real-world risk sits below the headline score because the mandatory UI:R step blocks automated or wormable exploitation and the attacker must be able to reach the OAF interface while a legitimate user can be persuaded to interact.
Oracle Siebel CRM Integration 25.12 through 26.9 is exposed through its Open Integration component to unauthenticated, HTTP-based attacks that succeed only when a legitimate user interacts with attacker-supplied content. A successful attack gives limited read access plus unauthorized insert, update, or delete capability within the integration scope, and the scope change means other products can be affected. At CVSS 3.1 base 6.1, the required user interaction is the main barrier to automated exploitation, and no public exploit was identified at the time of analysis.
Critical project data exposure and limited data tampering in Primavera P6 Enterprise Project Portfolio Management Web Access can occur when a low-privileged authenticated user persuades another user to interact with crafted HTTP content. Affected releases span 21.12.0.0 through 25.12.8, and the CVSS scope change means a successful attack may also affect connected Oracle products. Exploitation is rated difficult, requires valid credentials and a second human victim; no public exploit identified at time of analysis, and there is no CISA KEV entry.
Oracle Java SE (Libraries component) can be induced to improperly allow modification of critical or otherwise protected data, giving an attacker an integrity-only impact across JDK 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, plus Oracle GraalVM for JDK 17.0.20.1 / 21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1. Although the CVSS vector shows PR:N (no privileges required), exploitation is heavily constrained: the attacker must already have local logon access to the host running Java (AV:L), the attack is difficult to reproduce (AC:H), and it requires a user other than the attacker to interact with the malicious content (UI:R), yielding a 4.7 base score with no confidentiality or availability impact. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; real exposure is largely limited to deployments that execute untrusted code through Java APIs (for example a web service feeding data into the Libraries APIs) or legacy sandbox-dependent Java Web Start / applet scenarios. The third-party 'Authentication Bypass' tag should be treated with caution - the assessed vector describes a local, human-triggered integrity bug, not a remote authentication bypass.
Partial confidentiality and integrity compromise in Oracle Java SE (8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27) and the corresponding Oracle GraalVM for JDK and GraalVM Enterprise Edition releases arises from weaknesses in the Serviceability component's APIs, which an unauthenticated, network-reachable attacker can reach by supplying crafted data through a web service or another supported protocol. Oracle rates the issue as difficult to exploit due to high attack complexity, and the impact is bounded to unauthorized read of a subset of data plus unauthorized update, insert, or delete access to some data, with no effect on availability. No public exploit code and no CISA KEV listing were identified at time of analysis, and despite the ubiquity of the Java platform this scores only 4.8 - a genuinely moderate-severity, low-priority issue that still merits routine patch-cycle handling.
Partial denial of service in Oracle Java SE and Oracle GraalVM JDK occurs when the JSSE component processes attacker-supplied TLS data reachable over the network. Affected releases include Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1 and 25.0.4.1, plus GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1. Unauthenticated remote attackers can cause only a partial availability impact (CVSS 5.3, A:L); no public exploit was identified at time of analysis.
Local users holding a valid low-privileged login on the infrastructure hosting Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.9) can read a limited subset of application data they should not be entitled to see. The flaw is confined to a local attack vector with required authentication (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 3.3), so it offers no network or unauthenticated path and cannot modify data or disrupt service. There is no public exploit identified at time of analysis and no KEV listing, making this a genuinely low-priority issue whose realistic exposure is limited to insiders or attackers who already hold a foothold on the host. Note that the feed-supplied 'Authentication Bypass' tag is not supported by the assessed vector, which explicitly requires credentials.
Unauthenticated network attackers can read a limited subset of Oracle Siebel CRM Cloud Applications data through the Siebel Cloud Manager component in versions 22.3 through 26.9. Oracle rates this CVSS 3.1 5.8 (Medium) with AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, reflecting a low-complexity HTTP attack that requires no credentials or user interaction and can affect resources beyond the vulnerable component while only exposing confidentiality. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated information disclosure in Oracle Siebel CRM Cloud Applications 22.3 through 26.9 allows network attackers to read a limited subset of data through the Siebel Cloud Manager component over HTTP. Oracle rates the flaw as easily exploitable with CVSS 5.3 and confidentiality-only impact; no public exploit identified at time of analysis, and no CISA KEV status was supplied.
Integrity compromise in Oracle Siebel CRM Cloud Applications 22.3 through 26.9 lets an authenticated low-privileged attacker with HTTP network access to the Siebel Cloud Manager component create, delete, or modify critical data. Oracle rates this CVSS 5.3 and describes it as difficult to exploit because of high attack complexity, and the supplied intelligence shows no public exploit identified at time of analysis and no CISA KEV entry. User interaction is not required, but confidentiality and availability are unaffected, making this a moderate-severity, moderate-priority issue rather than an urgent one.
Local high-privileged attackers can read critical data from Siebel CRM Cloud Applications 22.3 through 26.9 by exploiting a flaw in the Siebel Cloud Manager component. The issue is rated CVSS 4.1 with a local, high-complexity, high-privilege vector (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N), so it is not remotely exploitable and requires an attacker who already has logon access to the infrastructure hosting the product. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided.
Local low-privileged users with logon access to a Siebel CRM Cloud Applications host can read critical application data beyond their intended scope through a flaw in the Siebel Cloud Manager component, affecting supported versions 22.3 through 26.9. The CVSS 3.1 score is 6.5 (Medium) with AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, meaning exploitation requires authenticated local access, needs no user interaction, changes scope, and impacts confidentiality only. No public exploit code or CISA KEV entry was identified at time of analysis.
Adjacent-network attackers with presence on the physical communication segment of the hardware hosting Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.9) can achieve limited unauthorized read access and update/insert/delete access to application data. Oracle's October 2026 CPU rates this 4.7 with a scope change (S:C), meaning downstream products may also be affected, but the attack is explicitly difficult to exploit (AC:H) and requires adjacent-segment positioning - not internet reachability - so no public exploit is identified at time of analysis and the CVE is not in CISA KEV. The practical risk is confined to insiders, compromised adjacent hosts, or parties with data-center/VLAN presence.
Attackers positioned on the physical or adjacent communication segment serving Siebel Cloud Manager can bypass authentication and reach critical data held in Oracle Siebel CRM Cloud Applications 22.3 through 26.9. No credentials and no user interaction are needed (PR:N/UI:N), but the vendor rates the attack as difficult (AC:H) and confines it to AV:A, so it is not reachable over the open internet and the impact is scored at 5.9 with high confidentiality and low integrity consequences. No public exploit code was identified and the issue is not listed on CISA KEV at the time of analysis, making mass or remote exploitation impractical.
Siebel Cloud Manager, the cloud provisioning and management component of Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9, exposes critical data to unauthenticated attackers who can reach the deployment over an adjacent network segment. Successful exploitation yields full confidentiality and integrity impact - unauthorized creation, deletion, modification, and disclosure of all data accessible to the Siebel CRM Cloud Applications instance - though the CVSS 3.1 score of 6.8 reflects a deliberately high attack complexity and an AV:A adjacency requirement that rules out internet-based exploitation. No public exploit code has been identified at time of analysis and the issue does not appear on CISA KEV, so the realistic threat is confined to attackers who already hold a foothold on the underlying physical or layer-2 communication segment.
Siebel Cloud Manager, the management component of Oracle Siebel CRM Cloud Applications versions 22.3 through 26.9, can be reached over HTTP by an unauthenticated attacker and, under difficult-to-satisfy conditions, disclose a limited subset of application data. The CVSS 3.1 score is 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), with no integrity or availability impact and no public exploit code or CISA KEV confirmation identified at time of analysis. Because exploitation depends on conditions outside the attacker's control and only read access is exposed, signals converge on low real-world priority despite network reachability; Oracle's October 2026 CPU advisory is the reference for fixes.
Unauthenticated HTTP requests to the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.9) can return a limited subset of application data to any attacker who can reach that interface, producing a confidentiality-only impact rated CVSS 3.1 base 5.3. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) requires no credentials, no user interaction, and no special configuration, so real-world exposure is governed almost entirely by whether Cloud Manager is network-reachable rather than by privilege level. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update advisory.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications 22.3 through 26.9 can be reached over HTTP by unauthenticated remote attackers and abused to update, insert, or delete selected data. The CVSS 3.1 score is 5.3 with integrity-only impact, no confidentiality or availability effect, and no user interaction required. No public exploit was identified at time of analysis.
Oracle Siebel CRM Cloud Applications 22.3 through 26.9 can expose sensitive tenant data, potentially all data accessible to that tenant, to an authenticated low-privilege user through the Siebel Cloud Manager component. The issue is remotely reachable over HTTP with low attack complexity and no user interaction, and impact is confidentiality-only (CVSS 3.1 base 6.5; PR:L). No public exploit identified at time of analysis.
Unauthenticated HTTP access to the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications 22.3 through 26.9 can expose a limited subset of application data. The flaw is rated CVSS 3.1 5.3 with low confidentiality impact and no integrity or availability impact, and exploitation requires only network reachability to the affected component. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Confidentiality exposure in Oracle E-Business Suite Order Management (Transaction Entry component) affecting releases 12.2.3 through 12.2.15 lets a low-privileged, HTTP-reachable user read critical order and transaction data they should not be able to see. The CVSS 3.1 base score is 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N): a valid EBS account is required, no user interaction is needed, and Oracle itself describes the flaw as 'difficult to exploit,' so reliability is constrained by conditions outside the attacker's control. There is no integrity or availability impact, and no public exploit code exists - no public exploit identified at time of analysis - so risk is primarily relevant to environments with large populations of low-privileged EBS users or broad HTTP exposure of the Order Management tier.
Unauthorized data modification, limited data disclosure and partial denial of service in Oracle PeopleSoft Enterprise HCM Global Payroll Switzerland 9.2 require an attacker who already holds high-privileged logon access to the infrastructure where the component executes. The CVSS 3.1 score of 4.2 (AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) reflects a local-only attack path with no user interaction and no unauthenticated or remote vector, so the realistic threat actor is a malicious insider or someone who has already achieved privileged compromise on the application or process-scheduler host. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, which keeps operational priority low.
Partial denial of service in Oracle Outside In Technology 8.5.8 (Outside In Clean Content SDK) allows unauthenticated remote attackers to degrade content parsing and conversion availability by supplying crafted input over HTTP. The CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), with no confidentiality or integrity impact, and no public exploit code or CISA KEV entry was identified at time of analysis. Because Outside In is an embedded SDK, actual exposure depends on whether a host application routes untrusted files or data into the Clean Content parser and exposes that path over HTTP.
Local, authenticated low-privileged users on hosts running Oracle Outside In Technology 8.5.8 can abuse the Outside In Clean Content SDK to corrupt or delete critical data and trigger a partial denial of service, with no confidentiality impact. The CVSS 3.1 score is 6.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L), so exposure is limited to environments where an attacker can both log on locally and get crafted content processed by the SDK. No public exploit code or confirmed active exploitation was identified at time of analysis.
Information disclosure in Oracle iSupport, the customer self-service module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), lets a low-privilege account holder read data well beyond their intended scope - up to and including all data the iSupport Service Requests component can reach - over plain HTTP. Oracle's October 2026 Critical Patch Update credits the flaw with a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction and no special conditions beyond a valid self-service login; there is no integrity or availability impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so the practical risk scales with how many low-privilege iSupport accounts exist and whether the portal is internet-facing - this is a moderate, authenticated data-exposure issue rather than an unauthenticated emergency.
Local integrity compromise in Oracle Solaris 11.4's Utility component allows a low-privileged user with an existing logon to create, delete, or modify critical data, with scope change potentially affecting additional products. Oracle rates this CVSS 3.1 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N); no public exploit code or CISA KEV confirmation was identified in the available intelligence. The flaw is not remotely exploitable and requires authenticated local access, narrowing realistic risk to insiders or attackers who already have a foothold.
Unauthorized read access in Oracle Java SE's AWT component affects client-side sandboxed Java deployments that execute untrusted code, and it requires victim interaction plus high attack complexity to succeed. Affected releases include Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, as well as GraalVM for JDK 17.0.20.1 and 21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1; this is a low-priority, low-severity issue despite the network vector, and no public exploit was identified at time of analysis. Real-world exposure is narrow because the Java applet and Web Start sandbox model is deprecated and rarely enabled, and server deployments running only trusted administrator-installed code are explicitly outside the vulnerability's scope.
ImageIO in Oracle Java SE (including 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27) and related GraalVM releases can expose a limited subset of process-accessible data when attacker-controlled image content is decoded through the affected component. The CVSS vector describes a network-reachable, unauthenticated issue (PR:N) but with high attack complexity and only low confidentiality impact; there is no integrity or availability effect. No public exploit was identified at time of analysis, and practical risk is concentrated in services or sandboxed Java deployments that actually pass untrusted images to ImageIO.
Oracle Java SE 21.0.12.1, 25.0.4.1, and 27 contain an integrity-only flaw in the Security component that remote attackers can reach through multiple protocols, potentially causing limited unauthorized update, insert, or delete access to some accessible data. Exploitation is difficult because high attack complexity requires conditions outside the attacker's control, and successful attacks do not affect confidentiality or availability. No public exploit code or CISA KEV entry was identified at time of analysis, making this a low-severity issue despite the ubiquitous product.
Remote attackers can cause limited unauthorized integrity modification of data accessible to Oracle Java SE’s Networking component in specific update releases (8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, plus listed GraalVM builds). Exploitation is unauthenticated (PR:N), requires no user interaction, and depends on attacker-controlled data reaching the Networking APIs-typically through an application web service-or on sandboxed Java Web Start or applet code running untrusted input; no public exploit identified at time of analysis.
PeopleSoft Enterprise CC Common Application Objects 9.2 exposes low-complexity HTTP functionality that lets an attacker who already holds a high-privileged account read and modify a limited subset of application data. Oracle's October 2026 CPU rates this CVSS 3.1 3.8 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N); no public exploit identified at time of analysis and no CISA KEV confirmation. Realistic exposure is therefore malicious or compromised privileged insiders rather than unauthenticated remote attackers.
Partial denial of service in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affects versions 9.2.0.0 through 9.2.26.5 and requires an attacker who already holds a low-privileged logon on the infrastructure where the product executes. Successful exploitation degrades availability only - confidentiality and integrity are unaffected - and because the vector is local (AV:L) with low attack complexity (AC:L) and no user interaction (UI:N), the CVSS 3.1 base score stays at 3.3. No public exploit identified at time of analysis, there is no CISA KEV entry, and no EPSS score was supplied; the Oracle October 2026 Critical Patch Update provides the fix.
Local attackers who already hold an interactive logon on a JD Edwards EnterpriseOne Tools host can leverage a separate privileged user's installation or security-configuration action to gain unauthorized modification of critical data, limited read access, and denial of service in versions 9.2.0.0 through 9.2.26.5 (CVSS 6.5). Exploitation is constrained by high attack complexity, the need for a second human actor, and local access; no public exploit identified at time of analysis.
Oracle Solaris 11.4 contains a denial-of-service flaw in its Libraries component that lets an attacker with local logon access hang or repeatedly crash the operating system, with no confidentiality or integrity impact. Exploitation is difficult: the CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R) requires local access, conditions outside the attacker's control, and a separate legitimate user or operator to perform a triggering action. No public exploit code or confirmed active exploitation was identified at time of analysis, and the 4.7 MEDIUM base score appropriately reflects a low-to-moderate priority issue.
Unauthorized read access to a subset of data accessible to Oracle JDeveloper is possible for authenticated low-privileged attackers who already have interactive logon to the host running affected versions 12.2.1.4.0 or 14.1.2.0.0. The vector is strictly local (AV:L, PR:L, UI:N) with confidentiality-only impact (C:L) and no integrity or availability effect, so there is no remote or unauthenticated path. No public exploit identified at time of analysis, and the issue is low priority given the mandatory local access and valid credentials.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 allows a high-privileged local attacker who can log on to the host to modify or delete critical data and cause a hang or repeatable crash, while confidentiality is not impacted. Exploitation is assessed as difficult (AC:H) and requires prior high-privileged logon access to the infrastructure where JDeveloper executes; no public exploit identified at time of analysis.
Data modification in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical or all JDeveloper-accessible data through the Java Business Objects component over HTTP, but Oracle and the CVSS vector classify exploitation as difficult because of high attack complexity and preconditions outside attacker control. The flaw is integrity-only (CVSS 3.1 base 5.9; C:N/I:H/A:N) with no confidentiality or availability impact, and no public exploit code has been identified at time of analysis. Realistic exposure is limited because JDeveloper is a developer tool that is not typically internet-exposed in production.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 expose confidentiality-sensitive data through a flaw in the product's Security Framework, reachable over HTTP by an unauthenticated attacker (CVSS 3.1 base score 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). The attacker must persuade a JDeveloper user - a person other than the attacker - to interact with attacker-controlled content, which is the single factor that keeps the flaw from being trivially remote-exploitable. Successful exploitation yields unauthorized access to critical data or complete access to all data the JDeveloper instance can reach, with no integrity or availability impact; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 expose an ADF Databinding flaw that lets a low-privileged authenticated user reach critical data over the network via SOAP, with a secondary ability to cause a partial denial of service. Oracle rates the issue 'difficult to exploit' (AC:H), so success hinges on configuration or environmental conditions rather than a straightforward single request; integrity is unaffected, and the realistic risk is confidential-data disclosure by an insider or a compromised low-privilege account. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, making this a moderate, lower-priority item for patch planning.
Local, authenticated low-privileged users on a JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 host can exploit the Installation Security component to bypass controls and gain unauthorized read access to critical data, with scope change potentially exposing co-located products. The issue requires prior logon to the infrastructure (AV:L/PR:L) and has no integrity or availability impact, making it a moderate insider-risk concern rather than a remote emergency. No public exploit was identified at time of analysis, and no KEV or EPSS data was supplied.
Unauthorized read access to critical data in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) is possible for unauthenticated remote attackers through the Interoperability SEC component's HTTPS interface. Oracle characterizes the flaw as difficult to exploit (AC:H) and limits impact to confidentiality only, for a CVSS 3.1 base score of 5.9. No public exploit identified at time of analysis, and no CISA KEV activity is associated with this CVE.
Local user-assisted denial of service in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 allows an unauthenticated-at-the-application-layer attacker who already holds a local logon on the hosting infrastructure to degrade availability, but only if another legitimate user performs an interaction. The CVSS 3.1 score is 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), with no confidentiality or integrity impact; no public exploit code was identified at time of analysis, and Oracle's October 2026 Critical Patch Update is the vendor remediation reference.
Low-privileged users who can log on interactively to a host running Oracle JD Edwards EnterpriseOne Tools can abuse the Monitoring and Diagnostics SEC component to modify or delete some restricted EnterpriseOne data and to degrade service availability. Only Tools releases 9.2.0.0 through 9.2.26.5 are affected, and the CVSS 3.1 base score is 3.6 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L), reflecting a local, high-complexity path that yields limited integrity and availability impact with no confidentiality exposure. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires an attacker to already hold a valid low-privileged account with logon access to the EnterpriseOne infrastructure, so the realistic threat is insider misuse or post-compromise lateral activity rather than remote attack. All available signals point to a low-priority issue best handled through routine quarterly patch cycles.
Low-severity integrity tampering in Oracle JD Edwards EnterpriseOne Tools (Web Runtime SEC component) affects versions 9.2.0.0 through 9.2.26.5. An unauthenticated remote attacker can exploit this difficult-to-exploit flaw only if a victim is tricked into interacting with malicious content, resulting in unauthorized update, insert, or delete access to a subset of accessible data. No public exploit code or active exploitation has been identified; the CVSS 3.1 base score is 3.1.
Stored/reflected cross-site scripting in the Web Runtime SEC component of JD Edwards EnterpriseOne Tools (9.2.0.0 through 9.2.26.5) lets a low-privileged authenticated attacker inject content that executes when a different user loads the affected page, producing limited confidentiality and integrity impact and a scope change beyond the vulnerable component. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); exploitation requires both a valid low-privileged account and victim interaction, so unattended mass exploitation is unlikely. No public exploit identified at time of analysis.
Unauthorized data modification and limited data disclosure in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can be triggered by an unauthenticated network attacker who convinces a victim to interact with a crafted HTTP request; the pattern is consistent with a cross-site-scripting-class issue in the Monitoring and Diagnostics SEC component. Successful exploitation can update, insert, or delete some accessible data and read a subset, with a scope change that may affect additional products, but no public exploit was identified at time of analysis and it is not confirmed actively exploited. This is a moderate-severity issue (CVSS 3.1 base 6.1) whose primary limiting factor is the required victim interaction.
A low-privileged authenticated user with network reachability to the JDENET service can degrade availability of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5, producing a partial denial of service against the affected component (Business Logic Infra SEC). The issue scores CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), so there is no confidentiality or integrity impact and no privilege escalation - only a limited availability effect against the tooling itself. There is no public exploit identified at time of analysis and no CISA KEV listing; this is a genuine but low-priority issue that requires prior authentication and is best handled through the scheduled Oracle Critical Patch Update cycle.
Authenticated low-privileged users of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can read a limited subset of application data and partially degrade service availability by sending crafted requests to the JDENET business-logic infrastructure component. The weakness is trivially reachable over the network once a valid low-privilege EnterpriseOne account exists, but its blast radius is bounded: confidentiality and availability impacts are both rated Low and there is no integrity impact, giving a CVSS 3.1 base score of 5.4. No public exploit code or confirmed active exploitation was identified at time of analysis, and no CISA KEV listing exists for this CVE.
Authenticated low-privileged attackers can read a limited subset of data and cause a partial denial of service in Oracle JD Edwards EnterpriseOne Localizations 9.2 through the JDENET protocol. Oracle rates it CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L), so exploitation requires valid low-privilege credentials and network reachability to the JDENET listener; impact is confined to confidentiality and availability, with no integrity effect. No public exploit was identified at time of analysis.
Low-privileged users who already hold interactive logon to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can, under narrowly specific conditions, read and modify a limited subset of the application's data through the Business Logic Infra SEC component. Impact is confined to partial confidentiality and integrity loss (CVSS 3.1 base 3.6, AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) with no availability effect, and exploitation is neither remote nor unauthenticated. No public exploit code or confirmed active exploitation was identified at time of analysis, and the overall risk picture is genuinely low priority.
Local, authenticated low-privileged access to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can be abused through the Web Runtime SEC component to disclose critical or all accessible application data (CVSS 3.1 score 5.5, confidentiality-only). The attacker must already have a valid low-privileged account with logon access to the infrastructure, so there is no unauthenticated network path and no integrity or availability impact; no public exploit code was identified at time of analysis.
Unauthenticated attackers positioned on the same physical or adjacent network segment as a JD Edwards EnterpriseOne Tools host can obtain critical data from the Monitoring and Diagnostics SEC component in versions 9.2.0.0 through 9.2.26.5, with impact limited to confidentiality. Exploitation is rated difficult - success depends on conditions outside the attacker's direct control and requires local segment presence rather than a routed or internet path - and no public exploit code has been identified at time of analysis; the CVSS 3.1 base score is 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Unauthorized disclosure of critical JD Edwards EnterpriseOne Orchestrator data is possible in versions 9.2.0.0 through 9.2.26.5 when a low-privilege authenticated attacker can reach the Orchestrator over HTTP. The flaw is rated CVSS 6.5 with confidentiality-only impact; integrity and availability are unaffected, and no user interaction is needed. No public exploit code or CISA KEV confirmation was present in the supplied intelligence, so risk is moderate and contingent on prior valid Orchestrator access.
Authenticated low-privileged attackers with network reachability to the JDENET service can crash or repeatedly hang Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 (E1 Dev Platform Tech on UNIX), producing a complete denial of service. The CVSS 3.1 score is 6.5, with impact confined to availability (A:H) and no confidentiality or integrity effect; exploitation requires valid low-privileged credentials (PR:L) and no user interaction (UI:N). No public exploit code identified at time of analysis, and the CVE is not reported in CISA KEV; EPSS was not supplied.
Unauthenticated HTTP traffic against Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can leak a limited subset of application data through the Web Runtime SEC component, but only if a victim is first persuaded to interact with attacker-controlled content (UI:R), so there is no self-contained server-side exploitation path. CVSS 3.1 scores it 4.3 with confidentiality-only impact (C:L) and no effect on integrity or availability. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and it is rated a genuinely low-priority issue despite the network-reachable, unauthenticated vector. Oracle addresses it in the October 2026 Critical Patch Update.
Unauthenticated attackers with HTTP network access to the Portal security (Portal SEC) component of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 may be able to read critical data, including potentially all data accessible through the Portal, via an authentication-bypass weakness. The CVSS 3.1 score of 5.9 reflects confidentiality-only impact (C:H/I:N/A:N) tempered by high attack complexity (AC:H), meaning exploitation depends on conditions outside the attacker's control such as specific configuration or environmental state, so the flaw is difficult rather than trivial to exploit reliably. No public exploit code and no CISA KEV confirmed active exploitation were identified at time of analysis.
Unauthenticated, user-assisted attacks against the JD Edwards EnterpriseOne Tools web interface (supported versions 9.2.0.0 through 9.2.26.5) let a remote attacker lure a victim into interacting with attacker-supplied HTTP content, yielding low-impact read and write access to a subset of application data, with scope change extending the impact to additional connected products. Oracle scores this 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) - the UI:R requirement for a tricked human victim is the main limiting factor, so it cannot be triggered automatically. No public exploit code and no CISA KEV entry are identified at time of analysis, and no EPSS data was supplied; treat this as a schedule-the-patch item rather than an emergency.
A cross-site scripting-style injection flaw in the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) can be triggered over HTTP by an unauthenticated remote attacker, but only succeeds if a victim other than the attacker interacts with attacker-supplied content (UI:R). CVSS 3.1 scores it 6.1 with scope change, low confidentiality and low integrity impact on the affected and possibly additional products, and no availability impact; the practical delivery vehicle is a targeted JD Edwards user session rather than mass-automated scanning. Exploitation requires social engineering of a legitimate user's browser, there is no confirmed active exploitation (not in CISA KEV), and no public exploit code was identified at time of analysis.
Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 contain a flaw in the Web Runtime SEC component that allows an unauthenticated, network-positioned attacker to deliver HTTP content which a legitimate logged-in user must be lured into interacting with, yielding partial read plus unauthorized insert/update/delete against that user's accessible data (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The scope change (S:C) means the impact can extend beyond EnterpriseOne Tools into other products that share the victim's browser session and trust context, but confidentiality and integrity effects are each rated Low and there is no availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, and a vendor fix is published in Oracle's October 2026 Critical Patch Update.
Low-privileged local users can read critical data from JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 via the Monitoring and Diagnostics SEC component, according to the Oracle October 2026 CPU. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires an existing interactive logon on the host running the affected Tools, so this is not a remote or unauthenticated authentication bypass despite the supplied 'Authentication Bypass' tag. No public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
Unauthenticated information disclosure in Oracle JD Edwards EnterpriseOne Orchestrator (supported releases 9.2.0.0 through 9.2.26.5) lets any party able to reach the Orchestrator over HTTP read a subset of Orchestrator-accessible data without credentials, privileges, or user interaction (CVSS 3.1 base 5.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The flaw sits in the E1 IOT Orchestrator Security component and is best characterized as an access-control/authentication bypass that yields confidentiality-only impact - no integrity or availability effect - so the practical exposure is bounded to whatever data the reachable endpoint returns. Exploitation requires only network reachability, making risk dominated by whether the Orchestrator tier is internet-exposed or reachable from untrusted segments; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation. Oracle addresses the issue in its October 2026 Critical Patch Update.
Unauthenticated information disclosure in Oracle JD Edwards EnterpriseOne Orchestrator (E1 IOT Orchestrator Security) affects releases 9.2.0.0 through 9.2.26.5, allowing a network attacker to read critical data or effectively all Orchestrator-accessible data. Oracle scores it 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N): no attacker credentials are required, but the attack is rated difficult and depends on a legitimate user other than the attacker being induced to perform an action, and there is no integrity or availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and the high attack complexity plus mandatory victim interaction substantially limit real-world exploitability for what is otherwise a confidentiality-only flaw.
High-privileged SQL access to the Monitoring and Diagnostics SEC component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) can yield unauthorized read of critical data and limited insert/update/delete capability, with a scope change that lets the impact propagate to additional connected products. Exploitation is explicitly rated difficult (AC:H) and is gated behind an attacker who already holds high privileges (PR:H) plus network reachability; no user interaction is required (UI:N). The CVSS 3.1 base score is 6.6, and no public exploit identified at time of analysis. Risk is therefore concentrated in environments where administrative or otherwise highly privileged JD Edwards accounts are shared, weakly controlled, or exposed to untrusted networks.
Unauthenticated network attackers can access or modify data in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 through the Monitoring and Diagnostics SEC component, although high attack complexity makes reliable exploitation difficult. The issue is reachable over HTTP and carries a CVSS 3.1 score of 6.5 with high confidentiality and low integrity impact; no public exploit identified at time of analysis and no CISA KEV entry is present in the provided data.
Unauthenticated network attackers can make limited unauthorized data changes in Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 through an HTTP-reachable security flaw, but exploitation is difficult because it depends on high-complexity conditions outside the attacker's control. The impact is integrity-only, with no confidentiality or availability effect, and no public exploit was identified at time of analysis. Oracle's October 2026 Critical Patch Update advisory is the reference for fixes, and exposure is lower where the SCM Manufacturing HTTP interface is not reachable from untrusted networks.
Low-privileged authenticated users of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Notification Configuration component over HTTP to read a limited subset of application data and to update, insert, or delete some of it, with a scope change that can extend impact to integrated PeopleSoft products. Oracle scores this 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N): a valid account is mandatory, no victim interaction is required, and there is no availability impact, but the high attack complexity means success hinges on conditions outside the attacker's control, making this a moderate rather than high-urgency issue. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Oracle WebCenter Content 14.1.2.0.0 (Content Server component) exposes an HTTP-reachable path that lets an unauthenticated remote attacker cause limited unauthorized reads and writes of Content Server data - but only if a human victim is lured into performing an interaction (CVSS 3.1 5.4, AV:N/AC:L/PR:N/UI:R/C:L/I:L/A:N). The mandatory user-interaction prerequisite and the bounded confidentiality/integrity impact (no availability effect) keep this a moderate-priority item rather than an emergency: without victim action the attack does not succeed, and the flaw cannot by itself disrupt service. No public exploit code or confirmed active exploitation was identified at time of analysis; Oracle addressed the issue through its Critical Patch Update referenced in the October 2026 security advisory.
Oracle WebCenter Content 14.1.2.0.0 (Content Server component of Oracle Fusion Middleware) allows a low-privileged authenticated user with network access over HTTP to read a limited subset of content the account should not be able to see, but only when a high-complexity condition is satisfied - Oracle itself classifies the issue as 'difficult to exploit.' The impact is confidentiality-only (CVSS 3.1 base score 3.1, AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), with no write, integrity, or availability effect, and exploitation requires a pre-existing valid account despite a third-party tag labeling it an authentication bypass. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the available intelligence at time of analysis, and this is a genuinely low-priority issue across nearly every risk signal.
Oracle E-Business Suite iSupport 12.2.3 through 12.2.15 allows an authenticated low-privileged user with HTTP access to the Service Requests component to read critical data and potentially all iSupport-accessible records, producing a confidentiality-only impact at CVSS 3.1 6.5. No public exploit was identified at time of analysis, and exposure is highest where the iSupport portal is internet-facing or broadly accessible to external or customer accounts.
Oracle Solaris 11.4 contains a local information-disclosure weakness in its Libraries component that allows an attacker with an existing low-privileged logon to read a limited subset of system-accessible data. The assessed CVSS vector is strictly local (AV:L), requires low privileges (PR:L), needs no user interaction, and has confidentiality-only impact (C:L), with no integrity or availability effect. The referenced vendor advisory is Oracle's October 2026 Critical Patch Update, and no public exploit code has been identified at time of analysis.
Information disclosure in Oracle WebCenter Portal (Runtime Tools component) allows unauthenticated, network-positioned attackers to read a subset of accessible data from versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 score is 5.3 with AV:N/AC:L/PR:N/UI:N, indicating low-complexity remote exploitation without credentials or user interaction, but impact is limited to confidentiality (C:L) with no integrity or availability effect. No public exploit code was identified at time of analysis, and exploitation requires the portal's HTTP interface to be reachable.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allow a remote, unauthenticated attacker to tamper with or delete critical portal data and to partially degrade service availability through a flaw in the Runtime Tools component reachable over HTTP. Exploitation is not straightforward: the CVSS vector (AC:H, UI:R) means preconditions outside the attacker's control must line up and a legitimate user other than the attacker must be induced to perform an action, which sharply limits opportunistic or automated mass exploitation, and there is no confidentiality impact. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS score supplied, so this is a moderate-severity (5.9) issue to schedule on a normal patch cycle rather than an emergency; Oracle's October 2026 Critical Patch Update advisory is the reference for remediation.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 are affected by a moderate-severity Runtime Tools flaw that lets remote unauthenticated attackers obtain partial read access and limited update/insert/delete capability against portal data, with potential scope change into integrated products. Exploitation requires a victim other than the attacker to interact with crafted content (UI:R), which limits unattended mass exploitation, and the CVSS 3.1 score is 6.1; no public exploit code was identified at time of analysis.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can disclose critical portal-accessible data to an unauthenticated, network-positioned attacker who convinces a separate user to interact with a crafted HTTP request against the Runtime Tools component. Rated CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), the flaw is purely a confidentiality problem - there is no integrity or availability impact - and the mandatory victim-interaction step is the main practical barrier to exploitation. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority issue that warrants timely patching rather than emergency response.
Local denial of service in Oracle Solaris 11.4 allows an authenticated low-privileged user with logon access to the host to cause a hang or frequently repeatable crash of the operating system by targeting the Services component. The issue is availability-only, requires local access and high attack complexity, and Oracle describes it as difficult to exploit; no public exploit code was identified at time of analysis. With a CVSS 3.1 base score of 4.7, it is most relevant to shared or multi-user Solaris systems exposed to untrusted local accounts.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain an unauthenticated HTTP-accessible flaw that can disclose critical or all application-accessible data. The vendor rates attack complexity as high (AC:H), meaning exploitation depends on conditions the attacker does not control and is not reliably repeatable, and impact is limited to confidentiality with no modification or denial of service. No public exploit code or confirmed active exploitation was identified at time of analysis.
Critical data exposure in Oracle WebCenter Content 14.1.2.0.0 requires a low-privileged authenticated attacker, network access via HTTP, and interaction by a separate user, and is rated difficult to exploit. Successful exploitation can give unauthorized read access to critical WebCenter Content data and limited update, insert, or delete access, with scope change potentially affecting additional Oracle products. No public exploit code was identified at time of analysis.
Local, low-privileged users on Oracle Solaris 11.4 can abuse the bundled X Window System component to gain limited unauthorized read and write access to data outside their own scope, plus a partial denial-of-service condition, provided they can convince a second, different user to interact with attacker-influenced X content. The attack surface is narrow: the vector is strictly local (AV:L) with high attack complexity (AC:H) and a required human-interaction step performed by a victim other than the attacker, yielding a CVSS 3.1 score of 4.2. No public exploit code was identified at time of analysis and the issue has not been added to CISA KEV, so practical risk is concentrated in multi-user Solaris hosts where untrusted local accounts coexist with interactive graphical sessions; single-user or tightly access-controlled deployments face negligible exposure.
Denial of service in Oracle Solaris 11.4's Services component can be triggered by an attacker who already holds an interactive local logon, causing a hang or frequently repeatable crash of the affected host. The CVSS 3.1 vector is AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, meaning exploitation is local rather than remote, does not require credentials beyond the local logon, needs no user interaction, and depends on specific runtime conditions that make reliable success difficult. No public exploit code or CISA KEV entry was identified at time of analysis, and impact is confined to availability on the single affected system.
A local low-privilege user on Oracle Solaris 11.4 can abuse a flaw in the X Window System component to read and modify a subset of system data and cause a partial denial of service. Exploitation requires an interactive logon to the affected host and is gated by high attack complexity, meaning success depends on winning a race or hitting a specific non-deterministic runtime state, and the impact stays capped at partial confidentiality, integrity, and availability loss with no privilege escalation. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score of 4.5 reflects the significant practical barriers to abuse.
Oracle Solaris 11.4 exposes a low-severity integrity flaw in its Services component: an attacker with local logon access and no additional privileges (PR:N) can, under high-complexity conditions and with the involvement of a second user, cause unauthorized update, insert, or delete operations against some Solaris-accessible data. The CVSS 3.1 score is 2.5 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N), reflecting no confidentiality or availability impact and a narrowly bounded modification-only effect; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation. The requirement for local logon plus human interaction from someone other than the attacker keeps realistic risk well below that of a network-facing service flaw.
Unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools 8.61-8.63 data is possible for a low-privileged attacker who already has local logon access to the infrastructure hosting PeopleTools and can interact with the Updates Environment Mgmt component under difficult-to-meet conditions. The issue is local-only, high-complexity, and confidentiality-only in impact (CVSS 2.5), and no public exploit has been identified at time of analysis. It is not listed in CISA KEV, so there is no confirmed active exploitation.
Unauthenticated read access to a subset of PeopleSoft Enterprise PeopleTools data is exposed through the Report Distribution component in versions 8.61 through 8.63, reachable over HTTP, but Oracle characterizes exploitation as difficult (AC:H) and scores the issue only 3.7. No user interaction is required per the CVSS vector, and the impact is confidentiality-only with no integrity or availability effect. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied.
Unauthorized read access to critical report data is possible in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Report Distribution component, which can be reached over HTTP without credentials. Exploitation is deliberately constrained: Oracle rates it 'difficult to exploit' (AC:H) and the attacker must persuade a legitimate user other than themselves to perform an action (UI:R), so a successful attack yields confidentiality loss only, with no integrity or availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor CVSS 3.1 base score of 5.3 reflects the combination of high impact on confidentiality with substantial exploitation barriers.
Integrity manipulation in Oracle Solaris 11.4's Image Packaging System (IPS) requires a network attacker to influence TLS-delivered package content and a separate user to perform a packaging action that processes it. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, score 3.1) limits impact to unauthorized update, insert, or delete access to some Solaris-accessible data, with no confidentiality or availability effect. No public exploit identified at time of analysis, and the supplied data does not confirm active exploitation.
Low-privileged local users can crash Oracle Solaris 11.4 through a flaw in the Filesystems component, causing a hang or repeatable complete denial of service. The issue requires a valid local logon (CVSS 5.5, AV:L/PR:L) and affects availability only, with no confidentiality or integrity impact; no public exploit code or confirmed active exploitation was identified at time of analysis. It is a routine-patching priority rather than an emergency remote threat.
Unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools data (versions 8.61 through 8.63, Report Distribution component) is possible when a high-privileged, authenticated attacker sends crafted HTTP requests; CVSS 3.1 score 2.7 reflects confidentiality-only impact. Exploitation requires an existing privileged PeopleTools account, sharply limiting exposure, and no public exploit code or confirmed active exploitation was identified at time of analysis.
A local availability flaw in the Filesystems component of Oracle Solaris 11.4 lets a low-privileged user who already holds a logon on the host hang or repeatedly crash the operating system, producing a complete denial of service. The CVSS 3.1 score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so there is no remote vector, no user interaction, and no confidentiality or integrity impact - the only meaningful precondition is existing local account access, which confines practical exposure to insider, shared-host, and post-compromise scenarios. There is no public exploit identified at time of analysis and no evidence of active exploitation, so this is a routine patch-cycle item rather than an emergency: moderate risk, availability only, gated behind local credentials.
Unauthenticated data exposure in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a network-positioned attacker read critical application data over HTTP, with the scope flag indicating that exposed data may extend into other PeopleSoft products built on the same platform. The 6.8 CVSS 3.1 score (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) is driven by a high attack-complexity metric - Oracle describes the flaw as difficult to exploit, so success depends on server state, timing, or other conditions the attacker does not fully control rather than a single crafted request - and there is no integrity or availability impact. No public exploit identified at time of analysis, the issue is not on CISA KEV, and no EPSS score was supplied; practical risk concentrates on internet-reachable PeopleTools deployments rather than a broad mass-exploitation threat.
Information disclosure in Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 allows an authenticated low-privileged user with HTTP access to the nVision component to read data beyond their intended privileges, up to all PeopleTools-accessible data. The flaw is rated CVSS 6.5 with confidentiality-only impact and requires a valid account, so it is not exploitable pre-authentication. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and the primary remediation is Oracle's October 2026 Critical Patch Update.
Unauthenticated disclosure of critical Oracle Applications Framework data in Oracle E-Business Suite 12.2.3 through 12.2.15 lets a network-positioned attacker reach OAF HTTP endpoints and read data the victim user is authorized to see, but only after that user is induced into a human interaction such as following an attacker-supplied link. The CVSS 3.1 score of 6.5 reflects confidentiality-only impact (C:H/I:N/A:N) with no integrity or availability effect, and no public exploit code has been identified at time of analysis. Real-world risk sits below the headline score because the mandatory UI:R step blocks automated or wormable exploitation and the attacker must be able to reach the OAF interface while a legitimate user can be persuaded to interact.