Oracle
Monthly
Unauthorized read access to a subset of PeopleSoft PeopleTools data is possible for low-privileged users who can log on locally to the infrastructure running the XML Publisher component in versions 8.61 through 8.63. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) requires an existing low-privileged credential and local access, with no integrity or availability impact. No public exploit identified at time of analysis, and KEV status is not indicated.
Oracle WebCenter Content 14.1.2.0.0 allows unauthenticated network attackers to access critical data and make limited unauthorized changes through HTTP if they can induce a victim to perform a crafted action. The CVSS 3.1 score is 6.9 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N), and no public exploit was identified at time of analysis. Mandatory user interaction and high attack complexity constrain reliable exploitation, but the scope change means connected products and trust relationships may also be affected.
Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows a low-privileged, HTTP-reachable attacker to create, delete, or modify critical repository data and read a limited subset of it, but only after a second, typically higher-privileged user is induced to interact with attacker-controlled content or a crafted request. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) makes valid credentials and victim interaction both mandatory, so the flaw is not anonymously reachable and is poorly suited to automated or wormable mass exploitation; integrity impact is high while confidentiality is limited and availability is unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, consistent with a moderate, not top-tier, priority rating.
Oracle Outside In Technology 8.5.8 (Outside In Core) can expose critical data to unauthenticated remote attackers who persuade a user to open, preview, or submit a crafted document for parsing; the assessed CVSS 3.1 score is 6.5 with confidentiality-only impact and mandatory user interaction. No public exploit code or CISA KEV entry is identified in the provided data, and EPSS is not supplied; this is a moderate-priority data-disclosure issue that depends on the malicious file reaching an application that invokes Outside In parsing.
Denial of service in Oracle Outside In Technology 8.5.8 (Outside In Core) lets unauthenticated remote attackers hang or repeatedly crash applications that parse attacker-supplied documents, with the CVSS 3.1 score of 6.5 reflecting an availability-only impact. The vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) requires network reachability plus human interaction from someone other than the attacker - typically a user opening, previewing, or uploading a crafted file into a service built on the Outside In SDK. No public exploit code exists and there is no CISA KEV listing at time of analysis, so the realistic exposure is confined to environments that embed Outside In Core in an internet-facing or multi-tenant document-processing path. Patch availability is indicated only through the Oracle Critical Patch Update advisory; no exact fixed version is stated in the available data.
Authenticated integrity compromise of Oracle WebCenter Content: Imaging 14.1.2.0.0 is achievable over the network through the product's SOAP web-service interface, where a low-privileged account can create, delete, or modify critical Imaging data without any user interaction. Confidentiality and availability are untouched - the entire CVSS 3.1 base score of 6.5 derives from a High integrity impact with PR:L, AC:L, and AV:N, meaning the only real barrier is holding valid low-tier credentials. There is no CISA KEV listing and no public exploit identified at time of analysis, so risk is concentrated in environments where the Imaging SOAP endpoint is broadly reachable by multi-tenant or delegated users rather than in mass internet-wide scanning.
WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0 can disclose critical data to a high-privileged attacker who already has logon access to the hosting infrastructure and can induce a different user to interact with the attack. Oracle rates this local, scope-changing flaw CVSS 5.5 with confidentiality-only impact; no public exploit was identified at time of analysis. Intelligence feeds tag it as an authentication bypass, but the authoritative vector requires high privileges and user interaction, so it is not a remote unauthenticated path.
Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 expose the Content Server component to an unauthenticated HTTP-reachable attack that only succeeds after a non-attacker user interacts with attacker-supplied content or a crafted link, after which the attacker can make limited unauthorized updates, inserts or deletions to accessible data and partially degrade availability. Integrity and availability impacts are both rated Low with no confidentiality exposure, yielding a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L); the user-interaction requirement means exploitation is not fully automatable, and no public exploit code was identified at time of analysis. Oracle addressed the issue in its October 2026 Critical Patch Update.
Unauthorized modification of HR data in Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 is possible for unauthenticated remote attackers over HTTP, but only under high-complexity conditions and with limited integrity impact (CVSS 3.1 base score 3.7). The vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) shows no confidentiality or availability loss, and no public exploit code or confirmed active exploitation was identified at time of analysis. Practical risk is genuinely low-priority, particularly because JD Edwards HR deployments are usually segmented from the public internet.
Integrity-only data tampering in Oracle JD Edwards EnterpriseOne Configurator 9.2 lets a low-privileged, authenticated attacker reach the Configuration Management component over HTTP and create, delete, or modify critical configuration data. Exploitation is constrained by high attack complexity (AC:H), meaning the attacker must satisfy conditions outside their direct control rather than issuing a single reliable request, and the impact is bounded to integrity - no confidentiality loss and no denial of service. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); this is a moderate-severity, low-priority item despite being network-reachable.
Integrity compromise in Oracle JD Edwards EnterpriseOne Homebuilder 9.2 lets a low-privileged, authenticated attacker reach the Homebuilder Management component over JDENET and create, delete, or modify critical business data at will. Only version 9.2 is listed as affected, and the flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) - no confidentiality or availability impact, but total loss of integrity for data the account can reach. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the attacker must already hold valid credentials, so this is not anonymously exploitable.
Denial of service in Oracle JD Edwards EnterpriseOne General Ledger 9.2 allows an authenticated low-privileged attacker with network access over JDENET to hang or repeatedly crash the E1 Foundation component. The CVSS 3.1 score is 5.3 (Medium) with AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, so exploitation is difficult and availability-only, with no confidentiality or integrity impact. No CISA KEV confirmation was provided, and no public exploit identified at time of analysis.
Unauthenticated network attackers can read a subset of and modify some Human Resources data in JD Edwards EnterpriseOne 9.2 via the JDENET service, but Oracle rates the issue difficult to exploit because of high attack complexity. The CVSS 3.1 base score is 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), with limited confidentiality and integrity impact and no availability effect. No public exploit identified at time of analysis and no CISA KEV entry is present, so this is a routine patch-cycle item rather than an emergency.
Low-privileged authenticated users of Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 can abuse the JDENET communication service to tamper with HR data and degrade service availability. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), the attacker must already hold valid low-privilege credentials and be able to reach JDENET, but no user interaction or elevated privileges are required, making it easily exploitable for any such account. Impact is limited to partial integrity modification/deletion of some HR-accessible records and a partial denial of service; this is a moderate-severity (5.4) issue rather than a top-priority one, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local, highly privileged users on hosts running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can exploit the Package Build SEC component to compromise the confidentiality, integrity, and availability of the installation, with a CVSS 3.1 base score of 6.7. Exploitation requires logon access to the underlying infrastructure and pre-existing high privileges, so realistic exposure is limited to malicious insiders or attackers who have already compromised a privileged account rather than external unauthenticated users. No public exploit code was identified and the issue is not confirmed as actively exploited at time of analysis, making this a moderate-priority hardening item rather than an emergency patch.
JD Edwards EnterpriseOne 9.2 allows a low-privileged authenticated user with SMTP reachability to read critical Operational Sourcing data, creating a confidentiality-only exposure of business records. The flaw is rated CVSS 6.5 and requires valid low-level credentials; no public exploit has been identified at time of analysis, and there is no indication of active exploitation.
Low-privileged users of Oracle JD Edwards EnterpriseOne Tools can read and modify data beyond their authorized scope through the JDENET interface, affecting versions 9.2.0.0 through 9.2.26.5. The flaw sits in the Business Logic Infra SEC component and requires only a valid low-privilege account plus network reachability to JDENET (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4), with no user interaction; impact is bounded to partial confidentiality and integrity loss with no availability effect. The available intelligence contains no confirmed active exploitation (not in CISA KEV) and no public exploit code, so practical risk concentrates on deployments where the JDENET listener is broadly reachable and low-privilege accounts are loosely provisioned or shared.
Oracle JD Edwards EnterpriseOne 9.2 exposes Sales Order Entry data to low-privileged users who should not be able to read it, through the JDENET communication service. An attacker who already holds a valid non-privileged EnterpriseOne account and can reach JDENET over the network can bypass intended access restrictions and read critical or complete Sales Order Entry data, with no user interaction and low attack complexity (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only - no integrity or availability effect - and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority data-exposure issue that becomes materially riskier when JDENET is internet-exposed or broadly reachable.
Oracle WebCenter Content: Imaging versions 12.2.1.4.0 and 14.1.2.0.0 contain a low-severity confidentiality flaw in the Core component exposed through SOAP. An attacker who already holds valid low-privileged credentials and can reach the SOAP interface can read a subset of Imaging data they should not access (CVSS 4.3), with no write or denial-of-service impact. No public exploit code has been identified at time of analysis.
Low-privileged authenticated users of Oracle WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0 can read critical or all application-accessible data through the Core component over HTTP. The flaw is remotely reachable with low attack complexity and no user interaction, but requires a valid low-privileged account; impact is confidentiality-only, with no integrity or availability effect. No public exploit or CISA KEV entry was identified at time of analysis, so this should be handled in the normal Oracle Critical Patch Update cycle.
Authenticated low-privileged attackers can read and modify critical data in Oracle WebCenter Content: Imaging 14.1.2.0.0 through the SOAP interface, but high attack complexity and the need for a valid account keep practical risk moderate. The CVSS 3.1 score is 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), with high confidentiality and integrity impact and no availability impact; only version 14.1.2.0.0 is affected, and no public exploit identified at time of analysis.
Oracle WebCenter Content: Imaging 14.1.2.0.0 (Core component) contains a hard-to-exploit access control weakness that lets a low-privileged, authenticated user reach the Imaging application over HTTP and read, create, delete, or modify data they should not control, giving full confidentiality and integrity impact to application data. Exploitation is gated by high attack complexity (AC:H - Oracle calls it 'difficult to exploit') and by the requirement for a pre-existing low-privileged account (PR:L), so anonymous outsiders cannot leverage it directly. No public exploit code or confirmed active exploitation is associated with this CVE at time of analysis, and the 6.8 Medium score reflects those friction factors rather than a trivial attack path.
WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0 can disclose critical or all Imaging-accessible data to a low-privileged, authenticated attacker over HTTP through the Core component. The CVSS vector requires a valid low-privilege account (PR:L), low attack complexity, and no user interaction, with impact limited to confidentiality. No public exploit was identified at time of analysis, and this is a moderate-risk, confidentiality-only issue that warrants prompt but not emergency patching.
Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 permit a low-privileged authenticated attacker who can reach the Content Server over HTTP to read, create, modify, or delete critical content repository data, yielding high confidentiality and integrity impact (CVSS 3.1 base 6.8). Exploitation is not unauthenticated: the assessed vector requires a valid low-privileged account (PR:L) plus network access, and the high attack complexity (AC:H) reflects additional conditions outside the attacker's direct control. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied, so risk is driven primarily by exposure of the Content Server interface and the population of low-privileged accounts rather than by imminent exploitation.
Unauthorized data access and limited data modification are possible in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 through the Content Server component. Unauthenticated remote attackers with HTTP network reachability can exploit this difficult-to-execute flaw to read critical content and modify some data, with CVSS 6.5 reflecting high confidentiality and low integrity impact. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Data exposure in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with local logon to the Content Server host to read critical data, and the scope change means the compromise can affect additional products. The assessed vector is local, requires a valid low-privilege account, and needs no user interaction; no public exploit was identified at time of analysis. This is a moderate-severity, context-dependent issue rather than a drop-everything emergency.
Oracle WebCenter Content's Content Server component (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated attacker on the same adjacent network segment to create, delete, or modify critical data and to access all WebCenter-accessible data. The CVSS 3.1 score is 6.8 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high attack complexity and adjacency requirements that sharply limit real-world exposure; no availability impact is scored. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry was provided in the intelligence.
Oracle WebCenter Content deployments at 12.2.1.4.0 and 14.1.2.0.0 expose the Content Server component to a low-privileged, authenticated attacker who can send crafted HTTP requests and, after convincing a separate user to perform an interaction, obtain unauthorized read access to critical content and limited insert/update/delete capability, with scope change allowing follow-on impact to other products. Oracle classifies the flaw as difficult to exploit - high attack complexity, a mandatory valid account, and a human-interaction lure all gate success - so the 6.5 MEDIUM score is a fair representation and this should be treated as a routine patch-cycle item rather than an emergency. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available through the October 2026 Oracle Critical Patch Update.
Unauthorized data modification in Oracle Java SE and GraalVM JAXP can be triggered by unauthenticated network attackers who can supply data to the affected XML APIs, though Oracle rates exploitation as difficult (AC:H). Affected releases include Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, plus GraalVM for JDK 17.0.20.1 and 21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1. Impact is limited to partial integrity with no confidentiality or availability effect; no public exploit identified at time of analysis, and practical exposure is narrow because the classic sandboxed applet/Web Start path is largely deprecated.
Oracle E-Business Suite 12.2.3 through 12.2.15 can expose critical application data through the Applications Framework Web Utilities component when an attacker who already holds high E-Business Suite privileges sends crafted HTTP requests. The issue is rated CVSS 4.9 with a confidentiality-only impact and a high-privilege prerequisite (PR:H), so it is a moderate-risk, high-prerequisite flaw rather than a pre-authentication emergency. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied.
Denial of service in Oracle WebCenter Content's Content Server component lets an authenticated low-privileged attacker with network HTTP access hang or repeatedly crash the application, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 score is 6.5 with availability-only impact (A:H; no confidentiality or integrity effect), and no public exploit code or CISA KEV entry was identified at time of analysis. This is a moderate availability risk rather than a top-tier emergency, but it is easily triggered once valid low-privileged credentials exist.
Confidentiality exposure in Oracle Agile PLM 9.3.6 lets a low-privileged authenticated user reach the Folders, Files & Attachments component over HTTP and read critical data, including potentially all PLM data accessible to that account; no user interaction or elevated privileges are required. The CVSS 3.1 score is 6.5 with high confidentiality impact only, and the authoritative assessment limits exploitation to holders of a valid low-privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a moderate authenticated-access risk rather than an unauthenticated emergency.
Oracle WebCenter Content 12.2.1.4.0 (Content Server component) permits an authenticated low-privileged attacker with HTTP network access to perform unauthorized update, insert, or delete operations against a subset of accessible data, with no confidentiality or availability impact. The flaw is low complexity and needs no user interaction, but exploitation requires a valid low-privileged account; no public exploit code or confirmed active exploitation was identified at time of analysis. This is a moderate-severity, low-priority issue rather than an urgent one.
Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 expose the Content Server component over HTTP in a way that can let an unauthenticated remote attacker reach critical document-management data, but only if a separate authorized user can first be induced into performing an action on the attacker's behalf (UI:R) and only when additional conditions outside the attacker's control are satisfied (AC:H). The CVSS 3.1 base score of 5.3 reflects confidentiality-only impact (C:H with no integrity or availability effect) against unchanged scope. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, and the mandatory victim interaction combined with high attack complexity substantially constrains reliable mass exploitation despite the network-reachable, unauthenticated vector; the issue is a moderate-priority patching item rather than an emergency.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 exposes an insufficiently protected Panel Processor component that a low-privileged authenticated user can abuse over HTTP, but only with a high degree of timing/conditions (AC:H) and only if a separate victim user interacts with attacker-influenced panel content (UI:R). Successful exploitation yields limited read access plus partial ability to update, insert or delete PeopleSoft data, and because the scope is changed (S:C) the impact can extend to integrated downstream products; base CVSS 3.1 is 4.4, making this a medium-severity issue that ranks as a low real-world priority. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
Information disclosure in the Kubernetes Operator component of Oracle TimesTen In-Memory Database (22.1 through 22.1.40.0 and 26.1 through 26.1.1.2.0) lets a low-privileged authenticated attacker who can reach the operator's HTTPS endpoint read a limited subset of data the database exposes. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) confirms that valid low-level credentials are a hard prerequisite - this is not exploitable by fully unauthenticated remote users - and that there is no integrity or availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, so severity is driven by exposure of the operator endpoint rather than by an imminent attack campaign.
Local, high-complexity data manipulation and partial denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 (Porting component) requires an attacker to already hold logon access to the host running PeopleTools and to induce a non-attacker user to perform a triggering action. Successful exploitation yields low-level unauthorized read plus insert/update/delete access to a subset of PeopleTools data and a partial availability impact (CVSS 3.1 base 4.5, AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L). No public exploit code or confirmed active exploitation was identified in the supplied intelligence, and the local-access plus victim-interaction prerequisites keep real-world risk low to moderate.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 contains a flaw in its LDAP component that lets a low-privileged user who already has a logon on the host where PeopleTools runs read, update, insert, or delete a limited subset of application data. The attack is local (AV:L), requires valid low-privileged credentials (PR:L), needs no user interaction, and yields only partial confidentiality and integrity impact with no availability effect, giving it a CVSS 3.1 base score of 4.4. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so real-world priority is moderate-to-low and hinges on whether an attacker can first obtain local authenticated access to the PeopleTools server.
PeopleSoft PeopleTools 8.61 through 8.63 allows a low-privileged user with local logon access to the PeopleTools host to read and modify limited application data and cause a partial denial of service. Exploitation is rated difficult (CVSS 4.5, AV:L/AC:H/PR:L) and requires an established account plus local access, so risk is mainly from insiders or attackers already on the server. No public exploit was identified at time of analysis, and Oracle has published an October 2026 Critical Patch Update advisory covering the issue.
Full takeover of Oracle PeopleSoft PeopleTools 8.61 through 8.63 is possible through a flaw in the product's Security component, but only by an authenticated attacker who already holds high privileges on the host and can induce a separate user to perform an action. The CVSS 3.1 base score is 6.5 (AV:L/AC:L/PR:H/UI:R), and no public exploit code or CISA KEV entry has been identified at time of analysis, so realistic risk is concentrated in insider or post-compromise scenarios rather than mass remote exploitation.
Local privilege-misuse weakness in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets an attacker who already holds a high-privileged account and interactive logon on the PeopleTools host read a limited subset of application data, insert/update/delete some records, and degrade availability enough to cause a partial denial of service. Because the CVSS vector is AV:L with PR:H, the practical risk is confined to malicious insiders or attackers who have already compromised an administrative account on the server; no user interaction is needed. There is no CISA KEV listing and no public exploit identified at time of analysis, and the vendor addressed the flaw in the October 2026 Critical Patch Update.
Cross-site scripting-class weakness in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 (Business Interlink) appears to let an unauthenticated remote attacker who persuades a victim to interact with crafted HTTP content gain limited read and update/insert/delete access to some PeopleTools data, with possible scope change to linked products. The CVSS 3.1 base score is 6.1, and exploitation requires user interaction (UI:R), so the flaw cannot be triggered autonomously against an idle server and is best treated as a moderate-severity, socially engineered issue. No public exploit code or CISA KEV entry is identified in the supplied intelligence; no public exploit identified at time of analysis.
Unauthenticated attackers with network access over HTTP can exploit the LDAP component in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 to read a subset of accessible data and to perform unauthorized inserts, updates, or deletes. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with no availability impact, and no public exploit was identified at time of analysis. Risk is concentrated on internet-facing or otherwise reachable PeopleTools web tiers; internal-only or segmented deployments are materially less exposed.
Limited read and write access to PeopleSoft Enterprise PeopleTools Portal data is achievable by unauthenticated remote attackers in versions 8.61 through 8.63, though exploitation is rated difficult (AC:H) and depends on conditions outside the attacker's control. Oracle assigns CVSS 3.1 base 4.8 (C:L/I:L/A:N); no public exploit code or CISA KEV entry was identified at time of analysis. Patch on a normal cycle rather than treating this as an emergency.
Authentication bypass in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a remote, unauthenticated attacker reach critical application data over HTTP and make limited unauthorized changes to it. Oracle rates the flaw 'difficult to exploit' - the CVSS 6.5 score pairs a high attack-complexity rating (AC:H) with no authentication or user-interaction requirements (PR:N/UI:N), so practical risk is concentrated in internet-facing PeopleSoft portals that depend on the Security component for access control. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the referenced Oracle Critical Patch Update is the vendor's fix vehicle.
Unauthenticated remote attackers can make limited unauthorized inserts, updates, or deletes against data exposed through the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63, reachable over HTTP. The severity is genuinely low: the CVSS 3.1 base score is 3.7 because Oracle explicitly rates the flaw 'difficult to exploit' (AC:H), meaning success hinges on a condition such as specific server state or precise timing that the attacker cannot directly control, and the impact is capped at partial integrity loss with no confidentiality or availability effect. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation; the practical risk is further bounded by the combination of high attack complexity and the absence of any disclosure or denial-of-service component. No EPSS score was supplied with the intelligence, reinforcing that prioritization should be driven by asset exposure rather than threat activity.
Oracle Siebel CRM Integration (versions 17.0 through 26.9) exposes a limited confidential-data read flaw in its REST component that can be reached over HTTP by an unauthenticated remote attacker. Exploitation is difficult (AC:H) and requires a victim other than the attacker to be lured into some form of interaction (UI:R), and a successful attack only yields read access to a subset of data accessible through the integration layer, with no integrity or availability impact - reflected in a low CVSS 3.1 base score of 3.1. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so all signals point to a low-priority issue best handled through the vendor's routine October 2026 Critical Patch Update cycle.
Siebel CRM Integration versions 17.0 through 26.9 contain an EAI HTTP-facing weakness that lets an unauthenticated remote attacker, provided a legitimate user is induced to interact and other high-complexity conditions align, obtain scope-changing access to critical integration data and limited ability to modify it. The assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N (6.9), reflecting mandatory victim interaction and high attack complexity rather than an easily repeatable default exploit. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Low-privileged authenticated users of the PeopleSoft Enterprise PeopleTools Portal (versions 8.61 through 8.63) can read data beyond their intended authorization scope, exposing critical or potentially all Portal-accessible data while leaving integrity and availability untouched. Exploitation requires a valid low-privileged account, network access to the Portal over HTTP, and favorable conditions outside the attacker's direct control (AC:H), so the practical barrier is credential possession rather than technical sophistication; the CVSS 3.1 base score is 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, keeping real-world urgency below what the confidentiality rating alone suggests.
Low-privileged authenticated users of Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Applications DBA data through the Internal Operations component because of an access-control weakness exposed over HTTP. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is confidentiality-only: no modification, no denial of service, and no user interaction. Exploitation requires a valid low-privilege EBS account and network reachability; no public exploit was identified at time of analysis and there is no CISA KEV listing.
Local, low-privileged users who can log on to a host where Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 is installed can read critical data exposed through the ADF Faces component, giving them access to anything the JDeveloper process can reach (CVSS 5.5, confidentiality-only). The attacker must already hold a valid account and shell access on the developer workstation or build server running the IDE - this is not network-reachable and cannot be triggered from an unauthenticated position. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update; despite the 'Authentication Bypass' classification tag, the assessed vector makes this a moderate, low-priority issue for most environments.
A low-privileged, locally authenticated user on a server hosting Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) can exploit a flaw in the Enterprise Infrastructure SEC component to read a limited subset of application data and to insert, update, or delete a limited set of records they should not be able to touch. Oracle rates exploitation as difficult (AC:H) and the attack is strictly local (AV:L) with no user interaction, yielding a CVSS 3.1 base score of 3.6; the realistic attacker population is therefore insiders or intruders who already hold a foothold and a valid low-privileged account on the E1 host. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is a hardening and patch-cadence item rather than an urgent exposure.
JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 permit a high-privileged attacker who already holds logon access to the host running the E1 Dev Platform Tech - Cloud component to perform unauthorized inserts, updates, or deletions of EnterpriseOne data and to partially degrade availability of the product. The flaw is scored CVSS 3.1 3.0 (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L), reflecting that it is local-only, requires high privileges, and is difficult to trigger because success depends on environmental conditions outside the attacker's control. There is no public exploit identified at time of analysis and no CISA KEV listing; realistic exposure is limited to trusted insiders or already-compromised privileged accounts on the application host.
Local, high-privilege tampering and partial denial of service in Oracle JD Edwards EnterpriseOne Tools (E1 Dev Platform Tech - UNIX component), affecting versions 9.2.0.0 through 9.2.26.5. An attacker who already holds a logon account with high privileges on the UNIX host running EnterpriseOne Tools can, with low complexity and no user interaction, make unauthorized updates, inserts, or deletions to data reachable through the product and degrade its availability. Scored only 3.4 (C:N/I:L/A:L) with a local attack vector and PR:H, this is a low-priority issue rather than a remotely reachable one; no public exploit was identified at time of analysis and the CVE is not listed in CISA KEV, so practical risk is confined to privileged insiders or attackers who have already compromised a privileged host account.
A local-privilege flaw in the UNIX implementation of the E1 Dev Platform Tech component of Oracle JD Edwards EnterpriseOne Tools (supported versions 9.2.0.0 through 9.2.26.5) lets a high-privileged attacker who already holds logon access to the host make unauthorized updates, inserts, or deletions, read a subset of data, and trigger a partial denial of service. The CVSS 3.1 score is 4.2 (AV:L/PR:H with low confidentiality, integrity, and availability impact), and no public exploit code or confirmed active exploitation was identified at time of analysis. Real-world risk is therefore narrow: exploitation is confined to insiders or attackers who have already compromised a privileged account on the UNIX server running the product.
Low-privileged users who can log on interactively to a JD Edwards EnterpriseOne Tools server can corrupt or delete critical enterprise data, read a limited subset of application data, and repeatedly hang or crash the Enterprise Infrastructure SEC component, with Oracle scoping the flaw to Tools releases 9.2.0.0 through 9.2.26.5. The attack is local only (AV:L) and high complexity (AC:H), so it is not reachable across the network and is realistically confined to insiders or intruders who already hold a foothold on the host, which keeps the CVSS 3.1 base score at 6.5 despite high integrity and availability impact. No public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and no EPSS score was supplied in the available intelligence; treat this as a moderate-priority insider-risk and hardening item rather than an emergency patch.
Unauthenticated network attackers can obtain unauthorized read access to critical data in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) by reaching the JDENET communication service, but Oracle rates the issue as difficult to exploit (CVSS 3.1 base 5.9, AC:H), and only confidentiality is affected. There is no public exploit code and no confirmed active exploitation at time of analysis, so practical risk is concentrated in environments that expose the JDENET transport beyond trusted internal networks.
An authentication-bypass issue in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 (Enterprise Infrastructure SEC component) lets an unauthenticated attacker positioned on the same physical or adjacent network segment read critical data and perform limited unauthorized updates, inserts, or deletes. The CVSS 3.1 score is 5.9 (AV:A/AC:H/PR:N/UI:N/C:H/I:L/A:N): no credentials or user interaction are required, but exploitation depends on non-deterministic conditions and local-segment access, so arbitrary internet attackers are not realistically exposed. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, making this a moderate rather than high priority.
Unauthenticated, network-reachable HTTP attackers can obtain unauthorized read access to critical data in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 via a flaw in the Enterprise Infrastructure SEC component. Oracle scores it 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) in the October 2026 Critical Patch Update, explicitly rating it difficult to exploit and confining impact to confidentiality, with no effect on integrity or availability. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; EPSS scoring was not supplied in the source data.
Denial of service plus limited data tampering in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5: a low-privileged authenticated attacker who can reach the JDENET service over the network can hang or repeatedly crash the application (Availability impact rated High) while also reading and modifying a subset of the data it exposes. Oracle classifies the flaw as difficult to exploit (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, base score 6.4), meaning success depends on specific timing or server-state conditions rather than a single crafted request, and a valid account is required. No public exploit code or confirmed active exploitation has been identified at time of analysis, so this is a normal-CPU-cycle remediation rather than an emergency.
Oracle JD Edwards EnterpriseOne Tools (component: Enterprise Infrastructure SEC) versions 9.2.0.0 through 9.2.26.5 can be driven into a persistent hang or repeatable crash through the JDENET protocol, while also exposing a limited slice of application data to unauthorized read and modification. The attack is network-reachable but rated high complexity and requires an existing low-privilege account, so it is a constrained, moderate-severity (CVSS 6.4) issue rather than an easily triggered remote takeover; no public exploit code exists and there is no confirmed active exploitation (not in CISA KEV) at time of analysis. Impact concentrates on availability, with secondary confidentiality and integrity effects.
Local information disclosure in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 lets a low-privileged user who can log on to the host read critical data or all EnterpriseOne data accessible through the Installation Security component. The flaw is confidentiality-only, requires authenticated local access, and does not allow remote unauthenticated compromise or modification of data. No public exploit was identified at time of analysis, and EPSS data was not supplied; overall risk is moderate rather than high priority.
Privilege escalation and takeover within the Package Build SEC component of Oracle JD Edwards EnterpriseOne Tools (9.2.0.0 through 9.2.26.5) allows a high-privileged user who already holds logon access to the application host to fully compromise the product's confidentiality, integrity and availability. The flaw is rated difficult to exploit (AC:H) and requires both local access and existing high privileges, so realistic exposure is limited to malicious insiders or attackers who have already compromised a privileged account rather than remote or unauthenticated actors. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; vendor remediation is published through Oracle's October 2026 Critical Patch Update.
Local takeover of Oracle JD Edwards EnterpriseOne Tools (9.2.0.0 through 9.2.26.5, E1 Dev Platform Tech component on UNIX) is achievable by an attacker who already holds a low-privileged logon account on the host, but only if a separate user performs a triggering interaction and difficult-to-satisfy conditions are met (CVSS 3.1 base 6.7, AV:L/AC:H/PR:L/UI:R). Successful exploitation gives high confidentiality, integrity and availability impact within the Tools product, effectively handing the attacker control of the platform from an already-established local foothold. Oracle addressed the flaw in its October 2026 Critical Patch Update; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the local-access, authentication and victim-interaction prerequisites substantially limit real-world exposure.
Authenticated low-privilege users with interactive logon to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can exploit a flaw in the Enterprise Infrastructure SEC component to gain unauthorized read and write access to critical application data, scoring CVSS 6.3 with high confidentiality and integrity impact but no availability impact. Exploitation is local only (AV:L) and rated high complexity (AC:H), meaning an attacker must already hold a valid account on the infrastructure host and satisfy additional non-default conditions or timing before the weakness can be reliably triggered. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no CISA KEV listing applies.
JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can allow a low-privileged attacker who already has local logon to the hosting infrastructure to compromise the Enterprise Infrastructure SEC component, including reading and modifying critical EnterpriseOne data. The CVSS 3.1 score is 6.3 with AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, so exploitation is local, requires an authenticated low-privileged account, and depends on difficult-to-control preconditions rather than network reachability. This is a moderate-priority issue rather than an emergency: no public exploit code or CISA KEV entry was identified at time of analysis.
Oracle JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 contain a difficult-to-exploit flaw in the Enterprise Infrastructure SEC component reachable over SMTP, allowing unauthenticated network attackers to make limited unauthorized data changes and cause a partial denial of service. Oracle assigns CVSS 3.1 base score 4.8 with high attack complexity and no confidentiality impact; no public exploit identified at time of analysis. Exposure is limited to deployments that expose or process attacker-reachable SMTP traffic under the specific conditions Oracle describes as difficult.
Denial of service in Oracle VM VirtualBox 7.2.16 can be triggered by a low-privileged user who already has local logon access to the host running VirtualBox. Exploitation is rated difficult and requires a specific non-trivial condition in the Core component, but a successful attack can crash or repeatedly hang VirtualBox and, because of the scope change, may affect other products on the same infrastructure. No public exploit was identified at time of analysis, and impact is limited to availability.
Local low-privileged users on hosts running Oracle VM VirtualBox 7.2.16 can cause a complete denial of service-hang or frequently repeatable crash-of the VirtualBox Core component, with scope change potentially affecting other host products, but only when a second user performs a triggering action. This moderate-severity flaw requires local logon and human interaction, is not remotely reachable, and affects availability only; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated attackers with HTTP network access to the Content Server component of Oracle WebCenter Content can induce a targeted user to perform an interaction that grants limited unauthorized read and insert/update/delete access to application data, with scope change potentially extending impact to connected products. The issue affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 6.1; no public exploit code or CISA KEV confirmation was identified at time of analysis, and the required victim interaction makes automated mass exploitation impractical.
Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allow authenticated low-privilege users to read confidential Content Server data over HTTP, with CVSS 3.1 base score 6.5 reflecting high confidentiality impact and no integrity or availability effect. Exploitation requires a valid low-privilege account plus network access to the Content Server component; no user interaction or special configuration is indicated. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Local privilege escalation in Oracle Communications Billing and Revenue Management can let an attacker who already holds high-privileged host access compromise the Platform component, affecting versions 15.0.0.0.0 through 15.2.0.0.0. The CVSS 3.1 score is 6.7 with AV:L/PR:H, so the main barrier is the requirement for a high-privileged local logon rather than network reachability; no public exploit was identified at time of analysis.
Information disclosure in the Indian Payroll component of Oracle HRMS (India) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker who already holds a valid logon on the infrastructure host read critical data, with the scope of the compromise extending beyond the vulnerable component to additional products. The vector is local and authenticated (AV:L, PR:L, UI:N, AC:L), so a foothold or internal credentials are a prerequisite, and impact is confined to confidentiality (C:H with no integrity or availability effect), giving a CVSS 3.1 base score of 6.5. No public exploit code and no CISA KEV entry were identified at time of analysis, and the attack surface is further narrowed to organizations that actually run the India payroll localization.
Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) expose a flaw in the Security component that lets a network-reachable, unauthenticated attacker achieve partial read and partial modify access to data accessible through those APIs, with no availability impact. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, score 6.5), exploitation requires no privileges and no user interaction, but the JVM must actually process attacker-influenced input through the affected APIs - typically a web service that supplies data to them - or, in the legacy client case, run untrusted code inside a sandboxed Java Web Start application or applet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical attack surface is narrower than the score implies because Java Web Start and the browser applet plugin are absent from modern JDKs.
Oracle Java SE 8u503 and 8u503-perf, along with Oracle GraalVM Enterprise Edition 21.3.19.1.1, contain a difficult-to-exploit RMI flaw that unauthenticated network attackers can trigger only by supplying crafted data to the affected RMI APIs, such as through a web service; applet and Java Web Start paths are explicitly excluded. Successful exploitation yields limited confidentiality and integrity impact with scope change but no availability impact, consistent with CVSS 5.4 (AC:H). No public exploit was identified at time of analysis, and the high complexity and narrow input path keep priority moderate rather than emergency.
A limited-integrity flaw in the Networking component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows a remote, unauthenticated attacker to make unauthorized updates, inserts, or deletions to some data, provided they can supply malicious input to the affected networking APIs. Oracle rates exploitation as difficult (CVSS AC:H, 3.7 base score), with no confidentiality or availability impact; the realistic exposure paths are web services that pass attacker-controlled data into these APIs and sandboxed Java Web Start/applet deployments running untrusted internet code. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV, so it is a low-priority patch item rather than an emergency.
Oracle Java SE Networking component exposes a read-only information disclosure in versions 21.0.12.1, 25.0.4.1, and 27, where crafted data supplied to affected Networking APIs can leak a subset of JVM-accessible data. Unauthenticated remote attackers need only network reachability to an application that forwards untrusted input into those APIs, with no user interaction and low attack complexity (CVSS 3.1: 5.3, AV:N/AC:L/PR:N/UI:N/C:L). No public exploit and no confirmed active exploitation were identified at time of analysis; the practical risk is bounded by whether a deployed service actually exposes the vulnerable Networking code path.
Oracle Java SE and GraalVM JDK/Enterprise distributions can expose confidential data when JAXP processes attacker-supplied XML, with the most realistic path being services that feed untrusted data into XML APIs. The flaw affects specific Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27 releases plus listed GraalVM versions, and is difficult to exploit (AC:H) with confidentiality-only impact. No public exploit was identified at time of analysis, and patch availability is documented through Oracle's October 2026 Critical Patch Update advisory.
Unauthorized read access to a limited subset of Java SE-accessible data is exposed in Oracle Java SE 25.0.4.1 and 27 through the Compiler component when attacker-controlled data is supplied to its APIs, such as through a web service that feeds external input into the compiler. The vector is network-reachable and requires no authentication or user interaction, but Oracle rates attack complexity as high and impact as confidentiality-only and low (CVSS 3.1 base 3.7); no public exploit was identified at time of analysis and no KEV entry is associated.
High-privileged attackers with network access to PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit a high-complexity flaw in the Multichannel Framework component to take over the affected PeopleTools instance, with full confidentiality, integrity, and availability impact. The vulnerability requires an authenticated account with high privileges and specific exploit conditions, so it is not reachable by anonymous remote users. No public exploit code or active exploitation is identified at time of analysis.
Local privilege-abuse in Oracle Communications Billing and Revenue Management (BRM) 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0 lets an attacker who already holds a high-privileged logon on the BRM host fully compromise the application, with high confidentiality, integrity and availability impact and unchanged scope (CVSS 3.1 base 6.7). The attack is not network-reachable and requires no user interaction once the privileged host foothold exists, so the realistic threat population is insiders, compromised administrator accounts, or an adversary who has already escalated on the underlying infrastructure. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; severity is driven by the value of the BRM platform rather than by ease of remote access.
Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 contain a moderate-severity flaw in the OIM Legacy UI that can allow an unauthenticated network attacker to read a subset of OIM data and update, insert, or delete some OIM-accessible data if a victim user is induced to interact with attacker-supplied content. The CVSS 3.1 base score is 6.1, with scope change indicating possible impact beyond OIM itself, but the UI:R requirement means exploitation depends on user action and is not silent or automatic at scale. No public exploit identified at time of analysis.
A reachable JAXP (Java API for XML Processing) parsing path in Oracle Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, plus GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1, can be driven by crafted XML to degrade availability, yielding a partial denial of service (CVSS 5.3, AV:N/AC:L/PR:N/UI:N, A:L only). Exploitation is bounded by reachability: it requires that the target expose a JAXP-backed interface to attacker-supplied XML, such as a web service, REST/SOAP endpoint, or any component parsing externally sourced documents with the JDK's default XML stack. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the issue carries no confidentiality or integrity impact - this is a moderate, availability-only flaw that does not warrant emergency out-of-band patching.
Oracle Java SE, together with the GraalVM for JDK and GraalVM Enterprise Edition distributions, contains a Networking component vulnerability that allows unauthenticated network attackers to make limited unauthorized changes to accessible data and to cause a partial denial of service, without any confidentiality loss or code execution. The affected builds are Java SE 8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, GraalVM for JDK 17.0.20.1 and 21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1. No public exploit code or confirmed active exploitation is identified at time of analysis; practical risk is concentrated in services that pass attacker-controlled data into the affected networking APIs and in legacy sandboxed applet or Web Start deployments.
Unauthorized access to critical data in Oracle Demand Planning 12.1 and 12.2 requires a low-privileged authenticated attacker and a separate victim's interaction, yet successful exploitation can cross scope boundaries and expose data in connected Oracle Supply Chain products. The issue is scored CVSS 3.1 6.8 with confidentiality-only impact; no public exploit identified at time of analysis and no confirmed active exploitation was reported in the provided intelligence. Realistic risk is social-engineering-assisted data disclosure against logged-in users rather than autonomous compromise.
Low-privileged authenticated users of Oracle E-Business Suite 12.2.3 through 12.2.15 can read a limited subset of Oracle Applications Manager Diagnostics data over HTTP, with no integrity or availability impact. The assessed vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) and Oracle's 'difficult to exploit' rating mean an attacker needs a valid low-privileged account plus additional preconditions, keeping realistic risk low. No public exploit code was identified at time of analysis.
Oracle HRMS (US) Payroll Year End, as shipped in Oracle E-Business Suite 12.2.3 through 12.2.15, exposes a moderate-severity HTTP-reachable flaw that a low-privileged authenticated attacker can exploit only if a different user is induced to view or process attacker-supplied data. Successful exploitation can yield limited unauthorized read access plus insert/update/delete changes within HRMS (US) and may affect additional products through scope change, with no availability impact; no public exploit was identified at time of analysis. The assessed CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Limited data disclosure and partial denial of service in Oracle Applications Manager (Oracle E-Business Suite) allow a low-privileged authenticated attacker with HTTP network access to the Diagnostics component to read a subset of accessible data and degrade availability. Affected releases are 12.2.3 through 12.2.15; Oracle rates exploitation as difficult (AC:H) and the CVSS 3.1 score is 4.2, so this is a low-priority issue. No public exploit code or CISA KEV entry is identified in the supplied intelligence.
A moderately severe flaw in Oracle HRMS (UK), a module of Oracle E-Business Suite, lets a low-privileged authenticated user with HTTP network access manipulate content that a separate victim must interact with, ultimately granting unauthorized read and limited write access to HRMS (UK) data and potentially affecting other EBS components due to a scope change. Versions 12.2.3 through 12.2.15 are affected; no public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score is 5.4. Successful abuse hinges on two prerequisites: a valid low-privilege account and a second user's interaction, which curbs automated mass exploitation.
Limited read-only data exposure in Oracle Applications Manager (the Diagnostics component of Oracle E-Business Suite 12.2.3 through 12.2.15) is reachable over HTTP but only by an attacker who already holds a high-privileged OAM account, and exploitation additionally depends on conditions outside the attacker's control (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N, base score 2.2). Successful abuse yields unauthorized read access to a subset of OAM-accessible data with no integrity or availability impact and no unauthenticated path. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the high privilege prerequisite and high attack complexity keep realistic risk well below what the network vector alone suggests.
Unauthorized read access to a subset of PeopleSoft PeopleTools data is possible for low-privileged users who can log on locally to the infrastructure running the XML Publisher component in versions 8.61 through 8.63. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) requires an existing low-privileged credential and local access, with no integrity or availability impact. No public exploit identified at time of analysis, and KEV status is not indicated.
Oracle WebCenter Content 14.1.2.0.0 allows unauthenticated network attackers to access critical data and make limited unauthorized changes through HTTP if they can induce a victim to perform a crafted action. The CVSS 3.1 score is 6.9 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N), and no public exploit was identified at time of analysis. Mandatory user interaction and high attack complexity constrain reliable exploitation, but the scope change means connected products and trust relationships may also be affected.
Oracle WebCenter Content 14.1.2.0.0 (Content Server component) allows a low-privileged, HTTP-reachable attacker to create, delete, or modify critical repository data and read a limited subset of it, but only after a second, typically higher-privileged user is induced to interact with attacker-controlled content or a crafted request. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) makes valid credentials and victim interaction both mandatory, so the flaw is not anonymously reachable and is poorly suited to automated or wormable mass exploitation; integrity impact is high while confidentiality is limited and availability is unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, consistent with a moderate, not top-tier, priority rating.
Oracle Outside In Technology 8.5.8 (Outside In Core) can expose critical data to unauthenticated remote attackers who persuade a user to open, preview, or submit a crafted document for parsing; the assessed CVSS 3.1 score is 6.5 with confidentiality-only impact and mandatory user interaction. No public exploit code or CISA KEV entry is identified in the provided data, and EPSS is not supplied; this is a moderate-priority data-disclosure issue that depends on the malicious file reaching an application that invokes Outside In parsing.
Denial of service in Oracle Outside In Technology 8.5.8 (Outside In Core) lets unauthenticated remote attackers hang or repeatedly crash applications that parse attacker-supplied documents, with the CVSS 3.1 score of 6.5 reflecting an availability-only impact. The vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) requires network reachability plus human interaction from someone other than the attacker - typically a user opening, previewing, or uploading a crafted file into a service built on the Outside In SDK. No public exploit code exists and there is no CISA KEV listing at time of analysis, so the realistic exposure is confined to environments that embed Outside In Core in an internet-facing or multi-tenant document-processing path. Patch availability is indicated only through the Oracle Critical Patch Update advisory; no exact fixed version is stated in the available data.
Authenticated integrity compromise of Oracle WebCenter Content: Imaging 14.1.2.0.0 is achievable over the network through the product's SOAP web-service interface, where a low-privileged account can create, delete, or modify critical Imaging data without any user interaction. Confidentiality and availability are untouched - the entire CVSS 3.1 base score of 6.5 derives from a High integrity impact with PR:L, AC:L, and AV:N, meaning the only real barrier is holding valid low-tier credentials. There is no CISA KEV listing and no public exploit identified at time of analysis, so risk is concentrated in environments where the Imaging SOAP endpoint is broadly reachable by multi-tenant or delegated users rather than in mass internet-wide scanning.
WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0 can disclose critical data to a high-privileged attacker who already has logon access to the hosting infrastructure and can induce a different user to interact with the attack. Oracle rates this local, scope-changing flaw CVSS 5.5 with confidentiality-only impact; no public exploit was identified at time of analysis. Intelligence feeds tag it as an authentication bypass, but the authoritative vector requires high privileges and user interaction, so it is not a remote unauthenticated path.
Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 expose the Content Server component to an unauthenticated HTTP-reachable attack that only succeeds after a non-attacker user interacts with attacker-supplied content or a crafted link, after which the attacker can make limited unauthorized updates, inserts or deletions to accessible data and partially degrade availability. Integrity and availability impacts are both rated Low with no confidentiality exposure, yielding a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L); the user-interaction requirement means exploitation is not fully automatable, and no public exploit code was identified at time of analysis. Oracle addressed the issue in its October 2026 Critical Patch Update.
Unauthorized modification of HR data in Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 is possible for unauthenticated remote attackers over HTTP, but only under high-complexity conditions and with limited integrity impact (CVSS 3.1 base score 3.7). The vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) shows no confidentiality or availability loss, and no public exploit code or confirmed active exploitation was identified at time of analysis. Practical risk is genuinely low-priority, particularly because JD Edwards HR deployments are usually segmented from the public internet.
Integrity-only data tampering in Oracle JD Edwards EnterpriseOne Configurator 9.2 lets a low-privileged, authenticated attacker reach the Configuration Management component over HTTP and create, delete, or modify critical configuration data. Exploitation is constrained by high attack complexity (AC:H), meaning the attacker must satisfy conditions outside their direct control rather than issuing a single reliable request, and the impact is bounded to integrity - no confidentiality loss and no denial of service. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); this is a moderate-severity, low-priority item despite being network-reachable.
Integrity compromise in Oracle JD Edwards EnterpriseOne Homebuilder 9.2 lets a low-privileged, authenticated attacker reach the Homebuilder Management component over JDENET and create, delete, or modify critical business data at will. Only version 9.2 is listed as affected, and the flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) - no confidentiality or availability impact, but total loss of integrity for data the account can reach. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the attacker must already hold valid credentials, so this is not anonymously exploitable.
Denial of service in Oracle JD Edwards EnterpriseOne General Ledger 9.2 allows an authenticated low-privileged attacker with network access over JDENET to hang or repeatedly crash the E1 Foundation component. The CVSS 3.1 score is 5.3 (Medium) with AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, so exploitation is difficult and availability-only, with no confidentiality or integrity impact. No CISA KEV confirmation was provided, and no public exploit identified at time of analysis.
Unauthenticated network attackers can read a subset of and modify some Human Resources data in JD Edwards EnterpriseOne 9.2 via the JDENET service, but Oracle rates the issue difficult to exploit because of high attack complexity. The CVSS 3.1 base score is 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), with limited confidentiality and integrity impact and no availability effect. No public exploit identified at time of analysis and no CISA KEV entry is present, so this is a routine patch-cycle item rather than an emergency.
Low-privileged authenticated users of Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 can abuse the JDENET communication service to tamper with HR data and degrade service availability. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), the attacker must already hold valid low-privilege credentials and be able to reach JDENET, but no user interaction or elevated privileges are required, making it easily exploitable for any such account. Impact is limited to partial integrity modification/deletion of some HR-accessible records and a partial denial of service; this is a moderate-severity (5.4) issue rather than a top-priority one, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local, highly privileged users on hosts running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can exploit the Package Build SEC component to compromise the confidentiality, integrity, and availability of the installation, with a CVSS 3.1 base score of 6.7. Exploitation requires logon access to the underlying infrastructure and pre-existing high privileges, so realistic exposure is limited to malicious insiders or attackers who have already compromised a privileged account rather than external unauthenticated users. No public exploit code was identified and the issue is not confirmed as actively exploited at time of analysis, making this a moderate-priority hardening item rather than an emergency patch.
JD Edwards EnterpriseOne 9.2 allows a low-privileged authenticated user with SMTP reachability to read critical Operational Sourcing data, creating a confidentiality-only exposure of business records. The flaw is rated CVSS 6.5 and requires valid low-level credentials; no public exploit has been identified at time of analysis, and there is no indication of active exploitation.
Low-privileged users of Oracle JD Edwards EnterpriseOne Tools can read and modify data beyond their authorized scope through the JDENET interface, affecting versions 9.2.0.0 through 9.2.26.5. The flaw sits in the Business Logic Infra SEC component and requires only a valid low-privilege account plus network reachability to JDENET (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4), with no user interaction; impact is bounded to partial confidentiality and integrity loss with no availability effect. The available intelligence contains no confirmed active exploitation (not in CISA KEV) and no public exploit code, so practical risk concentrates on deployments where the JDENET listener is broadly reachable and low-privilege accounts are loosely provisioned or shared.
Oracle JD Edwards EnterpriseOne 9.2 exposes Sales Order Entry data to low-privileged users who should not be able to read it, through the JDENET communication service. An attacker who already holds a valid non-privileged EnterpriseOne account and can reach JDENET over the network can bypass intended access restrictions and read critical or complete Sales Order Entry data, with no user interaction and low attack complexity (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only - no integrity or availability effect - and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority data-exposure issue that becomes materially riskier when JDENET is internet-exposed or broadly reachable.
Oracle WebCenter Content: Imaging versions 12.2.1.4.0 and 14.1.2.0.0 contain a low-severity confidentiality flaw in the Core component exposed through SOAP. An attacker who already holds valid low-privileged credentials and can reach the SOAP interface can read a subset of Imaging data they should not access (CVSS 4.3), with no write or denial-of-service impact. No public exploit code has been identified at time of analysis.
Low-privileged authenticated users of Oracle WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0 can read critical or all application-accessible data through the Core component over HTTP. The flaw is remotely reachable with low attack complexity and no user interaction, but requires a valid low-privileged account; impact is confidentiality-only, with no integrity or availability effect. No public exploit or CISA KEV entry was identified at time of analysis, so this should be handled in the normal Oracle Critical Patch Update cycle.
Authenticated low-privileged attackers can read and modify critical data in Oracle WebCenter Content: Imaging 14.1.2.0.0 through the SOAP interface, but high attack complexity and the need for a valid account keep practical risk moderate. The CVSS 3.1 score is 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), with high confidentiality and integrity impact and no availability impact; only version 14.1.2.0.0 is affected, and no public exploit identified at time of analysis.
Oracle WebCenter Content: Imaging 14.1.2.0.0 (Core component) contains a hard-to-exploit access control weakness that lets a low-privileged, authenticated user reach the Imaging application over HTTP and read, create, delete, or modify data they should not control, giving full confidentiality and integrity impact to application data. Exploitation is gated by high attack complexity (AC:H - Oracle calls it 'difficult to exploit') and by the requirement for a pre-existing low-privileged account (PR:L), so anonymous outsiders cannot leverage it directly. No public exploit code or confirmed active exploitation is associated with this CVE at time of analysis, and the 6.8 Medium score reflects those friction factors rather than a trivial attack path.
WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0 can disclose critical or all Imaging-accessible data to a low-privileged, authenticated attacker over HTTP through the Core component. The CVSS vector requires a valid low-privilege account (PR:L), low attack complexity, and no user interaction, with impact limited to confidentiality. No public exploit was identified at time of analysis, and this is a moderate-risk, confidentiality-only issue that warrants prompt but not emergency patching.
Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 permit a low-privileged authenticated attacker who can reach the Content Server over HTTP to read, create, modify, or delete critical content repository data, yielding high confidentiality and integrity impact (CVSS 3.1 base 6.8). Exploitation is not unauthenticated: the assessed vector requires a valid low-privileged account (PR:L) plus network access, and the high attack complexity (AC:H) reflects additional conditions outside the attacker's direct control. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied, so risk is driven primarily by exposure of the Content Server interface and the population of low-privileged accounts rather than by imminent exploitation.
Unauthorized data access and limited data modification are possible in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 through the Content Server component. Unauthenticated remote attackers with HTTP network reachability can exploit this difficult-to-execute flaw to read critical content and modify some data, with CVSS 6.5 reflecting high confidentiality and low integrity impact. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Data exposure in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with local logon to the Content Server host to read critical data, and the scope change means the compromise can affect additional products. The assessed vector is local, requires a valid low-privilege account, and needs no user interaction; no public exploit was identified at time of analysis. This is a moderate-severity, context-dependent issue rather than a drop-everything emergency.
Oracle WebCenter Content's Content Server component (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated attacker on the same adjacent network segment to create, delete, or modify critical data and to access all WebCenter-accessible data. The CVSS 3.1 score is 6.8 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high attack complexity and adjacency requirements that sharply limit real-world exposure; no availability impact is scored. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry was provided in the intelligence.
Oracle WebCenter Content deployments at 12.2.1.4.0 and 14.1.2.0.0 expose the Content Server component to a low-privileged, authenticated attacker who can send crafted HTTP requests and, after convincing a separate user to perform an interaction, obtain unauthorized read access to critical content and limited insert/update/delete capability, with scope change allowing follow-on impact to other products. Oracle classifies the flaw as difficult to exploit - high attack complexity, a mandatory valid account, and a human-interaction lure all gate success - so the 6.5 MEDIUM score is a fair representation and this should be treated as a routine patch-cycle item rather than an emergency. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available through the October 2026 Oracle Critical Patch Update.
Unauthorized data modification in Oracle Java SE and GraalVM JAXP can be triggered by unauthenticated network attackers who can supply data to the affected XML APIs, though Oracle rates exploitation as difficult (AC:H). Affected releases include Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, plus GraalVM for JDK 17.0.20.1 and 21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1. Impact is limited to partial integrity with no confidentiality or availability effect; no public exploit identified at time of analysis, and practical exposure is narrow because the classic sandboxed applet/Web Start path is largely deprecated.
Oracle E-Business Suite 12.2.3 through 12.2.15 can expose critical application data through the Applications Framework Web Utilities component when an attacker who already holds high E-Business Suite privileges sends crafted HTTP requests. The issue is rated CVSS 4.9 with a confidentiality-only impact and a high-privilege prerequisite (PR:H), so it is a moderate-risk, high-prerequisite flaw rather than a pre-authentication emergency. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied.
Denial of service in Oracle WebCenter Content's Content Server component lets an authenticated low-privileged attacker with network HTTP access hang or repeatedly crash the application, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 score is 6.5 with availability-only impact (A:H; no confidentiality or integrity effect), and no public exploit code or CISA KEV entry was identified at time of analysis. This is a moderate availability risk rather than a top-tier emergency, but it is easily triggered once valid low-privileged credentials exist.
Confidentiality exposure in Oracle Agile PLM 9.3.6 lets a low-privileged authenticated user reach the Folders, Files & Attachments component over HTTP and read critical data, including potentially all PLM data accessible to that account; no user interaction or elevated privileges are required. The CVSS 3.1 score is 6.5 with high confidentiality impact only, and the authoritative assessment limits exploitation to holders of a valid low-privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a moderate authenticated-access risk rather than an unauthenticated emergency.
Oracle WebCenter Content 12.2.1.4.0 (Content Server component) permits an authenticated low-privileged attacker with HTTP network access to perform unauthorized update, insert, or delete operations against a subset of accessible data, with no confidentiality or availability impact. The flaw is low complexity and needs no user interaction, but exploitation requires a valid low-privileged account; no public exploit code or confirmed active exploitation was identified at time of analysis. This is a moderate-severity, low-priority issue rather than an urgent one.
Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 expose the Content Server component over HTTP in a way that can let an unauthenticated remote attacker reach critical document-management data, but only if a separate authorized user can first be induced into performing an action on the attacker's behalf (UI:R) and only when additional conditions outside the attacker's control are satisfied (AC:H). The CVSS 3.1 base score of 5.3 reflects confidentiality-only impact (C:H with no integrity or availability effect) against unchanged scope. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, and the mandatory victim interaction combined with high attack complexity substantially constrains reliable mass exploitation despite the network-reachable, unauthenticated vector; the issue is a moderate-priority patching item rather than an emergency.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 exposes an insufficiently protected Panel Processor component that a low-privileged authenticated user can abuse over HTTP, but only with a high degree of timing/conditions (AC:H) and only if a separate victim user interacts with attacker-influenced panel content (UI:R). Successful exploitation yields limited read access plus partial ability to update, insert or delete PeopleSoft data, and because the scope is changed (S:C) the impact can extend to integrated downstream products; base CVSS 3.1 is 4.4, making this a medium-severity issue that ranks as a low real-world priority. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
Information disclosure in the Kubernetes Operator component of Oracle TimesTen In-Memory Database (22.1 through 22.1.40.0 and 26.1 through 26.1.1.2.0) lets a low-privileged authenticated attacker who can reach the operator's HTTPS endpoint read a limited subset of data the database exposes. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) confirms that valid low-level credentials are a hard prerequisite - this is not exploitable by fully unauthenticated remote users - and that there is no integrity or availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, so severity is driven by exposure of the operator endpoint rather than by an imminent attack campaign.
Local, high-complexity data manipulation and partial denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 (Porting component) requires an attacker to already hold logon access to the host running PeopleTools and to induce a non-attacker user to perform a triggering action. Successful exploitation yields low-level unauthorized read plus insert/update/delete access to a subset of PeopleTools data and a partial availability impact (CVSS 3.1 base 4.5, AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L). No public exploit code or confirmed active exploitation was identified in the supplied intelligence, and the local-access plus victim-interaction prerequisites keep real-world risk low to moderate.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 contains a flaw in its LDAP component that lets a low-privileged user who already has a logon on the host where PeopleTools runs read, update, insert, or delete a limited subset of application data. The attack is local (AV:L), requires valid low-privileged credentials (PR:L), needs no user interaction, and yields only partial confidentiality and integrity impact with no availability effect, giving it a CVSS 3.1 base score of 4.4. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so real-world priority is moderate-to-low and hinges on whether an attacker can first obtain local authenticated access to the PeopleTools server.
PeopleSoft PeopleTools 8.61 through 8.63 allows a low-privileged user with local logon access to the PeopleTools host to read and modify limited application data and cause a partial denial of service. Exploitation is rated difficult (CVSS 4.5, AV:L/AC:H/PR:L) and requires an established account plus local access, so risk is mainly from insiders or attackers already on the server. No public exploit was identified at time of analysis, and Oracle has published an October 2026 Critical Patch Update advisory covering the issue.
Full takeover of Oracle PeopleSoft PeopleTools 8.61 through 8.63 is possible through a flaw in the product's Security component, but only by an authenticated attacker who already holds high privileges on the host and can induce a separate user to perform an action. The CVSS 3.1 base score is 6.5 (AV:L/AC:L/PR:H/UI:R), and no public exploit code or CISA KEV entry has been identified at time of analysis, so realistic risk is concentrated in insider or post-compromise scenarios rather than mass remote exploitation.
Local privilege-misuse weakness in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets an attacker who already holds a high-privileged account and interactive logon on the PeopleTools host read a limited subset of application data, insert/update/delete some records, and degrade availability enough to cause a partial denial of service. Because the CVSS vector is AV:L with PR:H, the practical risk is confined to malicious insiders or attackers who have already compromised an administrative account on the server; no user interaction is needed. There is no CISA KEV listing and no public exploit identified at time of analysis, and the vendor addressed the flaw in the October 2026 Critical Patch Update.
Cross-site scripting-class weakness in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 (Business Interlink) appears to let an unauthenticated remote attacker who persuades a victim to interact with crafted HTTP content gain limited read and update/insert/delete access to some PeopleTools data, with possible scope change to linked products. The CVSS 3.1 base score is 6.1, and exploitation requires user interaction (UI:R), so the flaw cannot be triggered autonomously against an idle server and is best treated as a moderate-severity, socially engineered issue. No public exploit code or CISA KEV entry is identified in the supplied intelligence; no public exploit identified at time of analysis.
Unauthenticated attackers with network access over HTTP can exploit the LDAP component in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 to read a subset of accessible data and to perform unauthorized inserts, updates, or deletes. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with no availability impact, and no public exploit was identified at time of analysis. Risk is concentrated on internet-facing or otherwise reachable PeopleTools web tiers; internal-only or segmented deployments are materially less exposed.
Limited read and write access to PeopleSoft Enterprise PeopleTools Portal data is achievable by unauthenticated remote attackers in versions 8.61 through 8.63, though exploitation is rated difficult (AC:H) and depends on conditions outside the attacker's control. Oracle assigns CVSS 3.1 base 4.8 (C:L/I:L/A:N); no public exploit code or CISA KEV entry was identified at time of analysis. Patch on a normal cycle rather than treating this as an emergency.
Authentication bypass in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a remote, unauthenticated attacker reach critical application data over HTTP and make limited unauthorized changes to it. Oracle rates the flaw 'difficult to exploit' - the CVSS 6.5 score pairs a high attack-complexity rating (AC:H) with no authentication or user-interaction requirements (PR:N/UI:N), so practical risk is concentrated in internet-facing PeopleSoft portals that depend on the Security component for access control. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the referenced Oracle Critical Patch Update is the vendor's fix vehicle.
Unauthenticated remote attackers can make limited unauthorized inserts, updates, or deletes against data exposed through the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63, reachable over HTTP. The severity is genuinely low: the CVSS 3.1 base score is 3.7 because Oracle explicitly rates the flaw 'difficult to exploit' (AC:H), meaning success hinges on a condition such as specific server state or precise timing that the attacker cannot directly control, and the impact is capped at partial integrity loss with no confidentiality or availability effect. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation; the practical risk is further bounded by the combination of high attack complexity and the absence of any disclosure or denial-of-service component. No EPSS score was supplied with the intelligence, reinforcing that prioritization should be driven by asset exposure rather than threat activity.
Oracle Siebel CRM Integration (versions 17.0 through 26.9) exposes a limited confidential-data read flaw in its REST component that can be reached over HTTP by an unauthenticated remote attacker. Exploitation is difficult (AC:H) and requires a victim other than the attacker to be lured into some form of interaction (UI:R), and a successful attack only yields read access to a subset of data accessible through the integration layer, with no integrity or availability impact - reflected in a low CVSS 3.1 base score of 3.1. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so all signals point to a low-priority issue best handled through the vendor's routine October 2026 Critical Patch Update cycle.
Siebel CRM Integration versions 17.0 through 26.9 contain an EAI HTTP-facing weakness that lets an unauthenticated remote attacker, provided a legitimate user is induced to interact and other high-complexity conditions align, obtain scope-changing access to critical integration data and limited ability to modify it. The assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N (6.9), reflecting mandatory victim interaction and high attack complexity rather than an easily repeatable default exploit. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Low-privileged authenticated users of the PeopleSoft Enterprise PeopleTools Portal (versions 8.61 through 8.63) can read data beyond their intended authorization scope, exposing critical or potentially all Portal-accessible data while leaving integrity and availability untouched. Exploitation requires a valid low-privileged account, network access to the Portal over HTTP, and favorable conditions outside the attacker's direct control (AC:H), so the practical barrier is credential possession rather than technical sophistication; the CVSS 3.1 base score is 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, keeping real-world urgency below what the confidentiality rating alone suggests.
Low-privileged authenticated users of Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Applications DBA data through the Internal Operations component because of an access-control weakness exposed over HTTP. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is confidentiality-only: no modification, no denial of service, and no user interaction. Exploitation requires a valid low-privilege EBS account and network reachability; no public exploit was identified at time of analysis and there is no CISA KEV listing.
Local, low-privileged users who can log on to a host where Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 is installed can read critical data exposed through the ADF Faces component, giving them access to anything the JDeveloper process can reach (CVSS 5.5, confidentiality-only). The attacker must already hold a valid account and shell access on the developer workstation or build server running the IDE - this is not network-reachable and cannot be triggered from an unauthenticated position. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update; despite the 'Authentication Bypass' classification tag, the assessed vector makes this a moderate, low-priority issue for most environments.
A low-privileged, locally authenticated user on a server hosting Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) can exploit a flaw in the Enterprise Infrastructure SEC component to read a limited subset of application data and to insert, update, or delete a limited set of records they should not be able to touch. Oracle rates exploitation as difficult (AC:H) and the attack is strictly local (AV:L) with no user interaction, yielding a CVSS 3.1 base score of 3.6; the realistic attacker population is therefore insiders or intruders who already hold a foothold and a valid low-privileged account on the E1 host. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is a hardening and patch-cadence item rather than an urgent exposure.
JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 permit a high-privileged attacker who already holds logon access to the host running the E1 Dev Platform Tech - Cloud component to perform unauthorized inserts, updates, or deletions of EnterpriseOne data and to partially degrade availability of the product. The flaw is scored CVSS 3.1 3.0 (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L), reflecting that it is local-only, requires high privileges, and is difficult to trigger because success depends on environmental conditions outside the attacker's control. There is no public exploit identified at time of analysis and no CISA KEV listing; realistic exposure is limited to trusted insiders or already-compromised privileged accounts on the application host.
Local, high-privilege tampering and partial denial of service in Oracle JD Edwards EnterpriseOne Tools (E1 Dev Platform Tech - UNIX component), affecting versions 9.2.0.0 through 9.2.26.5. An attacker who already holds a logon account with high privileges on the UNIX host running EnterpriseOne Tools can, with low complexity and no user interaction, make unauthorized updates, inserts, or deletions to data reachable through the product and degrade its availability. Scored only 3.4 (C:N/I:L/A:L) with a local attack vector and PR:H, this is a low-priority issue rather than a remotely reachable one; no public exploit was identified at time of analysis and the CVE is not listed in CISA KEV, so practical risk is confined to privileged insiders or attackers who have already compromised a privileged host account.
A local-privilege flaw in the UNIX implementation of the E1 Dev Platform Tech component of Oracle JD Edwards EnterpriseOne Tools (supported versions 9.2.0.0 through 9.2.26.5) lets a high-privileged attacker who already holds logon access to the host make unauthorized updates, inserts, or deletions, read a subset of data, and trigger a partial denial of service. The CVSS 3.1 score is 4.2 (AV:L/PR:H with low confidentiality, integrity, and availability impact), and no public exploit code or confirmed active exploitation was identified at time of analysis. Real-world risk is therefore narrow: exploitation is confined to insiders or attackers who have already compromised a privileged account on the UNIX server running the product.
Low-privileged users who can log on interactively to a JD Edwards EnterpriseOne Tools server can corrupt or delete critical enterprise data, read a limited subset of application data, and repeatedly hang or crash the Enterprise Infrastructure SEC component, with Oracle scoping the flaw to Tools releases 9.2.0.0 through 9.2.26.5. The attack is local only (AV:L) and high complexity (AC:H), so it is not reachable across the network and is realistically confined to insiders or intruders who already hold a foothold on the host, which keeps the CVSS 3.1 base score at 6.5 despite high integrity and availability impact. No public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and no EPSS score was supplied in the available intelligence; treat this as a moderate-priority insider-risk and hardening item rather than an emergency patch.
Unauthenticated network attackers can obtain unauthorized read access to critical data in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) by reaching the JDENET communication service, but Oracle rates the issue as difficult to exploit (CVSS 3.1 base 5.9, AC:H), and only confidentiality is affected. There is no public exploit code and no confirmed active exploitation at time of analysis, so practical risk is concentrated in environments that expose the JDENET transport beyond trusted internal networks.
An authentication-bypass issue in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 (Enterprise Infrastructure SEC component) lets an unauthenticated attacker positioned on the same physical or adjacent network segment read critical data and perform limited unauthorized updates, inserts, or deletes. The CVSS 3.1 score is 5.9 (AV:A/AC:H/PR:N/UI:N/C:H/I:L/A:N): no credentials or user interaction are required, but exploitation depends on non-deterministic conditions and local-segment access, so arbitrary internet attackers are not realistically exposed. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, making this a moderate rather than high priority.
Unauthenticated, network-reachable HTTP attackers can obtain unauthorized read access to critical data in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 via a flaw in the Enterprise Infrastructure SEC component. Oracle scores it 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) in the October 2026 Critical Patch Update, explicitly rating it difficult to exploit and confining impact to confidentiality, with no effect on integrity or availability. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; EPSS scoring was not supplied in the source data.
Denial of service plus limited data tampering in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5: a low-privileged authenticated attacker who can reach the JDENET service over the network can hang or repeatedly crash the application (Availability impact rated High) while also reading and modifying a subset of the data it exposes. Oracle classifies the flaw as difficult to exploit (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, base score 6.4), meaning success depends on specific timing or server-state conditions rather than a single crafted request, and a valid account is required. No public exploit code or confirmed active exploitation has been identified at time of analysis, so this is a normal-CPU-cycle remediation rather than an emergency.
Oracle JD Edwards EnterpriseOne Tools (component: Enterprise Infrastructure SEC) versions 9.2.0.0 through 9.2.26.5 can be driven into a persistent hang or repeatable crash through the JDENET protocol, while also exposing a limited slice of application data to unauthorized read and modification. The attack is network-reachable but rated high complexity and requires an existing low-privilege account, so it is a constrained, moderate-severity (CVSS 6.4) issue rather than an easily triggered remote takeover; no public exploit code exists and there is no confirmed active exploitation (not in CISA KEV) at time of analysis. Impact concentrates on availability, with secondary confidentiality and integrity effects.
Local information disclosure in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 lets a low-privileged user who can log on to the host read critical data or all EnterpriseOne data accessible through the Installation Security component. The flaw is confidentiality-only, requires authenticated local access, and does not allow remote unauthenticated compromise or modification of data. No public exploit was identified at time of analysis, and EPSS data was not supplied; overall risk is moderate rather than high priority.
Privilege escalation and takeover within the Package Build SEC component of Oracle JD Edwards EnterpriseOne Tools (9.2.0.0 through 9.2.26.5) allows a high-privileged user who already holds logon access to the application host to fully compromise the product's confidentiality, integrity and availability. The flaw is rated difficult to exploit (AC:H) and requires both local access and existing high privileges, so realistic exposure is limited to malicious insiders or attackers who have already compromised a privileged account rather than remote or unauthenticated actors. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; vendor remediation is published through Oracle's October 2026 Critical Patch Update.
Local takeover of Oracle JD Edwards EnterpriseOne Tools (9.2.0.0 through 9.2.26.5, E1 Dev Platform Tech component on UNIX) is achievable by an attacker who already holds a low-privileged logon account on the host, but only if a separate user performs a triggering interaction and difficult-to-satisfy conditions are met (CVSS 3.1 base 6.7, AV:L/AC:H/PR:L/UI:R). Successful exploitation gives high confidentiality, integrity and availability impact within the Tools product, effectively handing the attacker control of the platform from an already-established local foothold. Oracle addressed the flaw in its October 2026 Critical Patch Update; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the local-access, authentication and victim-interaction prerequisites substantially limit real-world exposure.
Authenticated low-privilege users with interactive logon to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can exploit a flaw in the Enterprise Infrastructure SEC component to gain unauthorized read and write access to critical application data, scoring CVSS 6.3 with high confidentiality and integrity impact but no availability impact. Exploitation is local only (AV:L) and rated high complexity (AC:H), meaning an attacker must already hold a valid account on the infrastructure host and satisfy additional non-default conditions or timing before the weakness can be reliably triggered. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no CISA KEV listing applies.
JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can allow a low-privileged attacker who already has local logon to the hosting infrastructure to compromise the Enterprise Infrastructure SEC component, including reading and modifying critical EnterpriseOne data. The CVSS 3.1 score is 6.3 with AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, so exploitation is local, requires an authenticated low-privileged account, and depends on difficult-to-control preconditions rather than network reachability. This is a moderate-priority issue rather than an emergency: no public exploit code or CISA KEV entry was identified at time of analysis.
Oracle JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 contain a difficult-to-exploit flaw in the Enterprise Infrastructure SEC component reachable over SMTP, allowing unauthenticated network attackers to make limited unauthorized data changes and cause a partial denial of service. Oracle assigns CVSS 3.1 base score 4.8 with high attack complexity and no confidentiality impact; no public exploit identified at time of analysis. Exposure is limited to deployments that expose or process attacker-reachable SMTP traffic under the specific conditions Oracle describes as difficult.
Denial of service in Oracle VM VirtualBox 7.2.16 can be triggered by a low-privileged user who already has local logon access to the host running VirtualBox. Exploitation is rated difficult and requires a specific non-trivial condition in the Core component, but a successful attack can crash or repeatedly hang VirtualBox and, because of the scope change, may affect other products on the same infrastructure. No public exploit was identified at time of analysis, and impact is limited to availability.
Local low-privileged users on hosts running Oracle VM VirtualBox 7.2.16 can cause a complete denial of service-hang or frequently repeatable crash-of the VirtualBox Core component, with scope change potentially affecting other host products, but only when a second user performs a triggering action. This moderate-severity flaw requires local logon and human interaction, is not remotely reachable, and affects availability only; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated attackers with HTTP network access to the Content Server component of Oracle WebCenter Content can induce a targeted user to perform an interaction that grants limited unauthorized read and insert/update/delete access to application data, with scope change potentially extending impact to connected products. The issue affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 6.1; no public exploit code or CISA KEV confirmation was identified at time of analysis, and the required victim interaction makes automated mass exploitation impractical.
Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allow authenticated low-privilege users to read confidential Content Server data over HTTP, with CVSS 3.1 base score 6.5 reflecting high confidentiality impact and no integrity or availability effect. Exploitation requires a valid low-privilege account plus network access to the Content Server component; no user interaction or special configuration is indicated. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Local privilege escalation in Oracle Communications Billing and Revenue Management can let an attacker who already holds high-privileged host access compromise the Platform component, affecting versions 15.0.0.0.0 through 15.2.0.0.0. The CVSS 3.1 score is 6.7 with AV:L/PR:H, so the main barrier is the requirement for a high-privileged local logon rather than network reachability; no public exploit was identified at time of analysis.
Information disclosure in the Indian Payroll component of Oracle HRMS (India) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker who already holds a valid logon on the infrastructure host read critical data, with the scope of the compromise extending beyond the vulnerable component to additional products. The vector is local and authenticated (AV:L, PR:L, UI:N, AC:L), so a foothold or internal credentials are a prerequisite, and impact is confined to confidentiality (C:H with no integrity or availability effect), giving a CVSS 3.1 base score of 6.5. No public exploit code and no CISA KEV entry were identified at time of analysis, and the attack surface is further narrowed to organizations that actually run the India payroll localization.
Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) expose a flaw in the Security component that lets a network-reachable, unauthenticated attacker achieve partial read and partial modify access to data accessible through those APIs, with no availability impact. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, score 6.5), exploitation requires no privileges and no user interaction, but the JVM must actually process attacker-influenced input through the affected APIs - typically a web service that supplies data to them - or, in the legacy client case, run untrusted code inside a sandboxed Java Web Start application or applet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical attack surface is narrower than the score implies because Java Web Start and the browser applet plugin are absent from modern JDKs.
Oracle Java SE 8u503 and 8u503-perf, along with Oracle GraalVM Enterprise Edition 21.3.19.1.1, contain a difficult-to-exploit RMI flaw that unauthenticated network attackers can trigger only by supplying crafted data to the affected RMI APIs, such as through a web service; applet and Java Web Start paths are explicitly excluded. Successful exploitation yields limited confidentiality and integrity impact with scope change but no availability impact, consistent with CVSS 5.4 (AC:H). No public exploit was identified at time of analysis, and the high complexity and narrow input path keep priority moderate rather than emergency.
A limited-integrity flaw in the Networking component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows a remote, unauthenticated attacker to make unauthorized updates, inserts, or deletions to some data, provided they can supply malicious input to the affected networking APIs. Oracle rates exploitation as difficult (CVSS AC:H, 3.7 base score), with no confidentiality or availability impact; the realistic exposure paths are web services that pass attacker-controlled data into these APIs and sandboxed Java Web Start/applet deployments running untrusted internet code. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV, so it is a low-priority patch item rather than an emergency.
Oracle Java SE Networking component exposes a read-only information disclosure in versions 21.0.12.1, 25.0.4.1, and 27, where crafted data supplied to affected Networking APIs can leak a subset of JVM-accessible data. Unauthenticated remote attackers need only network reachability to an application that forwards untrusted input into those APIs, with no user interaction and low attack complexity (CVSS 3.1: 5.3, AV:N/AC:L/PR:N/UI:N/C:L). No public exploit and no confirmed active exploitation were identified at time of analysis; the practical risk is bounded by whether a deployed service actually exposes the vulnerable Networking code path.
Oracle Java SE and GraalVM JDK/Enterprise distributions can expose confidential data when JAXP processes attacker-supplied XML, with the most realistic path being services that feed untrusted data into XML APIs. The flaw affects specific Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27 releases plus listed GraalVM versions, and is difficult to exploit (AC:H) with confidentiality-only impact. No public exploit was identified at time of analysis, and patch availability is documented through Oracle's October 2026 Critical Patch Update advisory.
Unauthorized read access to a limited subset of Java SE-accessible data is exposed in Oracle Java SE 25.0.4.1 and 27 through the Compiler component when attacker-controlled data is supplied to its APIs, such as through a web service that feeds external input into the compiler. The vector is network-reachable and requires no authentication or user interaction, but Oracle rates attack complexity as high and impact as confidentiality-only and low (CVSS 3.1 base 3.7); no public exploit was identified at time of analysis and no KEV entry is associated.
High-privileged attackers with network access to PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit a high-complexity flaw in the Multichannel Framework component to take over the affected PeopleTools instance, with full confidentiality, integrity, and availability impact. The vulnerability requires an authenticated account with high privileges and specific exploit conditions, so it is not reachable by anonymous remote users. No public exploit code or active exploitation is identified at time of analysis.
Local privilege-abuse in Oracle Communications Billing and Revenue Management (BRM) 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0 lets an attacker who already holds a high-privileged logon on the BRM host fully compromise the application, with high confidentiality, integrity and availability impact and unchanged scope (CVSS 3.1 base 6.7). The attack is not network-reachable and requires no user interaction once the privileged host foothold exists, so the realistic threat population is insiders, compromised administrator accounts, or an adversary who has already escalated on the underlying infrastructure. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; severity is driven by the value of the BRM platform rather than by ease of remote access.
Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 contain a moderate-severity flaw in the OIM Legacy UI that can allow an unauthenticated network attacker to read a subset of OIM data and update, insert, or delete some OIM-accessible data if a victim user is induced to interact with attacker-supplied content. The CVSS 3.1 base score is 6.1, with scope change indicating possible impact beyond OIM itself, but the UI:R requirement means exploitation depends on user action and is not silent or automatic at scale. No public exploit identified at time of analysis.
A reachable JAXP (Java API for XML Processing) parsing path in Oracle Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, plus GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1, can be driven by crafted XML to degrade availability, yielding a partial denial of service (CVSS 5.3, AV:N/AC:L/PR:N/UI:N, A:L only). Exploitation is bounded by reachability: it requires that the target expose a JAXP-backed interface to attacker-supplied XML, such as a web service, REST/SOAP endpoint, or any component parsing externally sourced documents with the JDK's default XML stack. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the issue carries no confidentiality or integrity impact - this is a moderate, availability-only flaw that does not warrant emergency out-of-band patching.
Oracle Java SE, together with the GraalVM for JDK and GraalVM Enterprise Edition distributions, contains a Networking component vulnerability that allows unauthenticated network attackers to make limited unauthorized changes to accessible data and to cause a partial denial of service, without any confidentiality loss or code execution. The affected builds are Java SE 8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, GraalVM for JDK 17.0.20.1 and 21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1. No public exploit code or confirmed active exploitation is identified at time of analysis; practical risk is concentrated in services that pass attacker-controlled data into the affected networking APIs and in legacy sandboxed applet or Web Start deployments.
Unauthorized access to critical data in Oracle Demand Planning 12.1 and 12.2 requires a low-privileged authenticated attacker and a separate victim's interaction, yet successful exploitation can cross scope boundaries and expose data in connected Oracle Supply Chain products. The issue is scored CVSS 3.1 6.8 with confidentiality-only impact; no public exploit identified at time of analysis and no confirmed active exploitation was reported in the provided intelligence. Realistic risk is social-engineering-assisted data disclosure against logged-in users rather than autonomous compromise.
Low-privileged authenticated users of Oracle E-Business Suite 12.2.3 through 12.2.15 can read a limited subset of Oracle Applications Manager Diagnostics data over HTTP, with no integrity or availability impact. The assessed vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) and Oracle's 'difficult to exploit' rating mean an attacker needs a valid low-privileged account plus additional preconditions, keeping realistic risk low. No public exploit code was identified at time of analysis.
Oracle HRMS (US) Payroll Year End, as shipped in Oracle E-Business Suite 12.2.3 through 12.2.15, exposes a moderate-severity HTTP-reachable flaw that a low-privileged authenticated attacker can exploit only if a different user is induced to view or process attacker-supplied data. Successful exploitation can yield limited unauthorized read access plus insert/update/delete changes within HRMS (US) and may affect additional products through scope change, with no availability impact; no public exploit was identified at time of analysis. The assessed CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Limited data disclosure and partial denial of service in Oracle Applications Manager (Oracle E-Business Suite) allow a low-privileged authenticated attacker with HTTP network access to the Diagnostics component to read a subset of accessible data and degrade availability. Affected releases are 12.2.3 through 12.2.15; Oracle rates exploitation as difficult (AC:H) and the CVSS 3.1 score is 4.2, so this is a low-priority issue. No public exploit code or CISA KEV entry is identified in the supplied intelligence.
A moderately severe flaw in Oracle HRMS (UK), a module of Oracle E-Business Suite, lets a low-privileged authenticated user with HTTP network access manipulate content that a separate victim must interact with, ultimately granting unauthorized read and limited write access to HRMS (UK) data and potentially affecting other EBS components due to a scope change. Versions 12.2.3 through 12.2.15 are affected; no public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score is 5.4. Successful abuse hinges on two prerequisites: a valid low-privilege account and a second user's interaction, which curbs automated mass exploitation.
Limited read-only data exposure in Oracle Applications Manager (the Diagnostics component of Oracle E-Business Suite 12.2.3 through 12.2.15) is reachable over HTTP but only by an attacker who already holds a high-privileged OAM account, and exploitation additionally depends on conditions outside the attacker's control (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N, base score 2.2). Successful abuse yields unauthorized read access to a subset of OAM-accessible data with no integrity or availability impact and no unauthenticated path. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the high privilege prerequisite and high attack complexity keep realistic risk well below what the network vector alone suggests.