Oracle
Monthly
Information disclosure in the JDBC component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition (CVSS 3.1 base 5.9) lets an unauthenticated network attacker who can get attacker-influenced data into the affected JDBC APIs read critical data that the Java process can access; there is no integrity or availability impact. Exploitation is explicitly rated difficult (AC:H) and depends on non-trivial preconditions, chiefly a service that feeds untrusted input to those APIs or a sandboxed Java Web Start/applet client running untrusted code. No public exploit code was identified at time of analysis, and the issue was disclosed through the Oracle Critical Patch Update of October 2026 covering Java SE 8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, GraalVM for JDK 17.0.20.1/21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1.
Oracle HRMS (US) 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker with HTTP network access to the Internal Operations component to read critical HR data without user interaction. The assessed CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact only, and no public exploit has been identified at time of analysis. This moderate-risk issue warrants normal Oracle Critical Patch Update cadence rather than emergency response.
Unauthorized read access to HR data in Oracle HRMS (US) 12.2.3 through 12.2.15 is possible through an access-control weakness in the Internal Operations component of Oracle E-Business Suite, allowing a low-privileged authenticated user with HTTP network reach to retrieve records well beyond their intended authorization scope. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning impact is confined to confidentiality - no data modification or service disruption - and exploitation still requires valid credentials, which is the primary limiting factor. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not available in the supplied intelligence, so it should be treated as a moderate-priority patching item rather than an emergency.
Unauthorized access to critical Oracle HRMS (US) data is possible for low-privileged authenticated attackers who can reach the Internal Operations component over HTTP in Oracle E-Business Suite 12.2.3 through 12.2.15. Successful exploitation yields high confidentiality impact only, with no integrity or availability effect, and requires a valid EBS account but no user interaction and low attack complexity. At time of analysis, no public exploit identified, and no KEV or EPSS data was provided.
Low-privileged Oracle E-Business Suite users can read critical HRMS (US) data through the Internal Operations component, a confidentiality-only exposure reachable over HTTP. Oracle HRMS (US) releases 12.2.3 through 12.2.15 are affected by this easily exploited flaw (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), meaning any valid authenticated EBS account can trigger it against a default configuration without user interaction. No public exploit code and no CISA KEV listing were identified at time of analysis, so the practical barrier remains obtaining valid EBS credentials - the attacker pool is limited to credentialed insiders or someone who has already compromised an account, and no data modification or service disruption is possible.
Oracle Report Manager, a component of Oracle E-Business Suite (Internal Operations), exposes a subset of its data to unauthorized reading by a low-privileged, authenticated user who can reach the application over HTTPS. Versions 12.2.3 through 12.2.15 are affected; no public exploit code or confirmed active exploitation was identified at the time of analysis, and the CVSS 3.1 score of 4.3 reflects confidentiality-only impact with no integrity or availability effect. Because exploitation requires valid low-privileged credentials (PR:L) and low attack complexity with no user interaction, the practical risk is concentrated in environments where many low-trust accounts exist or where account provisioning is loosely controlled.
Partial data disclosure and unauthorized modification in Oracle Java SE (8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27), plus Oracle GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1, stem from a flaw in the 'Security' component that becomes reachable when an application or web service passes attacker-supplied data into those APIs, or when sandboxed Java Web Start/applet deployments execute untrusted code and rely on the Java sandbox for isolation. Network attackers need no credentials (PR:N) and no user interaction (UI:N), but High attack complexity (AC:H) means success depends on conditions the attacker cannot directly control, so exploitation is unreliable; impact is confined to partial read and partial modify of a subset of Java-accessible data with no availability effect (CVSS 3.1 base 4.8, MEDIUM). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated remote access to JAAS APIs in specific Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition releases can disclose a limited subset of accessible data; the issue is rated CVSS 3.1 base 5.3 with confidentiality-only impact. Affected builds are Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, GraalVM for JDK 17.0.20.1 and 21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1. Exploitation requires reachable JAAS APIs that process attacker-supplied data, with a narrower legacy path through sandboxed Web Start or applet code; no public exploit was identified at time of analysis.
Unauthorized data modification and limited information disclosure in Oracle Java SE (21.0.12.1, 25.0.4.1, and 27) occur when attacker-supplied data reaches the APIs of the Compiler component through a network-facing service. Rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), the flaw is unauthenticated and needs no user interaction, but Oracle explicitly scopes reachability to applications that pass untrusted data into the Compiler APIs directly - not via Java Web Start or applets - and the high attack complexity means success depends on conditions the attacker does not fully control. No public exploit code or confirmed active exploitation was identified at time of analysis.
A moderate-severity flaw (CVSS 3.1 base 5.4, MEDIUM) in the Mobile Applications component of Oracle HRMS (US) within Oracle E-Business Suite, disclosed in the October 2026 Critical Patch Update, lets a low-privileged authenticated attacker who persuades another user to interact with attacker-controlled content alter or delete some HRMS data and read a limited subset of it, with scope change extending impact to other products. Deployments running E-Business Suite 12.2.3 through 12.2.15 are affected; exploitation requires network access over HTTP, valid low-privilege credentials, and victim interaction, so the attacker cannot succeed alone. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Integrity-only data modification in Oracle Java SE's JSSE TLS component can be triggered by unauthenticated network attackers who can supply data to affected TLS-processing APIs, although exploitation is rated difficult and limited to low-integrity impact. Affected deployments include Java SE 8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, along with GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1; the 3.7 CVSS score and lack of public exploit code make this a low-priority issue, with client-side risk concentrated in sandboxed Java Web Start and applet deployments.
Authenticated high-privileged users of Oracle PeopleSoft Enterprise HCM Human Resources 9.2 can abuse the Administer Workforce component over HTTP to create, delete, or modify critical HR data, read a subset of otherwise restricted records, and force repeatable hangs or crashes of the application. Exploitation is constrained by three factors drawn from the CVSS vector - a high-privileged account (PR:H), interaction by a separate victim user (UI:R), and Oracle's own assessment that the flaw is difficult to exploit (AC:H) - which together point to insider or post-compromise misuse rather than opportunistic remote attack. There is no public exploit code identified at time of analysis and the issue is not in CISA KEV; the vendor-reported severity is 6.0, and independent assessment rates real-world urgency as low.
A high-complexity integrity flaw in the Security component of Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) lets a remote attacker who can feed untrusted data into the affected Security APIs create, delete or modify critical data, though the attacker gains no data disclosure or denial of service (CVSS 3.1 5.9, AV:N/AC:H/PR:N/UI:N/C:N/I:H/A:N). The primary server-side path requires an application that passes externally supplied data into those APIs, such as a web service; a secondary path affects deployments that rely on the Java sandbox to run untrusted Java Web Start applications or applets. Exploitation is rated difficult (AC:H) and no public exploit code or KEV listing was reported at time of analysis, so the practical risk is concentrated in applications that expose the vulnerable Security APIs to attacker-controlled input.
Low-severity confidentiality exposure in the Oracle PeopleSoft PeopleTools Portal component (versions 8.61 through 8.63) requires an authenticated, low-privileged attacker with HTTP network access and a separate victim's interaction to read a limited subset of application data. Oracle rates the attack as difficult (AC:H), and the mandatory authentication (PR:L), required second-party interaction (UI:R), and scope change (S:C) sharply limit realistic exploitation. No public exploit was identified at time of analysis, and the issue is not known to be actively exploited.
A moderate-severity flaw (CVSS 3.1 base 5.4) in the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a low-privileged, network-positioned attacker who already holds a valid account inject content that a second user must then view or interact with, yielding limited unauthorized read and limited insert/update/delete access to PeopleTools data; the scope change flag means the impact can spill into the victim's session and other integrated products. There is no public exploit code and no confirmed active exploitation at time of analysis, and the combination of a required authenticated account plus mandatory victim interaction keeps this out of the mass-exploitation category. Treat it as routine Oracle Critical Patch Update (October 2026) work rather than an emergency.
Low-privileged authenticated users can tamper with and read limited Oracle HRMS (UK) data in Oracle E-Business Suite 12.2.3 through 12.2.15 by convincing another user to interact with crafted HTTP content. The issue is medium severity (CVSS 3.1 base 5.4) and has scope change into other EBS products, but exploitation requires a valid account (PR:L) and victim interaction (UI:R); the 'Authentication Bypass' tag is not supported by the assessed vector. No public exploit was identified at time of analysis and no KEV entry is present in the provided data.
Oracle HRMS (Republic of Korea) payroll localization for E-Business Suite 12.2.3 through 12.2.15 permits a low-privileged, network-positioned attacker with a valid EBS account to read sensitive data beyond their intended authorization scope through the Korean Payroll component, yielding a high confidentiality impact with no integrity or availability effect (CVSS 6.5). Exploitation requires only low-privileged authenticated HTTP access, no user interaction, and low attack complexity, but is practically gated by whether an organization actually deploys the Korea-specific payroll localization outside South Korean deployments. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS-style risk is tempered by the module's narrow deployment footprint.
Oracle HRMS (India) Indian Payroll, as shipped with Oracle E-Business Suite 12.2.3 through 12.2.15, exposes a low-complexity HTTP-reachable path that lets a low-privileged authenticated user read data well beyond their intended scope, up to everything the HRMS (India) schema surfaces. The flaw is a confidentiality-only issue (CVSS 6.5, C:H/I:N/A:N) gated behind a valid EBS account (PR:L) with no user interaction required, which keeps unauthenticated external attackers out of reach. No public exploit code or confirmed active exploitation was identified at time of analysis, and the risk is best characterized as a moderate-priority authenticated information-disclosure problem concentrated in tenants that hand low-privilege EBS accounts to untrusted populations.
Unauthorized read access to critical HR data in Oracle HRMS (Norway) is possible for a low-privileged authenticated attacker who can reach the Internal Operations component over HTTP. The flaw affects Oracle E-Business Suite 12.2.3 through 12.2.15 deployments that include the Norwegian HRMS localization, and successful exploitation yields high confidentiality impact without integrity or availability effects. No public exploit was identified at the time of analysis, and the CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Authenticated information disclosure in the Product Diagnostic Tools component of Oracle Order Management (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged user reach data they should not see over plain HTTP, with no user interaction and low attack complexity. Because the CVSS vector carries PR:L with C:H and no integrity or availability impact, the practical outcome is read-only exposure of critical application data rather than tampering or denial of service - the authentication requirement is the main barrier an outside attacker must clear. Oracle addressed the flaw in its October 2026 Critical Patch Update; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Oracle Database Server 19.3 through 19.32 and 21.3 through 21.23 allow a high-privileged database principal holding the Query Optimizer privilege to read a limited subset of RDBMS data it should not be able to access over Oracle Net. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, base score 2.7) means the attacker must already be an authenticated, privileged account on the target instance, so the realistic threat population is insiders or holders of compromised privileged credentials rather than anonymous remote attackers, and there is no integrity or availability impact. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; fixes are delivered through Oracle's October 2026 Critical Patch Update.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 exposes an Integration Broker flaw that allows an unauthenticated attacker with network access over HTTP to influence data the application handles, with successful exploitation depending on inducing a legitimate user to interact with a crafted request and on conditions Oracle itself characterizes as difficult to arrange. Impact is partial - limited unauthorized read plus some unauthorized update, insert, or delete capability within PeopleTools-accessible data - with no availability effect, and because of the scope change the blast radius may extend to additional connected products; both confidentiality and integrity impacts are rated Low. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS-style risk is correspondingly modest: this is a low-to-moderate real-world priority despite network reachability, warranting patching on a normal cycle rather than emergency response.
An authenticated low-privileged user with HTTP access to the eProcurement component of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 can manipulate or expose data the account should not control, chiefly through unauthorized creation, deletion, or modification of critical records, with a smaller confidentiality spill. Exploitation is rated difficult (AC:H) because success depends on application state or configuration outside the attacker's direct control, and the Argentina financial localization must actually be deployed - so this is a moderate-risk issue unlikely to be a top-priority emergency, with no public exploit identified at time of analysis. Integrity impact is the dominant concern (I:H) while availability is unaffected (A:N).
High-privileged local users can corrupt critical data or repeatedly crash PeopleSoft PeopleTools 8.61-8.63 through the Updates Environment Mgmt component, with CVSS 3.1 scoring 6.0 for integrity and availability impact. Exploitation requires logon to the infrastructure hosting PeopleTools and pre-existing high privileges, so realistic exposure is limited to trusted insiders or attackers who have already escalated on the host. No public exploit identified at time of analysis, and no CISA KEV entry is associated with this CVE in the provided data.
Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 can expose a limited subset of application data to a high-privileged attacker who already has interactive logon access to the host running the product, specifically through the Open Query component. The assessed CVSS 3.1 score is 1.9 (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N), reflecting a local, high-complexity, privileged-only path with confidentiality impact limited to a subset of accessible data. No public exploit has been identified at time of analysis, and this is a low-priority issue best treated as an insider or post-compromise data-exposure risk rather than a remotely exploitable breach.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 carries a low-severity flaw in the Data Mover component that lets an attacker who already holds high privileges and a valid logon on the PeopleTools host - and who can induce a second, different user to perform an action - read and modify a limited subset of PeopleSoft data and trigger a partial denial of service. Oracle's October 2026 Critical Patch Update scores it CVSS 3.1 3.8 (AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) and explicitly calls it difficult to exploit, so realistic exposure is an insider or post-compromise scenario rather than opportunistic attack; no public exploit code or confirmed active exploitation was identified at time of analysis.
Adjacent-network attackers who already hold high privileges can achieve full takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 through the Push Notifications component, gaining complete confidentiality, integrity and availability impact (CVSS 3.1 base 6.8, MEDIUM). The flaw is easily triggered once an attacker sits on the physical or adjacent communication segment attached to the PeopleTools host and no end-user action is required, but the AV:A and PR:H prerequisites keep real-world exposure well below the headline 'takeover' severity. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update.
Information disclosure in the Search Framework component of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 allows an unauthenticated attacker who already has a foothold on the physical/adjacent network segment hosting the PeopleSoft instance to read critical application data. The CVSS 3.1 score is 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting a confidentiality-only impact that requires adjacent-network positioning and conditions outside the attacker's direct control (high attack complexity), so the flaw is not reachable from the routable internet. No public exploit code was identified at time of analysis, there is no CISA KEV listing, and no EPSS score was supplied; despite the 'Authentication Bypass' tag in the source feed, the practical risk is moderate and not an urgent priority.
High-privileged attackers with HTTP access to PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Meta Data component to read critical application data and cause a hang or repeatable crash, producing high confidentiality and availability impact. The issue is rated CVSS 3.1 6.5 and requires an already high-privileged PeopleSoft account (PR:H), so exploitation is realistic mainly for trusted insiders or attackers who already hold privileged credentials. No public exploit code or CISA KEV entry was identified at time of analysis.
PeopleSoft Enterprise PeopleTools 8.61 and 8.62 expose the Process Scheduler component to a low-privileged attacker with HTTP network access who can persuade a separate user to interact with crafted content, resulting in limited read and write access to PeopleTools data and possible impact on connected products through scope change. The assessed CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N for a base score of 4.4, so this is not an unauthenticated autonomous attack: it requires a valid low-privileged account, victim interaction, and high-complexity conditions. Supplied intelligence shows no CISA KEV active exploitation and no public exploit identified at time of analysis; Oracle's October 2026 CPU advisory is the vendor reference.
Limited confidentiality and integrity compromise in PeopleSoft Enterprise PeopleTools 8.62 Search Framework requires a victim to interact with attacker-supplied content before unauthenticated network attackers can read or modify a subset of application data. The issue is rated difficult to exploit (AC:H) and does not affect availability; no public exploit code has been identified at time of analysis. The supplied intelligence does not report active exploitation in CISA KEV.
Low-privileged, authenticated users of PeopleSoft Enterprise PeopleTools 8.61 and 8.62 can exploit the Portal component over HTTP to read a limited portion of accessible data and trigger a partial denial of service, but successful exploitation is difficult because it depends on conditions outside the attacker's direct control (AC:H). The vulnerability requires valid low-privileged credentials and network access; it does not permit integrity modification or full availability loss, and scope remains unchanged. No public exploit has been identified at time of analysis, and no EPSS or KEV data was provided in the intelligence.
Authenticated low-privileged users of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Application Data Sets component over HTTP to modify or delete critical application data and to cause repeated hangs or crashes, producing high integrity and availability impact. The CVSS 3.1 score is 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H), and Oracle characterizes the issue as difficult to exploit, so reliable exploitation depends on non-default or attacker-uncontrollable conditions beyond a valid account. This is a moderate-priority issue rather than an emergency, and no public exploit identified at time of analysis.
PeopleSoft Enterprise PeopleTools 8.61 and 8.62 contain a flaw in the Query component that a high-privileged, authenticated attacker can reach over HTTP to cause repeatable denial of service and limited unauthorized data reads or modifications. Oracle rates it CVSS 3.1 5.5 with high attack complexity and high privileges required, and no public exploit identified at time of analysis.
Unauthenticated network attackers can achieve limited unauthorized update, insert, or delete access to data in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by targeting the Application Server - JRE component over SSH, but Oracle rates exploitation as difficult (AC:H). The issue is low severity (CVSS 3.7) with integrity-only impact and no confidentiality or availability effect; no public exploit code or CISA KEV active exploitation is identified in the provided data.
Local, already high-privileged users on servers running Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 can abuse the Business Interlink component to gain partial read access and partial insert/update/delete capability over PeopleTools data, plus a partial denial-of-service condition against the PeopleTools process itself. Exploitation is gated by several preconditions - an interactive logon to the host (AV:L), high privileges on that host (PR:H), and attack complexity Oracle characterizes as 'difficult to exploit' (AC:H) - so this is a limited post-compromise or insider-abuse scenario rather than a remotely reachable flaw. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the 3.9 CVSS base score and the tightly capped Low/Low/Low impact reflect that an attacker must already control the underlying infrastructure to benefit.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 contains a WebLogic-component weakness that allows an unauthenticated attacker with access to the physical communication segment to achieve limited unauthorized read and write access to some PeopleTools data. Exploitation is Oracle-rated difficult and depends on race or protocol-state conditions outside the attacker's control, so the 4.2 MEDIUM score reflects low-to-moderate practical risk. Available intelligence did not identify public exploit code or confirmed active exploitation, and no CISA KEV entry or EPSS score was supplied.
Oracle Order Management in Oracle E-Business Suite 12.2.3 through 12.2.15 can expose critical application data through a high-complexity authenticated flaw in its Product Diagnostic Tools component. A network attacker holding a low-privileged account can use HTTP to read critical data and make limited unauthorized updates, inserts, or deletions, but successful exploitation depends on conditions outside the attacker's direct control. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Sensitive data exposure in PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a high-privileged attacker with local logon to the application-server host to read critical PeopleSoft data via the Application Server - JRE component. The CVSS 3.1 score is 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), and no public exploit code or confirmed active exploitation is identified in the supplied intelligence.
Authentication bypass in the WebLogic component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets unauthenticated, network-positioned attackers read critical application data and make limited unauthorized data changes over TLS. Oracle classifies the issue as difficult to exploit (CVSS AC:H), meaning success hinges on specific server state or configuration conditions rather than a single reliable request. No public exploit identified at time of analysis; the vendor advisory is Oracle's October 2026 Critical Patch Update.
Unauthenticated HTTP requests to the PeopleSoft Enterprise PeopleTools Web Server component in versions 8.61 through 8.63 can return a subset of PeopleTools-accessible data that the requester should not be able to read, so internet- or intranet-exposed PeopleSoft portals are directly at risk. Oracle scored it CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N): no credentials, no user interaction and no special configuration are needed, but the impact is confidentiality-only - no data modification and no availability effect - and the scope change means exposed data may extend beyond PeopleTools into connected products. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available intelligence.
Low-privileged local users on Oracle Solaris 11.4 can abuse the X Window System component to modify or delete some accessible data, read a subset of Solaris data, and cause a partial denial of service. The CVSS 3.1 score is 5.3 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, so an attacker must already hold a valid interactive login on the host, no victim interaction is required, and the issue cannot be reached remotely. No public exploit has been identified at time of analysis, and exposure is limited to Solaris 11.4 systems where an attacker already has a local account.
Path traversal in the djust MCP server's find_handlers_for_template tool (affected versions 0.9.0 through before 1.0.10, 1.1.x before 1.1.7, 1.2.x before 1.2.4, and 1.3.0.dev before 1.3.0rc8) allows a local MCP client to supply an arbitrary absolute template_path, which the tool reads without confining resolution to the project or configured template directories. Rather than full file disclosure, the tool acts as a file existence/readability oracle and leaks only substrings matching the dj-click, dj-submit, dj-change, dj-input, dj-keydown, or dj-keyup attribute pattern - a narrow, pattern-filtered exposure reflected in the low CVSS 3.3 score (AV:L/PR:L, C:L only). Exploitation requires an already-connected local stdio MCP session running as the same OS user with no network listener, so the attacker effectively already holds the victim's privileges; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Sensitive-data exposure in Oracle Order Management 12.2.3 through 12.2.15 lets a low-privileged authenticated user read critical or all Order Management-accessible data through the Product Diagnostic Tools component. The CVSS 6.5 rating reflects a network-reachable, low-complexity flaw with high confidentiality impact and no integrity or availability effect, gated by the need for a valid low-privileged EBS account (PR:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and this is assessed as a moderate-priority issue.
Oracle Order Management 12.2.3 through 12.2.15 can expose critical business data to an authenticated low-privilege user through the Product Diagnostic Tools component, yielding read-only confidentiality impact with a CVSS 3.1 base score of 6.5. The attacker needs network HTTP access and valid low-privilege EBS credentials, and no public exploit code was identified at time of analysis; no CISA KEV entry was provided.
Authenticated low-privilege users of Oracle Product Hub 12.2.3 through 12.2.15 can exploit the Internal Operations component over HTTP to read critical Product Hub data without modifying it or causing denial of service. The CVSS 3.1 score is 6.5 with a confidentiality-only impact, and exploitation requires a valid low-privilege account rather than anonymous access. No public exploit code was identified at time of analysis, and no CISA KEV status is indicated in the supplied data.
Reflected cross-site scripting in the HTML UI component of Oracle E-Business Suite's Installed Base module (versions 12.2.3 through 12.2.15) lets an unauthenticated remote attacker deliver a crafted HTTP request or link that executes in a victim's session once that user interacts with it. Because the vector carries scope change (S:C) with low confidentiality and integrity impact, a successful attack can read and modify a subset of Installed Base data and potentially affect other EBS products sharing the session context; there is no availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation depends on social-engineering a user into following the crafted link.
Integrity-only tampering in the Oracle Purchasing module of Oracle E-Business Suite (12.2.3 through 12.2.15) lets a low-privileged, authenticated user reach the Internal Operations component over HTTP and, if a separate and typically more privileged user is induced to interact, perform unauthorized updates, inserts, or deletes against a limited subset of Purchasing data. There is no confidentiality or availability impact and the CVSS 3.1 base score is 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N), so both prior authentication and victim interaction are prerequisites - no public exploit identified at time of analysis, and no CISA KEV listing. This is a genuinely low-priority issue despite being network-exploitable, and the practical risk is concentrated in environments where low-privileged Purchasing accounts are widely distributed or weakly governed.
Oracle Purchasing 12.2.3 through 12.2.15 contains an integrity-only flaw in the Internal Operations component of Oracle E-Business Suite. A low-privileged authenticated attacker with HTTP network access could manipulate some accessible purchasing data, but the high attack complexity and limited integrity impact keep real-world risk low. No public exploit code or confirmed active exploitation was identified at time of analysis.
Limited data disclosure in Oracle Concurrent Processing (Oracle E-Business Suite 12.2.3 through 12.2.15) allows an authenticated low-privileged attacker with HTTP access to read a subset of Concurrent Requests data. The CVSS 3.1 score is 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting high attack complexity and no integrity or availability impact; no public exploit identified at time of analysis.
Local, low-privileged users with logon access to hosts running Oracle E-Business Suite Production Scheduling 12.2.3 through 12.2.15 can update, insert, or delete some Production Scheduling data, read a subset of that data, and cause a partial denial of service. The CVSS 3.1 score is 4.5 with AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, meaning exploitation requires an existing local authenticated foothold and depends on high-complexity conditions outside the attacker's direct control. No public exploit was identified at time of analysis, EPSS was not provided, and there is no CISA KEV confirmation of active exploitation.
Oracle E-Business Suite iSupplier Portal 12.2.3 through 12.2.15 contains a confidentiality-only flaw in the Internal Operations component that lets a low-privileged, authenticated attacker with HTTP network access read critical data or all data accessible through the portal. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no integrity or availability impact; the main barrier is obtaining a valid supplier or portal credential. No public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated information disclosure in Oracle Order Management 12.2.3 through 12.2.15 allows low-privilege users with network HTTP access to read critical data exposed by the Product Diagnostic Tools component. The CVSS 3.1 score is 6.5 with PR:L, AC:L, UI:N, and only confidentiality impact (C:H/I:N/A:N), so an attacker must already hold valid E-Business Suite credentials and cannot modify or disrupt the service through this issue. No public exploit identified at time of analysis, and no KEV or EPSS data was supplied.
Sensitive-data disclosure in the MWA Terminal Server component of Oracle Mobile Application Server (part of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged authenticated user reach data they should not be able to read, potentially including all information accessible to the component. Exploitation requires a valid EBS account plus network access to the MWA Terminal Server over HTTP, needs no user interaction, and succeeds with low attack complexity (CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) - confidentiality only, with no integrity or availability impact. The exposure is bounded by the authentication prerequisite and by whether the optional mobile/barcode component is actually deployed and exposed; no public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV), so it is primarily an insider or post-compromise credential-abuse risk addressed in the Oracle Critical Patch Update of October 2026.
Oracle Compensation Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated low-privileged attacker with HTTP network access to read and modify a subset of Total Compensation Statement data, provided a second, different user interacts with attacker-influenced content (UI:R). The CVSS 3.1 base score is 5.4 with a scope change (S:C), meaning successful exploitation may affect resources beyond the vulnerable component; both the required prior authentication (PR:L) and the mandatory victim interaction materially limit real-world exploitation. No public exploit was identified at time of analysis, and this is a moderate-severity issue best handled through the normal Oracle Critical Patch Update cycle rather than emergency response.
Oracle General Ledger within Oracle E-Business Suite 12.2.3 through 12.2.15 can expose critical financial records to an authenticated low-privilege user who can reach the Internal Operations component over HTTP. The flaw scores 6.5 on CVSS 3.1 with confidentiality-only impact (C:H/I:N/A:N), requires a valid PR:L account and no user interaction, and does not affect integrity or availability. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the reference for fixes.
Unauthenticated information disclosure in the Oracle Engineering module (Change Management component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a remote attacker with HTTP reachability to read a limited subset of application data. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning no credentials or user interaction are required, but confidentiality impact is partial and there is no modification or availability effect. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; realistic exposure depends almost entirely on whether the EBS web tier is internet-facing or confined to an internal network. Oracle addresses it in the October 2026 Critical Patch Update.
Authenticated low-privileged users can abuse high-complexity conditions in the LOV component of Oracle Complex Maintenance, Repair and Overhaul (CMRO) 12.2.3 through 12.2.15 to create, delete, modify, or read critical data reachable through CMRO over HTTP. The issue is rated CVSS 3.1 6.8 with high confidentiality and integrity impact but no availability impact, and exploitation requires valid EBS credentials plus attacker-independent conditions that Oracle describes as difficult to exploit. No public exploit identified at time of analysis.
Unauthorized read and limited insert/update/delete access to Oracle Communications Billing and Revenue Management (BRM) Server 15.x data is possible for unauthenticated network attackers via the HTTP interface, though Oracle rates exploitation as difficult (AC:H). The flaw affects BRM Server versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 and carries a CVSS 3.1 base score of 4.8 with only low confidentiality and integrity impact and no availability impact. No public exploit code or CISA KEV entry was identified at time of analysis; this is a normal-cycle patch rather than an emergency.
Oracle MySQL Connector/ODBC 26.7.1 can allow a low-privileged, network-positioned attacker to read and modify connector-accessible data, but only under high-complexity conditions outside the attacker's control (CVSS 3.1 base 6.8, AC:H/PR:L/UI:N). The flaw affects confidentiality and integrity with no availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis.
Oracle Applications Manager, the management and diagnostics console bundled with Oracle E-Business Suite 12.2.3 through 12.2.15, contains an HTTP-reachable weakness in its Diagnostics component that allows a high-privileged attacker to read a limited subset of Applications Manager data and cause a partial denial of service. The CVSS 3.1 base score is 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L), meaning the attacker must already hold an authenticated administrative account on the product and must meet conditions outside their direct control for the attack to succeed. No public exploit code has been identified at time of analysis, and Oracle addresses the issue through its October 2026 Critical Patch Update.
Partial denial of service in Oracle MySQL Connector/ODBC 26.7.1 is reachable only by an attacker who already holds a logon on the same infrastructure where the driver runs, and only when a separate user is induced to interact with the affected component; high attack complexity means the precondition state is hard to arrange reliably. Successful exploitation yields nothing beyond a partial availability impact on the connector itself - no confidentiality or integrity effect - which is why Oracle scored it CVSS 3.1 base 2.5. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS-style risk is correspondingly low.
Authenticated attackers with high database privileges can exploit the Server: XML component in MySQL Server 8.4.x, 9.7.x, and 26.7.x, as well as MySQL Cluster 8.0.x, 8.4.x, 9.7.x, and 26.7.x, over the network to modify or delete critical data and to hang or repeatedly crash the service. The flaw has low attack complexity and requires no user interaction, but the PR:H prerequisite limits practical risk to insiders, compromised privileged accounts, or post-authentication attack chains; confidentiality is not affected. No public exploit code or CISA KEV entry was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster allows a low-privileged authenticated remote attacker to hang or repeatedly crash the database by sending crafted SQL that reaches the Server: Parser component. MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 are affected. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit code or CISA KEV entry is identified in the provided data.
A denial-of-service flaw in the Optimizer component of MySQL Server and MySQL Cluster lets a high-privileged, network-connected database account hang or repeatedly crash the server, with CVSS 3.1 base score 4.9 (availability-only). Affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Exploitation requires an authenticated session using a highly privileged account (PR:H) over MySQL's supported protocols, so the realistic threat is insiders or attackers who already hold privileged credentials; no public exploit code or confirmed active exploitation was identified at time of analysis.
Low-privileged MySQL Server and MySQL Cluster users with network access can potentially gain read and write access to data beyond their intended authorization scope through the Server: Security: Privileges component. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, and Oracle characterizes exploitation as difficult with CVSS 6.8, AC:H, and PR:L. This is a moderate-priority issue, not a top-tier emergency; no public exploit identified at time of analysis, and no CISA KEV entry was present in the supplied intelligence.
Denial of service in Oracle MySQL Server and MySQL Cluster Group Replication allows an unauthenticated attacker on the same Layer-2 network segment to hang or repeatedly crash the database service. The flaw affects Group Replication GCS deployments in MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; standalone instances without Group Replication enabled are not exposed. No public exploit was identified at time of analysis, and impact is limited to availability with no confidentiality or integrity effect.
Denial of service in Oracle MySQL Server and MySQL Cluster lets an attacker who already holds high-privilege database credentials hang or repeatedly crash the server through the Server: Optimizer component, reachable over the network via multiple protocols. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The CVSS 3.1 base score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact with no disclosure or modification of data; no public exploit code or confirmed active exploitation was identified at time of analysis, and the PR:H prerequisite means realistic abuse comes from a malicious or compromised privileged account rather than anonymous external attackers.
High-privileged local attackers can take over Oracle MySQL Server and MySQL Cluster through the Server: Components Services component, affecting MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 score is 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so exploitation requires an existing high-privileged account with logon to the MySQL host rather than remote or unauthenticated access. No CISA KEV listing or public exploit code is reported in the supplied data; no public exploit identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster allows a low-privileged authenticated account with network access to hang or repeatedly crash the database service through the Server: XML component. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The issue is availability-only (CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit code or CISA KEV entry was identified at time of analysis, so practical risk is moderate and driven by exposure of MySQL accounts and ports.
Local information disclosure in Oracle Communications BRM - Elastic Charging Engine 15.0.0.0.0, 15.0.1.0.0.0, 15.1.0.0.0, and 15.2.0.0.0 lets an authenticated low-privileged user who can log on to the ECE host read critical data accessible to the product. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, so exploitation requires existing local access, is straightforward once that access exists, and affects confidentiality only. No public exploit identified at time of analysis.
Unauthenticated adjacent-network attackers can create, delete, or modify critical data in Oracle Communications BRM - Elastic Charging Engine 15.x, plus read a limited subset of data, by reaching the physical or adjacent communication segment attached to the ECE hardware. The issue is medium severity (CVSS 5.9) with high attack complexity (AC:H), so success depends on timing or runtime conditions outside the attacker's control and Internet-based exploitation is not possible. Affected releases are 15.0.0.0.0, 15.0.1.0.0.0, 15.1.0.0.0, and 15.2.0.0.0; no public exploit identified at time of analysis, and Oracle's October 2026 Critical Patch Update is the reference advisory.
A locally exploitable information-disclosure flaw in Oracle Communications BRM - Elastic Charging Engine (versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0) lets an attacker who already holds a low-privileged logon on the host read a subset of data the ECE component would otherwise keep out of reach. The CVSS 3.1 base score is only 3.3 (AV:L/PR:L/AC:L/UI:N/C:L/I:N/A:N), so there is no write or availability impact and no path to full compromise from the network - realistic exposure is limited to insiders or an adversary who has already landed on the server. No public exploit code and no confirmed active exploitation were identified at time of analysis; Oracle addresses the issue in its October 2026 Critical Patch Update.
Denial of service in MySQL Server and MySQL Cluster (Server: Optimizer component) allows an authenticated low-privilege attacker with network access to cause a hang or frequently repeatable crash of the database service, resulting in complete loss of availability for the affected instance. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. No public exploit identified at time of analysis, and risk is concentrated on multi-tenant, shared, or externally reachable instances where untrusted or compromisable low-privilege accounts exist.
Unauthenticated, network-reachable attackers can force a hang or repeatable crash of MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, and of MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, through the Server: Components Services component. Oracle rates this CVSS 3.1 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability; the high attack complexity reflects conditions outside the attacker's control rather than a deterministic payload. No public exploit code or confirmed active exploitation was identified in the available intelligence, and the issue is materially lower risk where the MySQL listener is not exposed to untrusted networks.
Denial of service in Oracle MySQL Server and MySQL Cluster can be triggered by an authenticated, high-privileged attacker sending queries that exercise the Server: Optimizer component, resulting in a hang or repeatable crash of the database service. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 base score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H); the high-privilege prerequisite limits exposure to insiders or compromised accounts, and no public exploit has been identified at time of analysis.
A denial-of-service flaw in the Oracle MySQL Server Optimizer also affects MySQL Cluster, allowing a high-privileged attacker with network access to hang or repeatedly crash the server (CVSS 3.1 base 4.9, availability-only). Affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. Exploitation requires an authenticated session holding HIGH database privileges (CVSS PR:H), which sharply limits exposure; no public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 allows any authenticated low-privileged user with HTTP network access to read critical data through the Oracle Diagnostics Interfaces component. Exploitation is low-complexity and requires no user interaction, but the need for a valid account limits exposure; impact is confidentiality-only (CVSS 6.5, C:H/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis.
Repeated-crash denial of service in Oracle MySQL Server (X Plugin component) and MySQL Cluster allows a low-privileged, network-positioned user to hang or fully take down the database service. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle rates it CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning the attacker must already hold a low-privileged account but needs no user interaction; there is no confidentiality or integrity impact and no code execution path, and no public exploit or CISA KEV listing was identified at time of analysis.
Partial denial of service in MySQL Server and MySQL Cluster can be triggered by a high-privileged, authenticated attacker with network access through MySQL protocols against the Server: Telemetry component. The affected releases are MySQL Server and MySQL Cluster 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. CVSS 3.1 scores the issue 2.7 with only low availability impact, and no public exploit was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster allows an authenticated low-privilege attacker to hang or repeatedly crash the database service over the network. The flaw affects the Server: Components Services component in MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; it is rated CVSS 6.5 with availability-only impact. No public exploit was identified at time of analysis, and the main prerequisite is a valid low-privilege database account reachable over MySQL-supported protocols.
High-privileged network attackers can force hangs or repeatable crashes and read a limited subset of data in Oracle MySQL Server and MySQL Cluster versions 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1. The issue is in the Server: Security: Encryption component and requires an existing high-privilege MySQL account, so anonymous or low-privileged remote users are not sufficient. Oracle assigned CVSS 3.1 base score 5.5, and no public exploit identified at time of analysis; the referenced Oracle Critical Patch Update advisory is the primary source.
Oracle MySQL Server and MySQL Cluster deployments that run the Group Replication plugin (Server: Group Replication Plugin) can be driven into a hang or a frequently repeatable crash by a high-privileged, network-reachable database account, producing a complete denial of service on the affected instance. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; standalone servers that do not enable Group Replication are outside the exploitable path. The CVSS 3.1 base score is 4.9 (MEDIUM) with availability-only impact, and no public exploit identified at time of analysis; because the vector requires PR:H, exploitation is limited to trusted or already-compromised privileged accounts. Fixes are referenced through Oracle's October 2026 Critical Patch Update advisory.
Unauthenticated network attackers can cause a hang or frequently repeatable crash of Oracle MySQL Server and MySQL Cluster and make limited unauthorized data changes through the Server: Pluggable Auth component. Affected releases are MySQL Server 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1, plus MySQL Cluster 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. Oracle rates exploitation as difficult (CVSS 6.5, AC:H), and no public exploit identified at time of analysis; risk is highest where MySQL network ports are exposed to untrusted networks.
A difficult-to-exploit denial-of-service flaw in Oracle MySQL's Server: Replication component lets a high-privileged, network-connected database user hang or repeatedly crash MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, as well as MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Because the CVSS vector requires PR:H credentials and high attack complexity (AC:H), only authenticated administrators or accounts with replication-level privileges can trigger it, and no confidentiality or integrity impact results - availability only, at a base score of 4.4. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied with the source data.
Oracle BRM 15.x allows a locally authenticated low-privileged user to read critical or complete application data, with no integrity or availability impact. Affected releases are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0; exploitation requires a pre-existing local logon to the infrastructure hosting BRM Server and the ability to interact with that component. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score is 5.5.
Authenticated low-privileged users can cause a hang or repeatable crash (complete denial of service) in Oracle MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 by reaching the Server: Security: Encryption component over network protocols. Oracle rates exploitation as difficult (AC:H) and impact as availability-only (CVSS 3.1 base 5.3); no public exploit was identified at time of analysis.
Unauthenticated network attackers can hang or repeatedly crash MySQL Server and MySQL Cluster by targeting the Server: Security: Encryption component, producing a complete denial of service against the database service. The flaw carries CVSS 3.1 base score 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle characterizes the issue as difficult to exploit because attack complexity is high, meaning the attacker must satisfy server-side conditions outside their direct control (specific state, timing or race behavior) rather than sending a single deterministic request; there is no public exploit identified at time of analysis and the issue is not in CISA KEV. Impact is strictly availability - no confidentiality or integrity loss - so exposure is materially reduced for instances not reachable from untrusted networks.
High-privilege MySQL accounts can crash InnoDB-backed MySQL Server and MySQL Cluster instances by sending crafted requests over supported network protocols, causing a hang or repeatable full denial of service. Affected builds include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, as well as MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H); no CISA KEV entry or public exploit code was supplied, and the high-privilege prerequisite limits practical exposure to insiders or already-compromised accounts.
Authenticated high-privileged users can crash or hang MySQL Server and MySQL Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1 through malformed input handled by the Server: GIS component, causing a denial of service with no confidentiality or integrity impact. Exploitation requires network access and a privileged database account, so realistic risk is concentrated in trusted-insider or already-compromised-credential scenarios; no public exploit identified at time of analysis.
Information disclosure in the JDBC component of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition (CVSS 3.1 base 5.9) lets an unauthenticated network attacker who can get attacker-influenced data into the affected JDBC APIs read critical data that the Java process can access; there is no integrity or availability impact. Exploitation is explicitly rated difficult (AC:H) and depends on non-trivial preconditions, chiefly a service that feeds untrusted input to those APIs or a sandboxed Java Web Start/applet client running untrusted code. No public exploit code was identified at time of analysis, and the issue was disclosed through the Oracle Critical Patch Update of October 2026 covering Java SE 8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, GraalVM for JDK 17.0.20.1/21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1.
Oracle HRMS (US) 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker with HTTP network access to the Internal Operations component to read critical HR data without user interaction. The assessed CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact only, and no public exploit has been identified at time of analysis. This moderate-risk issue warrants normal Oracle Critical Patch Update cadence rather than emergency response.
Unauthorized read access to HR data in Oracle HRMS (US) 12.2.3 through 12.2.15 is possible through an access-control weakness in the Internal Operations component of Oracle E-Business Suite, allowing a low-privileged authenticated user with HTTP network reach to retrieve records well beyond their intended authorization scope. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning impact is confined to confidentiality - no data modification or service disruption - and exploitation still requires valid credentials, which is the primary limiting factor. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not available in the supplied intelligence, so it should be treated as a moderate-priority patching item rather than an emergency.
Unauthorized access to critical Oracle HRMS (US) data is possible for low-privileged authenticated attackers who can reach the Internal Operations component over HTTP in Oracle E-Business Suite 12.2.3 through 12.2.15. Successful exploitation yields high confidentiality impact only, with no integrity or availability effect, and requires a valid EBS account but no user interaction and low attack complexity. At time of analysis, no public exploit identified, and no KEV or EPSS data was provided.
Low-privileged Oracle E-Business Suite users can read critical HRMS (US) data through the Internal Operations component, a confidentiality-only exposure reachable over HTTP. Oracle HRMS (US) releases 12.2.3 through 12.2.15 are affected by this easily exploited flaw (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), meaning any valid authenticated EBS account can trigger it against a default configuration without user interaction. No public exploit code and no CISA KEV listing were identified at time of analysis, so the practical barrier remains obtaining valid EBS credentials - the attacker pool is limited to credentialed insiders or someone who has already compromised an account, and no data modification or service disruption is possible.
Oracle Report Manager, a component of Oracle E-Business Suite (Internal Operations), exposes a subset of its data to unauthorized reading by a low-privileged, authenticated user who can reach the application over HTTPS. Versions 12.2.3 through 12.2.15 are affected; no public exploit code or confirmed active exploitation was identified at the time of analysis, and the CVSS 3.1 score of 4.3 reflects confidentiality-only impact with no integrity or availability effect. Because exploitation requires valid low-privileged credentials (PR:L) and low attack complexity with no user interaction, the practical risk is concentrated in environments where many low-trust accounts exist or where account provisioning is loosely controlled.
Partial data disclosure and unauthorized modification in Oracle Java SE (8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27), plus Oracle GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1, stem from a flaw in the 'Security' component that becomes reachable when an application or web service passes attacker-supplied data into those APIs, or when sandboxed Java Web Start/applet deployments execute untrusted code and rely on the Java sandbox for isolation. Network attackers need no credentials (PR:N) and no user interaction (UI:N), but High attack complexity (AC:H) means success depends on conditions the attacker cannot directly control, so exploitation is unreliable; impact is confined to partial read and partial modify of a subset of Java-accessible data with no availability effect (CVSS 3.1 base 4.8, MEDIUM). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated remote access to JAAS APIs in specific Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition releases can disclose a limited subset of accessible data; the issue is rated CVSS 3.1 base 5.3 with confidentiality-only impact. Affected builds are Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, GraalVM for JDK 17.0.20.1 and 21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1. Exploitation requires reachable JAAS APIs that process attacker-supplied data, with a narrower legacy path through sandboxed Web Start or applet code; no public exploit was identified at time of analysis.
Unauthorized data modification and limited information disclosure in Oracle Java SE (21.0.12.1, 25.0.4.1, and 27) occur when attacker-supplied data reaches the APIs of the Compiler component through a network-facing service. Rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), the flaw is unauthenticated and needs no user interaction, but Oracle explicitly scopes reachability to applications that pass untrusted data into the Compiler APIs directly - not via Java Web Start or applets - and the high attack complexity means success depends on conditions the attacker does not fully control. No public exploit code or confirmed active exploitation was identified at time of analysis.
A moderate-severity flaw (CVSS 3.1 base 5.4, MEDIUM) in the Mobile Applications component of Oracle HRMS (US) within Oracle E-Business Suite, disclosed in the October 2026 Critical Patch Update, lets a low-privileged authenticated attacker who persuades another user to interact with attacker-controlled content alter or delete some HRMS data and read a limited subset of it, with scope change extending impact to other products. Deployments running E-Business Suite 12.2.3 through 12.2.15 are affected; exploitation requires network access over HTTP, valid low-privilege credentials, and victim interaction, so the attacker cannot succeed alone. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Integrity-only data modification in Oracle Java SE's JSSE TLS component can be triggered by unauthenticated network attackers who can supply data to affected TLS-processing APIs, although exploitation is rated difficult and limited to low-integrity impact. Affected deployments include Java SE 8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, along with GraalVM for JDK 17.0.20.1/21.0.12.1 and GraalVM Enterprise Edition 21.3.19.1.1; the 3.7 CVSS score and lack of public exploit code make this a low-priority issue, with client-side risk concentrated in sandboxed Java Web Start and applet deployments.
Authenticated high-privileged users of Oracle PeopleSoft Enterprise HCM Human Resources 9.2 can abuse the Administer Workforce component over HTTP to create, delete, or modify critical HR data, read a subset of otherwise restricted records, and force repeatable hangs or crashes of the application. Exploitation is constrained by three factors drawn from the CVSS vector - a high-privileged account (PR:H), interaction by a separate victim user (UI:R), and Oracle's own assessment that the flaw is difficult to exploit (AC:H) - which together point to insider or post-compromise misuse rather than opportunistic remote attack. There is no public exploit code identified at time of analysis and the issue is not in CISA KEV; the vendor-reported severity is 6.0, and independent assessment rates real-world urgency as low.
A high-complexity integrity flaw in the Security component of Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) lets a remote attacker who can feed untrusted data into the affected Security APIs create, delete or modify critical data, though the attacker gains no data disclosure or denial of service (CVSS 3.1 5.9, AV:N/AC:H/PR:N/UI:N/C:N/I:H/A:N). The primary server-side path requires an application that passes externally supplied data into those APIs, such as a web service; a secondary path affects deployments that rely on the Java sandbox to run untrusted Java Web Start applications or applets. Exploitation is rated difficult (AC:H) and no public exploit code or KEV listing was reported at time of analysis, so the practical risk is concentrated in applications that expose the vulnerable Security APIs to attacker-controlled input.
Low-severity confidentiality exposure in the Oracle PeopleSoft PeopleTools Portal component (versions 8.61 through 8.63) requires an authenticated, low-privileged attacker with HTTP network access and a separate victim's interaction to read a limited subset of application data. Oracle rates the attack as difficult (AC:H), and the mandatory authentication (PR:L), required second-party interaction (UI:R), and scope change (S:C) sharply limit realistic exploitation. No public exploit was identified at time of analysis, and the issue is not known to be actively exploited.
A moderate-severity flaw (CVSS 3.1 base 5.4) in the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a low-privileged, network-positioned attacker who already holds a valid account inject content that a second user must then view or interact with, yielding limited unauthorized read and limited insert/update/delete access to PeopleTools data; the scope change flag means the impact can spill into the victim's session and other integrated products. There is no public exploit code and no confirmed active exploitation at time of analysis, and the combination of a required authenticated account plus mandatory victim interaction keeps this out of the mass-exploitation category. Treat it as routine Oracle Critical Patch Update (October 2026) work rather than an emergency.
Low-privileged authenticated users can tamper with and read limited Oracle HRMS (UK) data in Oracle E-Business Suite 12.2.3 through 12.2.15 by convincing another user to interact with crafted HTTP content. The issue is medium severity (CVSS 3.1 base 5.4) and has scope change into other EBS products, but exploitation requires a valid account (PR:L) and victim interaction (UI:R); the 'Authentication Bypass' tag is not supported by the assessed vector. No public exploit was identified at time of analysis and no KEV entry is present in the provided data.
Oracle HRMS (Republic of Korea) payroll localization for E-Business Suite 12.2.3 through 12.2.15 permits a low-privileged, network-positioned attacker with a valid EBS account to read sensitive data beyond their intended authorization scope through the Korean Payroll component, yielding a high confidentiality impact with no integrity or availability effect (CVSS 6.5). Exploitation requires only low-privileged authenticated HTTP access, no user interaction, and low attack complexity, but is practically gated by whether an organization actually deploys the Korea-specific payroll localization outside South Korean deployments. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS-style risk is tempered by the module's narrow deployment footprint.
Oracle HRMS (India) Indian Payroll, as shipped with Oracle E-Business Suite 12.2.3 through 12.2.15, exposes a low-complexity HTTP-reachable path that lets a low-privileged authenticated user read data well beyond their intended scope, up to everything the HRMS (India) schema surfaces. The flaw is a confidentiality-only issue (CVSS 6.5, C:H/I:N/A:N) gated behind a valid EBS account (PR:L) with no user interaction required, which keeps unauthenticated external attackers out of reach. No public exploit code or confirmed active exploitation was identified at time of analysis, and the risk is best characterized as a moderate-priority authenticated information-disclosure problem concentrated in tenants that hand low-privilege EBS accounts to untrusted populations.
Unauthorized read access to critical HR data in Oracle HRMS (Norway) is possible for a low-privileged authenticated attacker who can reach the Internal Operations component over HTTP. The flaw affects Oracle E-Business Suite 12.2.3 through 12.2.15 deployments that include the Norwegian HRMS localization, and successful exploitation yields high confidentiality impact without integrity or availability effects. No public exploit was identified at the time of analysis, and the CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Authenticated information disclosure in the Product Diagnostic Tools component of Oracle Order Management (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged user reach data they should not see over plain HTTP, with no user interaction and low attack complexity. Because the CVSS vector carries PR:L with C:H and no integrity or availability impact, the practical outcome is read-only exposure of critical application data rather than tampering or denial of service - the authentication requirement is the main barrier an outside attacker must clear. Oracle addressed the flaw in its October 2026 Critical Patch Update; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Oracle Database Server 19.3 through 19.32 and 21.3 through 21.23 allow a high-privileged database principal holding the Query Optimizer privilege to read a limited subset of RDBMS data it should not be able to access over Oracle Net. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, base score 2.7) means the attacker must already be an authenticated, privileged account on the target instance, so the realistic threat population is insiders or holders of compromised privileged credentials rather than anonymous remote attackers, and there is no integrity or availability impact. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; fixes are delivered through Oracle's October 2026 Critical Patch Update.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 exposes an Integration Broker flaw that allows an unauthenticated attacker with network access over HTTP to influence data the application handles, with successful exploitation depending on inducing a legitimate user to interact with a crafted request and on conditions Oracle itself characterizes as difficult to arrange. Impact is partial - limited unauthorized read plus some unauthorized update, insert, or delete capability within PeopleTools-accessible data - with no availability effect, and because of the scope change the blast radius may extend to additional connected products; both confidentiality and integrity impacts are rated Low. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS-style risk is correspondingly modest: this is a low-to-moderate real-world priority despite network reachability, warranting patching on a normal cycle rather than emergency response.
An authenticated low-privileged user with HTTP access to the eProcurement component of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 can manipulate or expose data the account should not control, chiefly through unauthorized creation, deletion, or modification of critical records, with a smaller confidentiality spill. Exploitation is rated difficult (AC:H) because success depends on application state or configuration outside the attacker's direct control, and the Argentina financial localization must actually be deployed - so this is a moderate-risk issue unlikely to be a top-priority emergency, with no public exploit identified at time of analysis. Integrity impact is the dominant concern (I:H) while availability is unaffected (A:N).
High-privileged local users can corrupt critical data or repeatedly crash PeopleSoft PeopleTools 8.61-8.63 through the Updates Environment Mgmt component, with CVSS 3.1 scoring 6.0 for integrity and availability impact. Exploitation requires logon to the infrastructure hosting PeopleTools and pre-existing high privileges, so realistic exposure is limited to trusted insiders or attackers who have already escalated on the host. No public exploit identified at time of analysis, and no CISA KEV entry is associated with this CVE in the provided data.
Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 can expose a limited subset of application data to a high-privileged attacker who already has interactive logon access to the host running the product, specifically through the Open Query component. The assessed CVSS 3.1 score is 1.9 (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N), reflecting a local, high-complexity, privileged-only path with confidentiality impact limited to a subset of accessible data. No public exploit has been identified at time of analysis, and this is a low-priority issue best treated as an insider or post-compromise data-exposure risk rather than a remotely exploitable breach.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 carries a low-severity flaw in the Data Mover component that lets an attacker who already holds high privileges and a valid logon on the PeopleTools host - and who can induce a second, different user to perform an action - read and modify a limited subset of PeopleSoft data and trigger a partial denial of service. Oracle's October 2026 Critical Patch Update scores it CVSS 3.1 3.8 (AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) and explicitly calls it difficult to exploit, so realistic exposure is an insider or post-compromise scenario rather than opportunistic attack; no public exploit code or confirmed active exploitation was identified at time of analysis.
Adjacent-network attackers who already hold high privileges can achieve full takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 through the Push Notifications component, gaining complete confidentiality, integrity and availability impact (CVSS 3.1 base 6.8, MEDIUM). The flaw is easily triggered once an attacker sits on the physical or adjacent communication segment attached to the PeopleTools host and no end-user action is required, but the AV:A and PR:H prerequisites keep real-world exposure well below the headline 'takeover' severity. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update.
Information disclosure in the Search Framework component of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 allows an unauthenticated attacker who already has a foothold on the physical/adjacent network segment hosting the PeopleSoft instance to read critical application data. The CVSS 3.1 score is 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting a confidentiality-only impact that requires adjacent-network positioning and conditions outside the attacker's direct control (high attack complexity), so the flaw is not reachable from the routable internet. No public exploit code was identified at time of analysis, there is no CISA KEV listing, and no EPSS score was supplied; despite the 'Authentication Bypass' tag in the source feed, the practical risk is moderate and not an urgent priority.
High-privileged attackers with HTTP access to PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Meta Data component to read critical application data and cause a hang or repeatable crash, producing high confidentiality and availability impact. The issue is rated CVSS 3.1 6.5 and requires an already high-privileged PeopleSoft account (PR:H), so exploitation is realistic mainly for trusted insiders or attackers who already hold privileged credentials. No public exploit code or CISA KEV entry was identified at time of analysis.
PeopleSoft Enterprise PeopleTools 8.61 and 8.62 expose the Process Scheduler component to a low-privileged attacker with HTTP network access who can persuade a separate user to interact with crafted content, resulting in limited read and write access to PeopleTools data and possible impact on connected products through scope change. The assessed CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N for a base score of 4.4, so this is not an unauthenticated autonomous attack: it requires a valid low-privileged account, victim interaction, and high-complexity conditions. Supplied intelligence shows no CISA KEV active exploitation and no public exploit identified at time of analysis; Oracle's October 2026 CPU advisory is the vendor reference.
Limited confidentiality and integrity compromise in PeopleSoft Enterprise PeopleTools 8.62 Search Framework requires a victim to interact with attacker-supplied content before unauthenticated network attackers can read or modify a subset of application data. The issue is rated difficult to exploit (AC:H) and does not affect availability; no public exploit code has been identified at time of analysis. The supplied intelligence does not report active exploitation in CISA KEV.
Low-privileged, authenticated users of PeopleSoft Enterprise PeopleTools 8.61 and 8.62 can exploit the Portal component over HTTP to read a limited portion of accessible data and trigger a partial denial of service, but successful exploitation is difficult because it depends on conditions outside the attacker's direct control (AC:H). The vulnerability requires valid low-privileged credentials and network access; it does not permit integrity modification or full availability loss, and scope remains unchanged. No public exploit has been identified at time of analysis, and no EPSS or KEV data was provided in the intelligence.
Authenticated low-privileged users of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Application Data Sets component over HTTP to modify or delete critical application data and to cause repeated hangs or crashes, producing high integrity and availability impact. The CVSS 3.1 score is 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H), and Oracle characterizes the issue as difficult to exploit, so reliable exploitation depends on non-default or attacker-uncontrollable conditions beyond a valid account. This is a moderate-priority issue rather than an emergency, and no public exploit identified at time of analysis.
PeopleSoft Enterprise PeopleTools 8.61 and 8.62 contain a flaw in the Query component that a high-privileged, authenticated attacker can reach over HTTP to cause repeatable denial of service and limited unauthorized data reads or modifications. Oracle rates it CVSS 3.1 5.5 with high attack complexity and high privileges required, and no public exploit identified at time of analysis.
Unauthenticated network attackers can achieve limited unauthorized update, insert, or delete access to data in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by targeting the Application Server - JRE component over SSH, but Oracle rates exploitation as difficult (AC:H). The issue is low severity (CVSS 3.7) with integrity-only impact and no confidentiality or availability effect; no public exploit code or CISA KEV active exploitation is identified in the provided data.
Local, already high-privileged users on servers running Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 can abuse the Business Interlink component to gain partial read access and partial insert/update/delete capability over PeopleTools data, plus a partial denial-of-service condition against the PeopleTools process itself. Exploitation is gated by several preconditions - an interactive logon to the host (AV:L), high privileges on that host (PR:H), and attack complexity Oracle characterizes as 'difficult to exploit' (AC:H) - so this is a limited post-compromise or insider-abuse scenario rather than a remotely reachable flaw. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the 3.9 CVSS base score and the tightly capped Low/Low/Low impact reflect that an attacker must already control the underlying infrastructure to benefit.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 contains a WebLogic-component weakness that allows an unauthenticated attacker with access to the physical communication segment to achieve limited unauthorized read and write access to some PeopleTools data. Exploitation is Oracle-rated difficult and depends on race or protocol-state conditions outside the attacker's control, so the 4.2 MEDIUM score reflects low-to-moderate practical risk. Available intelligence did not identify public exploit code or confirmed active exploitation, and no CISA KEV entry or EPSS score was supplied.
Oracle Order Management in Oracle E-Business Suite 12.2.3 through 12.2.15 can expose critical application data through a high-complexity authenticated flaw in its Product Diagnostic Tools component. A network attacker holding a low-privileged account can use HTTP to read critical data and make limited unauthorized updates, inserts, or deletions, but successful exploitation depends on conditions outside the attacker's direct control. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Sensitive data exposure in PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a high-privileged attacker with local logon to the application-server host to read critical PeopleSoft data via the Application Server - JRE component. The CVSS 3.1 score is 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), and no public exploit code or confirmed active exploitation is identified in the supplied intelligence.
Authentication bypass in the WebLogic component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets unauthenticated, network-positioned attackers read critical application data and make limited unauthorized data changes over TLS. Oracle classifies the issue as difficult to exploit (CVSS AC:H), meaning success hinges on specific server state or configuration conditions rather than a single reliable request. No public exploit identified at time of analysis; the vendor advisory is Oracle's October 2026 Critical Patch Update.
Unauthenticated HTTP requests to the PeopleSoft Enterprise PeopleTools Web Server component in versions 8.61 through 8.63 can return a subset of PeopleTools-accessible data that the requester should not be able to read, so internet- or intranet-exposed PeopleSoft portals are directly at risk. Oracle scored it CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N): no credentials, no user interaction and no special configuration are needed, but the impact is confidentiality-only - no data modification and no availability effect - and the scope change means exposed data may extend beyond PeopleTools into connected products. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available intelligence.
Low-privileged local users on Oracle Solaris 11.4 can abuse the X Window System component to modify or delete some accessible data, read a subset of Solaris data, and cause a partial denial of service. The CVSS 3.1 score is 5.3 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, so an attacker must already hold a valid interactive login on the host, no victim interaction is required, and the issue cannot be reached remotely. No public exploit has been identified at time of analysis, and exposure is limited to Solaris 11.4 systems where an attacker already has a local account.
Path traversal in the djust MCP server's find_handlers_for_template tool (affected versions 0.9.0 through before 1.0.10, 1.1.x before 1.1.7, 1.2.x before 1.2.4, and 1.3.0.dev before 1.3.0rc8) allows a local MCP client to supply an arbitrary absolute template_path, which the tool reads without confining resolution to the project or configured template directories. Rather than full file disclosure, the tool acts as a file existence/readability oracle and leaks only substrings matching the dj-click, dj-submit, dj-change, dj-input, dj-keydown, or dj-keyup attribute pattern - a narrow, pattern-filtered exposure reflected in the low CVSS 3.3 score (AV:L/PR:L, C:L only). Exploitation requires an already-connected local stdio MCP session running as the same OS user with no network listener, so the attacker effectively already holds the victim's privileges; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Sensitive-data exposure in Oracle Order Management 12.2.3 through 12.2.15 lets a low-privileged authenticated user read critical or all Order Management-accessible data through the Product Diagnostic Tools component. The CVSS 6.5 rating reflects a network-reachable, low-complexity flaw with high confidentiality impact and no integrity or availability effect, gated by the need for a valid low-privileged EBS account (PR:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and this is assessed as a moderate-priority issue.
Oracle Order Management 12.2.3 through 12.2.15 can expose critical business data to an authenticated low-privilege user through the Product Diagnostic Tools component, yielding read-only confidentiality impact with a CVSS 3.1 base score of 6.5. The attacker needs network HTTP access and valid low-privilege EBS credentials, and no public exploit code was identified at time of analysis; no CISA KEV entry was provided.
Authenticated low-privilege users of Oracle Product Hub 12.2.3 through 12.2.15 can exploit the Internal Operations component over HTTP to read critical Product Hub data without modifying it or causing denial of service. The CVSS 3.1 score is 6.5 with a confidentiality-only impact, and exploitation requires a valid low-privilege account rather than anonymous access. No public exploit code was identified at time of analysis, and no CISA KEV status is indicated in the supplied data.
Reflected cross-site scripting in the HTML UI component of Oracle E-Business Suite's Installed Base module (versions 12.2.3 through 12.2.15) lets an unauthenticated remote attacker deliver a crafted HTTP request or link that executes in a victim's session once that user interacts with it. Because the vector carries scope change (S:C) with low confidentiality and integrity impact, a successful attack can read and modify a subset of Installed Base data and potentially affect other EBS products sharing the session context; there is no availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation depends on social-engineering a user into following the crafted link.
Integrity-only tampering in the Oracle Purchasing module of Oracle E-Business Suite (12.2.3 through 12.2.15) lets a low-privileged, authenticated user reach the Internal Operations component over HTTP and, if a separate and typically more privileged user is induced to interact, perform unauthorized updates, inserts, or deletes against a limited subset of Purchasing data. There is no confidentiality or availability impact and the CVSS 3.1 base score is 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N), so both prior authentication and victim interaction are prerequisites - no public exploit identified at time of analysis, and no CISA KEV listing. This is a genuinely low-priority issue despite being network-exploitable, and the practical risk is concentrated in environments where low-privileged Purchasing accounts are widely distributed or weakly governed.
Oracle Purchasing 12.2.3 through 12.2.15 contains an integrity-only flaw in the Internal Operations component of Oracle E-Business Suite. A low-privileged authenticated attacker with HTTP network access could manipulate some accessible purchasing data, but the high attack complexity and limited integrity impact keep real-world risk low. No public exploit code or confirmed active exploitation was identified at time of analysis.
Limited data disclosure in Oracle Concurrent Processing (Oracle E-Business Suite 12.2.3 through 12.2.15) allows an authenticated low-privileged attacker with HTTP access to read a subset of Concurrent Requests data. The CVSS 3.1 score is 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting high attack complexity and no integrity or availability impact; no public exploit identified at time of analysis.
Local, low-privileged users with logon access to hosts running Oracle E-Business Suite Production Scheduling 12.2.3 through 12.2.15 can update, insert, or delete some Production Scheduling data, read a subset of that data, and cause a partial denial of service. The CVSS 3.1 score is 4.5 with AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L, meaning exploitation requires an existing local authenticated foothold and depends on high-complexity conditions outside the attacker's direct control. No public exploit was identified at time of analysis, EPSS was not provided, and there is no CISA KEV confirmation of active exploitation.
Oracle E-Business Suite iSupplier Portal 12.2.3 through 12.2.15 contains a confidentiality-only flaw in the Internal Operations component that lets a low-privileged, authenticated attacker with HTTP network access read critical data or all data accessible through the portal. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no integrity or availability impact; the main barrier is obtaining a valid supplier or portal credential. No public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated information disclosure in Oracle Order Management 12.2.3 through 12.2.15 allows low-privilege users with network HTTP access to read critical data exposed by the Product Diagnostic Tools component. The CVSS 3.1 score is 6.5 with PR:L, AC:L, UI:N, and only confidentiality impact (C:H/I:N/A:N), so an attacker must already hold valid E-Business Suite credentials and cannot modify or disrupt the service through this issue. No public exploit identified at time of analysis, and no KEV or EPSS data was supplied.
Sensitive-data disclosure in the MWA Terminal Server component of Oracle Mobile Application Server (part of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged authenticated user reach data they should not be able to read, potentially including all information accessible to the component. Exploitation requires a valid EBS account plus network access to the MWA Terminal Server over HTTP, needs no user interaction, and succeeds with low attack complexity (CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) - confidentiality only, with no integrity or availability impact. The exposure is bounded by the authentication prerequisite and by whether the optional mobile/barcode component is actually deployed and exposed; no public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV), so it is primarily an insider or post-compromise credential-abuse risk addressed in the Oracle Critical Patch Update of October 2026.
Oracle Compensation Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated low-privileged attacker with HTTP network access to read and modify a subset of Total Compensation Statement data, provided a second, different user interacts with attacker-influenced content (UI:R). The CVSS 3.1 base score is 5.4 with a scope change (S:C), meaning successful exploitation may affect resources beyond the vulnerable component; both the required prior authentication (PR:L) and the mandatory victim interaction materially limit real-world exploitation. No public exploit was identified at time of analysis, and this is a moderate-severity issue best handled through the normal Oracle Critical Patch Update cycle rather than emergency response.
Oracle General Ledger within Oracle E-Business Suite 12.2.3 through 12.2.15 can expose critical financial records to an authenticated low-privilege user who can reach the Internal Operations component over HTTP. The flaw scores 6.5 on CVSS 3.1 with confidentiality-only impact (C:H/I:N/A:N), requires a valid PR:L account and no user interaction, and does not affect integrity or availability. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the reference for fixes.
Unauthenticated information disclosure in the Oracle Engineering module (Change Management component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a remote attacker with HTTP reachability to read a limited subset of application data. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning no credentials or user interaction are required, but confidentiality impact is partial and there is no modification or availability effect. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; realistic exposure depends almost entirely on whether the EBS web tier is internet-facing or confined to an internal network. Oracle addresses it in the October 2026 Critical Patch Update.
Authenticated low-privileged users can abuse high-complexity conditions in the LOV component of Oracle Complex Maintenance, Repair and Overhaul (CMRO) 12.2.3 through 12.2.15 to create, delete, modify, or read critical data reachable through CMRO over HTTP. The issue is rated CVSS 3.1 6.8 with high confidentiality and integrity impact but no availability impact, and exploitation requires valid EBS credentials plus attacker-independent conditions that Oracle describes as difficult to exploit. No public exploit identified at time of analysis.
Unauthorized read and limited insert/update/delete access to Oracle Communications Billing and Revenue Management (BRM) Server 15.x data is possible for unauthenticated network attackers via the HTTP interface, though Oracle rates exploitation as difficult (AC:H). The flaw affects BRM Server versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 and carries a CVSS 3.1 base score of 4.8 with only low confidentiality and integrity impact and no availability impact. No public exploit code or CISA KEV entry was identified at time of analysis; this is a normal-cycle patch rather than an emergency.
Oracle MySQL Connector/ODBC 26.7.1 can allow a low-privileged, network-positioned attacker to read and modify connector-accessible data, but only under high-complexity conditions outside the attacker's control (CVSS 3.1 base 6.8, AC:H/PR:L/UI:N). The flaw affects confidentiality and integrity with no availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis.
Oracle Applications Manager, the management and diagnostics console bundled with Oracle E-Business Suite 12.2.3 through 12.2.15, contains an HTTP-reachable weakness in its Diagnostics component that allows a high-privileged attacker to read a limited subset of Applications Manager data and cause a partial denial of service. The CVSS 3.1 base score is 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L), meaning the attacker must already hold an authenticated administrative account on the product and must meet conditions outside their direct control for the attack to succeed. No public exploit code has been identified at time of analysis, and Oracle addresses the issue through its October 2026 Critical Patch Update.
Partial denial of service in Oracle MySQL Connector/ODBC 26.7.1 is reachable only by an attacker who already holds a logon on the same infrastructure where the driver runs, and only when a separate user is induced to interact with the affected component; high attack complexity means the precondition state is hard to arrange reliably. Successful exploitation yields nothing beyond a partial availability impact on the connector itself - no confidentiality or integrity effect - which is why Oracle scored it CVSS 3.1 base 2.5. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS-style risk is correspondingly low.
Authenticated attackers with high database privileges can exploit the Server: XML component in MySQL Server 8.4.x, 9.7.x, and 26.7.x, as well as MySQL Cluster 8.0.x, 8.4.x, 9.7.x, and 26.7.x, over the network to modify or delete critical data and to hang or repeatedly crash the service. The flaw has low attack complexity and requires no user interaction, but the PR:H prerequisite limits practical risk to insiders, compromised privileged accounts, or post-authentication attack chains; confidentiality is not affected. No public exploit code or CISA KEV entry was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster allows a low-privileged authenticated remote attacker to hang or repeatedly crash the database by sending crafted SQL that reaches the Server: Parser component. MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 are affected. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit code or CISA KEV entry is identified in the provided data.
A denial-of-service flaw in the Optimizer component of MySQL Server and MySQL Cluster lets a high-privileged, network-connected database account hang or repeatedly crash the server, with CVSS 3.1 base score 4.9 (availability-only). Affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Exploitation requires an authenticated session using a highly privileged account (PR:H) over MySQL's supported protocols, so the realistic threat is insiders or attackers who already hold privileged credentials; no public exploit code or confirmed active exploitation was identified at time of analysis.
Low-privileged MySQL Server and MySQL Cluster users with network access can potentially gain read and write access to data beyond their intended authorization scope through the Server: Security: Privileges component. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, and Oracle characterizes exploitation as difficult with CVSS 6.8, AC:H, and PR:L. This is a moderate-priority issue, not a top-tier emergency; no public exploit identified at time of analysis, and no CISA KEV entry was present in the supplied intelligence.
Denial of service in Oracle MySQL Server and MySQL Cluster Group Replication allows an unauthenticated attacker on the same Layer-2 network segment to hang or repeatedly crash the database service. The flaw affects Group Replication GCS deployments in MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; standalone instances without Group Replication enabled are not exposed. No public exploit was identified at time of analysis, and impact is limited to availability with no confidentiality or integrity effect.
Denial of service in Oracle MySQL Server and MySQL Cluster lets an attacker who already holds high-privilege database credentials hang or repeatedly crash the server through the Server: Optimizer component, reachable over the network via multiple protocols. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The CVSS 3.1 base score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact with no disclosure or modification of data; no public exploit code or confirmed active exploitation was identified at time of analysis, and the PR:H prerequisite means realistic abuse comes from a malicious or compromised privileged account rather than anonymous external attackers.
High-privileged local attackers can take over Oracle MySQL Server and MySQL Cluster through the Server: Components Services component, affecting MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 score is 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so exploitation requires an existing high-privileged account with logon to the MySQL host rather than remote or unauthenticated access. No CISA KEV listing or public exploit code is reported in the supplied data; no public exploit identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster allows a low-privileged authenticated account with network access to hang or repeatedly crash the database service through the Server: XML component. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The issue is availability-only (CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit code or CISA KEV entry was identified at time of analysis, so practical risk is moderate and driven by exposure of MySQL accounts and ports.
Local information disclosure in Oracle Communications BRM - Elastic Charging Engine 15.0.0.0.0, 15.0.1.0.0.0, 15.1.0.0.0, and 15.2.0.0.0 lets an authenticated low-privileged user who can log on to the ECE host read critical data accessible to the product. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, so exploitation requires existing local access, is straightforward once that access exists, and affects confidentiality only. No public exploit identified at time of analysis.
Unauthenticated adjacent-network attackers can create, delete, or modify critical data in Oracle Communications BRM - Elastic Charging Engine 15.x, plus read a limited subset of data, by reaching the physical or adjacent communication segment attached to the ECE hardware. The issue is medium severity (CVSS 5.9) with high attack complexity (AC:H), so success depends on timing or runtime conditions outside the attacker's control and Internet-based exploitation is not possible. Affected releases are 15.0.0.0.0, 15.0.1.0.0.0, 15.1.0.0.0, and 15.2.0.0.0; no public exploit identified at time of analysis, and Oracle's October 2026 Critical Patch Update is the reference advisory.
A locally exploitable information-disclosure flaw in Oracle Communications BRM - Elastic Charging Engine (versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0) lets an attacker who already holds a low-privileged logon on the host read a subset of data the ECE component would otherwise keep out of reach. The CVSS 3.1 base score is only 3.3 (AV:L/PR:L/AC:L/UI:N/C:L/I:N/A:N), so there is no write or availability impact and no path to full compromise from the network - realistic exposure is limited to insiders or an adversary who has already landed on the server. No public exploit code and no confirmed active exploitation were identified at time of analysis; Oracle addresses the issue in its October 2026 Critical Patch Update.
Denial of service in MySQL Server and MySQL Cluster (Server: Optimizer component) allows an authenticated low-privilege attacker with network access to cause a hang or frequently repeatable crash of the database service, resulting in complete loss of availability for the affected instance. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. No public exploit identified at time of analysis, and risk is concentrated on multi-tenant, shared, or externally reachable instances where untrusted or compromisable low-privilege accounts exist.
Unauthenticated, network-reachable attackers can force a hang or repeatable crash of MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, and of MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, through the Server: Components Services component. Oracle rates this CVSS 3.1 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability; the high attack complexity reflects conditions outside the attacker's control rather than a deterministic payload. No public exploit code or confirmed active exploitation was identified in the available intelligence, and the issue is materially lower risk where the MySQL listener is not exposed to untrusted networks.
Denial of service in Oracle MySQL Server and MySQL Cluster can be triggered by an authenticated, high-privileged attacker sending queries that exercise the Server: Optimizer component, resulting in a hang or repeatable crash of the database service. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 base score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H); the high-privilege prerequisite limits exposure to insiders or compromised accounts, and no public exploit has been identified at time of analysis.
A denial-of-service flaw in the Oracle MySQL Server Optimizer also affects MySQL Cluster, allowing a high-privileged attacker with network access to hang or repeatedly crash the server (CVSS 3.1 base 4.9, availability-only). Affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. Exploitation requires an authenticated session holding HIGH database privileges (CVSS PR:H), which sharply limits exposure; no public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 allows any authenticated low-privileged user with HTTP network access to read critical data through the Oracle Diagnostics Interfaces component. Exploitation is low-complexity and requires no user interaction, but the need for a valid account limits exposure; impact is confidentiality-only (CVSS 6.5, C:H/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis.
Repeated-crash denial of service in Oracle MySQL Server (X Plugin component) and MySQL Cluster allows a low-privileged, network-positioned user to hang or fully take down the database service. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle rates it CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning the attacker must already hold a low-privileged account but needs no user interaction; there is no confidentiality or integrity impact and no code execution path, and no public exploit or CISA KEV listing was identified at time of analysis.
Partial denial of service in MySQL Server and MySQL Cluster can be triggered by a high-privileged, authenticated attacker with network access through MySQL protocols against the Server: Telemetry component. The affected releases are MySQL Server and MySQL Cluster 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. CVSS 3.1 scores the issue 2.7 with only low availability impact, and no public exploit was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster allows an authenticated low-privilege attacker to hang or repeatedly crash the database service over the network. The flaw affects the Server: Components Services component in MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; it is rated CVSS 6.5 with availability-only impact. No public exploit was identified at time of analysis, and the main prerequisite is a valid low-privilege database account reachable over MySQL-supported protocols.
High-privileged network attackers can force hangs or repeatable crashes and read a limited subset of data in Oracle MySQL Server and MySQL Cluster versions 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1. The issue is in the Server: Security: Encryption component and requires an existing high-privilege MySQL account, so anonymous or low-privileged remote users are not sufficient. Oracle assigned CVSS 3.1 base score 5.5, and no public exploit identified at time of analysis; the referenced Oracle Critical Patch Update advisory is the primary source.
Oracle MySQL Server and MySQL Cluster deployments that run the Group Replication plugin (Server: Group Replication Plugin) can be driven into a hang or a frequently repeatable crash by a high-privileged, network-reachable database account, producing a complete denial of service on the affected instance. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; standalone servers that do not enable Group Replication are outside the exploitable path. The CVSS 3.1 base score is 4.9 (MEDIUM) with availability-only impact, and no public exploit identified at time of analysis; because the vector requires PR:H, exploitation is limited to trusted or already-compromised privileged accounts. Fixes are referenced through Oracle's October 2026 Critical Patch Update advisory.
Unauthenticated network attackers can cause a hang or frequently repeatable crash of Oracle MySQL Server and MySQL Cluster and make limited unauthorized data changes through the Server: Pluggable Auth component. Affected releases are MySQL Server 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1, plus MySQL Cluster 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. Oracle rates exploitation as difficult (CVSS 6.5, AC:H), and no public exploit identified at time of analysis; risk is highest where MySQL network ports are exposed to untrusted networks.
A difficult-to-exploit denial-of-service flaw in Oracle MySQL's Server: Replication component lets a high-privileged, network-connected database user hang or repeatedly crash MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, as well as MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Because the CVSS vector requires PR:H credentials and high attack complexity (AC:H), only authenticated administrators or accounts with replication-level privileges can trigger it, and no confidentiality or integrity impact results - availability only, at a base score of 4.4. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied with the source data.
Oracle BRM 15.x allows a locally authenticated low-privileged user to read critical or complete application data, with no integrity or availability impact. Affected releases are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0; exploitation requires a pre-existing local logon to the infrastructure hosting BRM Server and the ability to interact with that component. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score is 5.5.
Authenticated low-privileged users can cause a hang or repeatable crash (complete denial of service) in Oracle MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 by reaching the Server: Security: Encryption component over network protocols. Oracle rates exploitation as difficult (AC:H) and impact as availability-only (CVSS 3.1 base 5.3); no public exploit was identified at time of analysis.
Unauthenticated network attackers can hang or repeatedly crash MySQL Server and MySQL Cluster by targeting the Server: Security: Encryption component, producing a complete denial of service against the database service. The flaw carries CVSS 3.1 base score 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle characterizes the issue as difficult to exploit because attack complexity is high, meaning the attacker must satisfy server-side conditions outside their direct control (specific state, timing or race behavior) rather than sending a single deterministic request; there is no public exploit identified at time of analysis and the issue is not in CISA KEV. Impact is strictly availability - no confidentiality or integrity loss - so exposure is materially reduced for instances not reachable from untrusted networks.
High-privilege MySQL accounts can crash InnoDB-backed MySQL Server and MySQL Cluster instances by sending crafted requests over supported network protocols, causing a hang or repeatable full denial of service. Affected builds include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, as well as MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H); no CISA KEV entry or public exploit code was supplied, and the high-privilege prerequisite limits practical exposure to insiders or already-compromised accounts.
Authenticated high-privileged users can crash or hang MySQL Server and MySQL Cluster 9.7.0-9.7.3 and 26.7.0-26.7.1 through malformed input handled by the Server: GIS component, causing a denial of service with no confidentiality or integrity impact. Exploitation requires network access and a privileged database account, so realistic risk is concentrated in trusted-insider or already-compromised-credential scenarios; no public exploit identified at time of analysis.