Oracle
Monthly
Full takeover of the Siebel CRM Deployment component (Oracle Siebel CRM Server Infrastructure, supported versions 17.0 through 26.7) is possible for a low-privileged user who can log on to the host where the deployment service runs, provided a person other than the attacker can be induced to perform an interaction. Oracle rates it 7.3 under CVSS 3.1 (AV:L/AC:L/PR:L/
A broken authorization flaw in the Proxy User Delegation component of Oracle User Management (Oracle E-Business Suite 12.2.3 through 12.2.15) lets an authenticated, low-privileged user reach the application over HTTP and fully take over the module, with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Because delegation features inherently exercise impersonation logic, a bypass here can translate directly into acting as a higher-privileged user across the suite. No CISA KEV listing, no public exploit code and no EPSS score were supplied with the input; exploitation status is therefore 'no public exploit identified at time of analysis'.
Full takeover of Oracle Depot Repair — the field-service and repair-management module of Oracle E-Business Suite — is possible in versions 12.2.3 through 12.2.15 for any attacker who already holds a high-privileged account and can reach the application over HTTP. The flaw sits in the module's Internal Operations component and permits complete loss of confidentiality, integrity and availability of Depot Repair data and functions. There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is currently limited to actors who obtain or already possess elevated EBS credentials.
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an application-layer access-control weakness that lets a low-privileged user with network access to the EBS HTTP interface create, delete or modify critical calendar data and read a subset of calendar records. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), meaning no user interaction is needed but a valid low-privileged account is a prerequisite. No public exploit code or CISA KEV listing was provided in the source data, and no EPSS score was supplied, so active exploitation is currently unconfirmed.
Low-privileged users with network access to Oracle E-Business Suite 12.2.3 through 12.2.15 can tamper with, create, or delete Applications Calendar data they should not control, and can partially degrade the availability of that component (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N, integrity high and availability low, no confidentiality impact). The flaw sits in the Oracle Common Applications Calendar module of EBS and is rated 'easily exploitable' by the vendor, but it is not a pre-authentication bug: an attacker must already hold a valid low-privileged account and HTTP reachability to the EBS application tier. No CISA KEV listing, EPSS score, or public exploit code was provided with the advisory data, so there is currently no public exploit identified at time of analysis.
Oracle Common Applications, a shared framework component of Oracle E-Business Suite (CRM User Management Framework), fails to properly restrict actions for low-privileged users in versions 12.2.3 through 12.2.15, allowing them to create, delete, or modify critical CRM data and read data they should not access. Exploitation is network-based over HTTP with low complexity, but requires the attacker to already hold a valid low-privileged account and to persuade another user to interact with a crafted request (CVSS 7.3, AV:N/AC:L/PR:L/UI:R). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was provided in the source data.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Core component of the Application Object Library that allows a remote, unauthenticated attacker with HTTP access to bypass authentication and gain unauthorized read and write access to critical application data. Oracle rates the issue 7.4 with a high attack complexity, reflecting that exploitation is possible over the network without credentials but requires conditions an attacker must engineer or discover. No public exploit code has been identified and the issue is not listed in CISA KEV, so at time of analysis this is a patch-now, high-impact confidentiality and integrity risk rather than a confirmed active campaign.
Unauthenticated denial of service in Oracle Siebel CRM Deployment (Server Infrastructure component) affecting release levels 17.0 through 26.7. An attacker who can reach the deployment infrastructure over HTTP can send crafted requests that hang or repeatedly crash the service, producing a complete denial of service with no confidentiality or integrity impact. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied; the risk is driven by the low attack complexity and lack of required credentials rather than by observed exploitation.
Authenticated low-privileged attackers with network reachability can fully take over Oracle Siebel CRM Development (versions 17.0 through 26.7) by exploiting the Configuration Tools component through SQL-based input, resulting in complete loss of confidentiality, integrity, and availability on the affected deployment. Oracle rates this 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a hard-to-execute but network-reachable flaw that requires only a low-privileged account and no user interaction. There is no public exploit identified at time of analysis, no EPSS score supplied, and no CISA KEV listing, so this is currently a patch-cycle priority rather than an observed active campaign.
Unauthenticated remote attackers can reach the Workspaces component of Oracle Siebel CRM Development over HTTP and obtain unauthorized read access to critical application data while also degrading service availability (CVSS 3.1 base 8.2, AV:N/AC:L/PR:N/UI:N). Affected are all Siebel CRM Development releases from 17.0 through 26.7. There is no public exploit code or CISA KEV listing confirmed in the supplied intelligence, so the practical priority depends on whether the Workspaces HTTP interface is exposed beyond trusted internal networks.
Full compromise of Oracle Siebel CRM Deployment (Server Infrastructure component, versions 17.0 through 26.7) is achievable by an authenticated low-privileged user who can reach the deployment tier over HTTP. Oracle's own advisory rates it 8.8 with complete confidentiality, integrity, and availability impact, meaning a single low-privilege account can escalate to takeover of the deployment rather than merely reading data. No CISA KEV listing, no public exploit code, and no EPSS score were included in the source data, so the current exploitation status is unconfirmed and the immediate risk is driven by the breadth of the affected version range combined with trivial attack complexity.
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker who already holds a valid account and can reach the application over HTTP. Successful exploitation gives the attacker unauthorized read, creation, modification, and deletion access to Calendar data and can also cause a partial denial of service, though Oracle rates the flaw as difficult to exploit (CVSS 3.1 7.1, AV:N/AC:H/PR:L/UI:N). No public exploit code or CISA KEV entry was provided in the intelligence feed, and the only authoritative reference is Oracle's Critical Patch Update advisory cspusep2026.
We need to produce JSON with specified fields. Need include "koszalin" only in risk_assessment. Let's craft. Let me parse data. CVE-2026-83178: Oracle Application Object Library product of Oracle E-Business Suite, component Core. Affected versions 12.2.3-12.2.15. "Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Application Object Library." Scope change, takeover. CVSS 8.0 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. References: Oracle security alert cspusep2026.html. ENISA EUVD. Product name: Oracle E-Business Suite? Or Oracle Application Object Library. 1-3 words. "Oracle E-Business Suite" is 4 words incl Oracle? Actually "Oracle E-Business Suite" = 3 words? Oracle (1) E-Business (2) Suite (3). Yes. Or "Oracle Application Object Library" is 4 words. Primary product likely Oracle E-Business Suite. But specific product is Oracle Application Object Library. Product name 1-3 words: "Oracle E-Business Suite" fits 3 words. Could be "Oracle AOL"? No. Use "Oracle E-Business Suite". Summary: 2-3 sentence original synthesis. Must not start with "A vulnerability", etc. Start with impact. E.g. "Privileged attackers with network access can achieve full takeover of Oracle E-Business Suite 12.2.3 through 12.2.15 by exploiting a high-complexity flaw in the Application Object Library Core component." Mention scope change, CVSS 8.0, EPSS not provided, KEV not provided. No public exploit identified at time of analysis. Since no KEV/POC info given. We can state "no public exploit identified at time of analysis" (per rules). Also EPSS not provided. Mention high-privileged required, AC:H. Scope S:C. Technical context: Underlying tech: Oracle E-Business Suite, Application Object Library (AOL) is a foundational component managing concurrent programs, menus, responsibilities, security, and metadata. CWE N/A. Root cause unknown. High privileged attacker, network HTTP. Scope chang
Low-privileged users of Oracle One-to-One Fulfillment (the Documents component of Oracle E-Business Suite 12.2.3 through 12.2.15) can read, create, delete, or modify critical fulfillment and document data over HTTP without any user interaction. Oracle assigns it a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning the attacker only needs network reachability plus a low-privileged account, not administrative rights. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data.
Oracle E-Business Suite's Common Applications module (CRM User Management Framework component) in supported releases 12.2.3 through 12.2.15 can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP, resulting in complete loss of confidentiality, integrity and availability of that component. Oracle rates it CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so the network attack path is simple but the privilege bar is high. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied in the input data.
Improper authorization in the Application Framework component of Oracle CRM Technical Foundation (Oracle E-Business Suite 12.2.3–12.2.15) lets a low-privileged user with ordinary HTTP access to the instance read and alter critical CRM data that should be restricted to higher-privileged roles — integrity and confidentiality are both rated High, availability is unaffected. Oracle scores it 8.1 (AV:N/AC:L/PR:L/UI:N), meaning exploitation is straightforward but requires a valid low-privilege account rather than anonymous access. No public exploit code or active exploitation has been reported in the supplied intelligence, and no EPSS value was provided, so it should be treated as a patch-priority issue rather than an emergency.
Oracle One-to-One Fulfillment, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes unauthorized access to critical data and can be partially disrupted by an attacker holding only a low-privileged account with HTTP access to the application. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/A:L), the issue requires authentication but no user interaction, and yields high confidentiality loss plus a limited availability impact. There is no public exploit code and no CISA KEV entry at time of analysis, and no EPSS score was supplied; the vendor patch is published in the September 2026 Critical Patch Update advisory.
Oracle Sales Online, a component of Oracle E-Business Suite, is affected by an easily exploitable flaw in versions 12.2.3 through 12.2.15 that lets a low-privileged attacker with HTTP network access compromise the application and reach data outside its intended boundary (scope change). Successful exploitation can expose critical data or all Oracle Sales Online-accessible data, plus allow unauthorized insert, update, or delete of some records. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle's Critical Security Patch Update advisory (cspusep2026.html) is the authoritative fix reference and the CVSS 3.1 base score of 8.5 reflects high confidentiality and low integrity impact.
Authenticated low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the One-to-One Fulfillment 'Documents' component to read critical data outside their authorized scope and partially degrade availability of the module. The vendor-assigned CVSS 3.1 base score is 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L), reflecting high confidentiality impact with no integrity impact and only partial denial of service; the scope-change flag indicates that exploitation can significantly affect resources beyond the vulnerable component. There is no CISA KEV listing, no public proof-of-concept identified, and no EPSS data supplied, so exploitation is not confirmed to be active at time of analysis.
An adjacent-network attacker holding a low-privileged Oracle E-Business Suite account can fully take over the Oracle One-to-One Fulfillment module (Documents component) in EBS releases 12.2.3 through 12.2.15, with high confidentiality, integrity and availability impact. Exploitation requires the attacker to sit on the physical communication segment serving the host where One-to-One Fulfillment runs, but needs no user interaction and no elevated privileges once there, making a single craftable request sufficient for complete compromise of the module. No public exploit code and no CISA KEV listing were present in the available intelligence at time of analysis, and no EPSS score was supplied to quantify real-world exploitation likelihood.
Unauthenticated attackers who can reach the One-to-One Fulfillment module of Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP can achieve complete takeover of that component, with high confidentiality, integrity, and availability impact (CVSS 8.1). Oracle characterizes the flaw as difficult to exploit (AC:H), which tempers the unauthenticated network attack vector, and the issue resides in the module's Java Server layer. No public exploit code and no CISA KEV listing were identified at time of analysis, and Oracle published the fix as part of its September 2026 Critical Security Patch Update.
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An unauthenticated remote attacker with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can bypass access controls in the Oracle Application Object Library (FND) Core component and read critical application data, per Oracle's own disclosure (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/C:H/I:N/AN). The flaw is fully automatable — no credentials, no user interaction, low complexity — making it attractive for mass scanning, though its impact is limited to confidentiality (no integrity or availability loss). No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, but no EPSS score was supplied, so real-world exploitation probability is unquantified.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a broken-authorization flaw in the Customer Interaction History module (Outcome-Result component) that allows a low-privileged user with HTTP access to read data well outside their intended privileges. Exploitation is trivial once an attacker holds any valid low-privileged EBS account, and Oracle's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) marks it as an easily exploitable, confidentiality-only issue whose scope change means other EBS modules can be affected. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical risk is driven by the enormous blast radius of an ERP holding financial, HR and customer records rather than by confirmed active exploitation.
Oracle E-Business Suite releases 12.2.3 through 12.2.15 allow a low-privileged, authenticated user with network access to the HTTPS interface to take over the Customer Interaction History module, compromising confidentiality, integrity and availability of that component's data. No public exploit code has been identified and the CVE is not listed in CISA KEV, but the attack is network-reachable with low complexity and no user interaction, so a single valid account is the only real barrier. Exploitation probability metrics (EPSS) were not supplied with this record, so real-world activity cannot be quantified from the available data.
Authenticated low-privileged users can fully compromise the Customer Interaction History module (Outcome-Result component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 over HTTP, achieving complete loss of confidentiality, integrity and availability of that module. Oracle rates the issue 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker needs only a valid low-privilege account and no user interaction, making the barrier to exploitation low for anyone who already holds any EBS login. No public exploit code has been identified and the flaw does not appear in CISA KEV at time of analysis, but the Oracle Critical Patch Update reference (cspusep2026.html) indicates a vendor fix is published and patching should follow normal CPU urgency for internet-facing EBS deployments.
Network-reachable file-upload flaws in Oracle E-Business Suite's Application Object Library (Attachments component, versions 12.2.3 through 12.2.15) allow a low-privileged authenticated user to take over the affected component, earning a CVSS 3.1 base score of 8.8 with High confidentiality, integrity and availability impact and no user interaction. Exploitation needs only a valid low-privilege EBS account plus HTTP access — no privileged role, no crash, no victim action — which makes it an attractive post-authentication escalation path inside ERP deployments. No public exploit code or CISA KEV entry has been identified at time of analysis, and Oracle's cspusep2026 Critical Patch Update is the authoritative fix source.
Unauthenticated attackers able to reach the HTTPS interface of Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the Oracle Application Object Library (Core component) to create, delete, or modify critical data and to read data they should never see. The CVSS 3.1 base score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), meaning no credentials or user interaction are needed but successful exploitation depends on conditions the attacker must satisfy. No public exploit code has been identified and the flaw is not listed in CISA KEV, so it should be treated as a high-severity patch obligation rather than an actively exploited emergency.
Authenticated low-privileged users can compromise Oracle Project Intelligence within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) over HTTP, gaining unauthorized create, delete, and modify access to critical data along with read access to a subset of application data. Oracle rates the issue CVSS 3.1 base 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), reflecting a trivial-to-execute, low-privilege attack whose dominant impact is data integrity rather than availability or broad disclosure. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so exploitation status is unconfirmed.
Oracle Database Server releases 23.4.0 through 23.26.3 contain a flaw in the RDBMS component that allows a low-privileged database account holding the Create Table privilege to escalate to full takeover of the database engine over Oracle Net. The attack is network-reachable, requires no user interaction, and carries high confidentiality, integrity and availability impact, producing a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied in the source data, so the immediate driver is the combination of a low privilege bar and complete database compromise rather than confirmed in-the-wild activity.
Oracle E-Business Suite's Applications DBA component (ADPatch) contains a flaw in versions 12.2.3 through 12.2.15 that allows an attacker who already holds a logon on the host infrastructure to take over Applications DBA without presenting Oracle application credentials. Exploitation requires the attacker to persuade another person to perform some interaction (UI:R) and is scored 7.8 with full confidentiality, integrity and availability impact. No public exploit code, EPSS score, or CISA KEV entry was provided in the available intelligence, so active exploitation is unconfirmed at time of analysis.
Oracle E-Business Suite Applications Manager 12.2.3 through 12.2.15 lets a low-privileged attacker who already holds a logon on the host running Applications Manager read and tamper with critical data through the Command Line - RapidClone component. The flaw is a local-only, low-complexity authorization weakness (CVSS 7.1, AV:L/PR:L/UI:N) that yields high confidentiality and integrity impact with no availability impact, and no scoped privilege escalation beyond the component. No public exploit code has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.
Command-line processing in Oracle Applications Manager, a component of Oracle E-Business Suite 12.2.3 through 12.2.15, can be abused by a high-privileged attacker with network access over HTTP to take full control of the Applications Manager host and, because of a scope change, to significantly impact other linked EBS products. Oracle's own vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates that exploitation is difficult and requires an already-elevated account (a privileged operator, administrator, or equivalent account with access to the RapidClone command-line functionality), and no public exploit code or CISA KEV listing has been identified at time of analysis. No EPSS score was supplied with the source data, so the probability of real-world exploitation cannot be quantified from the available intelligence.
A flaw in the Oracle XML Developers Kit (XDK) component bundled with Oracle Database Server lets a low-privileged database account holding the XDKC privilege execute a network-delivered Oracle Net attack that can lead to full takeover of the XDK component, with high confidentiality, integrity and availability impact. Supported releases 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3 are affected. Oracle classifies the issue as difficult to exploit (AC:H) and no public exploit code or CISA KEV entry has been identified at time of analysis, though any user able to obtain XDKC rights is a viable candidate attacker.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contains an easily exploitable flaw that lets a low-privileged attacker positioned on the physical communication segment adjacent to the Siebel Deployment host read critical data and repeatedly crash the service. Successful exploitation yields complete confidentiality loss of all data accessible to Siebel CRM Deployment plus a repeatable denial-of-service condition, per the Oracle CPU advisory. No public exploit code or CISA KEV listing was identified at time of analysis, and EPSS data was not supplied for this CVE.
We need answer JSON only. Need synthesize. Need follow instructions. CVE-2026-83154 Oracle Siebel CRM End User Open UI SOAP vulnerability. Need produce fields. Need careful. We need use all data. Product_name: "Siebel CRM End User" probably. Single 1-3 words? "Siebel CRM End User" is 4 words but maybe product name. They said specific product name. Could use "Siebel CRM" maybe? Affected product is Siebel CRM End User. Use "Siebel CRM" (2 words). But product_name should specific. hmm. Input product: "Siebel CRM End User". 4 words; instruction 1-3 words. Could "Siebel CRM" or "Siebel CRM End User"? Need obey 1-3 words. Maybe "Siebel CRM" is primary product suite but affected is End User. Use "Siebel CRM". Summary: Need not copy description. Mention remote unauth network via SOAP, critical data read/write, no availability impact, CVSS 9.1. No KEV, no POC? Input no KEV/POC. EPSS? Not provided. Need mention POC absent and EPSS unknown/not available. "no public exploit identified..." Use phrase. Start with specific impact verb and product. E.g. "Unauthorized read and write access to critical data in Oracle Siebel CRM End User versions 17.0 through 26.7 can be achieved by an unauthenticated attacker sending SOAP requests over the network." That's good. Include if KEV no. Data: tags Authentication Bypass, Oracle, ENISA. No CWE. Need mention no patch? References has Oracle advisory URL. Likely patch available but not explicit version? We can infer Oracle security alert may include fixes but data no exact fix version. Need remediation maybe advise apply Oracle CPU July 2026? Wait URL cspusep2026 maybe Critical Patch Update? Use vendor advisory. The URL is https://www.oracle.com/security-alerts/cspusep2026.html. "cspusep2026" maybe maybe? Need not invent. We can say "Vendor advisory available; apply Oracle's recommended Siebel CRM fixes from July 2026 Critical Patch Update" even if no exact version. Need avoid inventing exact. "Patch available per vendor advisory" maybe patch
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 can be fully taken over by a low-privileged attacker who can reach the deployment server over HTTPS, with high impact to confidentiality, integrity and availability. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) and describes it as easily exploitable, meaning a valid low-privilege account plus network reachability to the Deployment tier is sufficient — no user interaction and no elevated privileges are required. No public exploit code or CISA KEV entry is associated with this CVE in the supplied intelligence, and no technical root-cause detail (CWE) has been published, so exploitation in the wild is not confirmed.
Improper authorization control in the Oracle Project Intelligence module of Oracle E-Business Suite allows a low-privileged authenticated user with network access to read, create, modify, or delete data across the module, including records the account should never reach. Affected releases are 12.2.3 through 12.2.15; the vendor's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N, base 8.1) indicates the flaw is trivially automatable once credentials exist, because no user interaction is needed. No public exploit code, KEV listing, or EPSS estimate was supplied with the available intelligence, so active exploitation should be treated as unconfirmed rather than assumed.
We need answer JSON only. Need synthesize. Need follow all requirements. Need parse input: CVE-2026-83151, description Oracle Fusion Middleware Service Delivery Platform component Messaging Enabler, affected 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable unauthenticated network via SOAP to compromise, takeover. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. Reported by Oracle. ENISA. References: nvd None? Actually reference URL oracle security alerts cspusep2026.html. Need cross-reference. Need produce fields. Need determine product_name: "Service Delivery Platform" maybe primary product, Oracle Fusion Middleware. 1-3 words only. Could be "Oracle Service Delivery Platform" (3 words). Good. Summary: not copy description. Need original synthesis. Include actively exploited? KEV? Not provided. Input has no KEV field. We must infer KEV status? There's no KEV status in provided. Need use only data. So likely no KEV. POC? not provided. EPSS? not provided. Need say no public exploit identified, EPSS not available perhaps. Summary: remote unauthenticated takeover via SOAP in Oracle Fusion Middleware Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0; CVSS 9.8; component Messaging Enabler. Need not start "A vulnerability". Start with specific impact verb: "Remote unauthenticated attackers can take over Oracle Service Delivery Platform via SOAP requests..." Use no "A vulnerability". Mention no KEV/POC/EPSS? Maybe "No CISA KEV entry or public exploit details were provided in the source data." Good. Technical_context: Underlying SOAP web service in Oracle Fusion Middleware Service Delivery Platform Messaging Enabler. CWE N/A, but maybe CWE unspecified. Use CPE? Input has not explicit CPE strings, just affected versions. Need say no CPE provided in source; version scope from ENVA. Root cause class not identified (CWE N/A). Could mention SOAP interface likely accepts untrusted XML/SOAP leading to compromise; CWE missing, but impact
Local attackers who can log on to a host running Oracle Application Testing Suite 13.3.0.1 can achieve full takeover of the application, with high impact to confidentiality, integrity and availability. The flaw requires human interaction from someone other than the attacker and is rated high complexity, meaning a foothold on the machine plus a successful social-engineering or timing condition is needed rather than a simple remote request. There is no confirmed CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the source data, so current risk is driven by the local-access precondition and Oracle's own assessment rather than evidence of active exploitation.
We need answer JSON only. Need synthesize. Let's inspect input. CVE-2026-83149. Description says Oracle Application Testing Suite supported version affected 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker with Test Manager for Web Apps privilege with network access via HTTP. Scope change. Impacts confidentiality high, integrity low, availability low. CVSS 9.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L. Tags: Authentication Bypass, Denial Of Service, Oracle. References oracle advisory cspusep2026. No patch info? "Affected versions EUVD". No KEV, no POC, no EPSS? Not provided. Need mention missing. Product name: Oracle Application Testing Suite. Summary original synthesis. Need not copy description. Start impact verb and product. "Critical data exposure and limited integrity/availability impact in Oracle Application Testing Suite 13.3.0.1 allows a low-privileged user with Test Manager for Web Apps privilege to access all application data via HTTP, with scope change affecting additional products. No active exploitation or public exploit is identified; patch details are in Oracle CPU." Need mention no KEV, no POC, EPSS missing. Technical context: Oracle Application Testing Suite, HTTP, CWE N/A but likely? Tags authentication bypass. Need explain root cause? We don't have CWE. Use CPE? Not provided but EUVD affected. Oracle ATS. Need educational: web application, privilege/authorization issue? But do not infer too much? Can state "CWE not specified by NVD, but tag Authentication Bypass suggests missing/inadequate authorization checks; root cause class not confirmed." Mention CVSS scope change indicates vulnerable component may be the Test Manager for Web Apps privilege or module, impacting additional products. Risk assessment: Signals: CVSS 9.1 with AV:N AC:L PR:L UI:N S:C C:H I:L A:L. EPSS not provided. KEV absent. POC absent. So compare: high CVSS due to network low complexity and scope change; but requires low privileged with specific Test
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by an attacker who already controls a low-privileged account holding the 'Test Manager for Web Apps' role: a crafted HTTP request traverses a privilege boundary and grants control of the platform with high confidentiality, integrity and availability impact (CVSS 8.8). Because the vector is AV:N/AC:L/PR:L/UI:N, exploitation is network-reachable and needs no user interaction but does require valid low-privilege credentials, so credential theft or reuse is the practical entry point. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied with this record.
Local privilege escalation and full takeover in Oracle PeopleSoft Enterprise FIN Inventory Brazil 9.1, where any attacker holding a valid low-privileged logon to the host running the application can compromise confidentiality, integrity and availability of the Inventory component entirely. Because the flaw is reached via local access (AV:L, PR:L, UI:N) with low attack complexity, it is most relevant to insider threat, shared-host environments and post-compromise lateral movement on PeopleSoft infrastructure rather than to internet-facing attackers. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied.
Oracle Siebel CRM 17.0 through 26.7 exposes a flaw in the Open UI component that lets a low-privileged, network-positioned attacker compromise a victim's Siebel CRM End User session once that victim is persuaded to interact with attacker-supplied content. Successful exploitation yields unauthorized read, creation, deletion or modification of critical and otherwise inaccessible CRM data, and the scope-change (S:C) rating means the fallout can extend to products beyond Siebel CRM End User itself. Rated CVSS 7.7 with high attack complexity, the bug is difficult to exploit reliably, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Low-privileged attackers with network access to the Siebel Apps - Customer Order Management module (Order Management component) in Oracle Siebel CRM versions 17.0 through 26.7 can craft HTTP requests that, once a second user is induced to interact, allow unauthorized read, creation, modification, and deletion of critical order data, with a scope change that can propagate impact to connected products. The flaw carries a CVSS 3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), but no EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so active exploitation is not confirmed (no public exploit identified at time of analysis). It is an easily exploitable, low-complexity issue, making patch deployment a high priority for any organization running an affected Siebel release.
We need to produce JSON. Need to include "walbrzych" only in risk_assessment, lowercase, woven naturally once. Let's craft. Let's think about CVE-2026-83144. Oracle Siebel CRM, Siebel Apps - Customer Order Management, component Order Management. Versions 17.0-26.7. CVSS 8.7 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. Low privileged attacker with network access via HTTP, requires human interaction from a person other than attacker, scope change. Tags: Authentication Bypass, Oracle. Hmm "Authentication Bypass" tag though CVSS PR:L (low privileged) — so maybe mislabeled? Actually PR:L means authenticated low privilege. Authentication Bypass tag might be mislabeled? The vulnerability might allow bypass but CVSS says PR:L. It's Oracle CPU (Critical Patch Update) - cspusep2026.html maybe "Oracle Siebel CRM" something. Reference: https://www.oracle.com/security-alerts/cspusep2026.html. Note "cspusep2026" — likely "Oracle Critical Patch Update Advisory - ..." Hmm, the URL pattern for Oracle is like https://www.oracle.com/security-alerts/cpujan2026.html. "cspusep2026" unusual. Actually might be a typo in input "cspusep2026". Anyway. CWE: N/A. Description says unauthorized creation, deletion, modification + unauthorized access to critical data. C:H/I:H/A:N. So confidentiality and integrity high, availability none. Product name: "Oracle Siebel CRM" or "Siebel CRM"? 1-3 words. "Oracle Siebel CRM" is 3 words. Good. Summary: Must not start with "A vulnerability". Start with impact + product. "Low-privileged attackers with HTTP access to Oracle Siebel CRM's Customer Order Management module 17.0 through 26.7 can exploit an order management flaw requiring victim interaction to read and modify critical data, with scope change impacting other products." Mention KEV? No KEV. POC? No POC. EPSS? No EPSS provided. So mention no public exploit identified at time of analysis. Maybe: "No public exploit code or CISA KEV listing is currently associated with this CVE, though the CVSS score of 8.7
Unauthenticated network attackers can bypass authentication in the eDetailing component of the Siebel Apps - Life Sciences module shipped with Oracle Siebel CRM, affecting versions 17.0 through 26.7, and gain both read and write access to critical CRM data — provided a human other than the attacker is induced to interact with a crafted HTTP request. Oracle scores this 8.1 (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:N), reflecting full confidentiality and integrity compromise but no availability impact and only the Life Sciences vertical exposed. No public exploit code or active exploitation has been identified at time of analysis, and the vendor advisory is Oracle's September 2026 Critical Security Patch Update (cspusep2026.html).
Improper access control in Oracle Proposals, a module of Oracle E-Business Suite (component: Internal Operations), lets a low-privileged, authenticated attacker reach data outside their authorization boundary over HTTP. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields unauthorized read access to critical Oracle Proposals data with a scope change that can extend impact to other EBS-backed products. Oracle rates the issue 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code or CISA KEV entry is present in the supplied intelligence, so it should be treated as an unpatched-window exposure rather than a confirmed in-the-wild campaign.
Low-privileged, network-reachable users of Oracle Field Service can read data far beyond their authorized scope in Oracle E-Business Suite releases 12.2.3 through 12.2.15, potentially reaching critical data across additional products because the flaw crosses a security scope boundary (CVSS 3.1 7.7, C:H only). The vulnerability is exploitable over HTTP with no user interaction once a low-privileged session exists, and no public exploit code or active exploitation is identified at time of analysis. Oracle has published a Critical Security Patch Update advisory covering this issue; there is no CISA KEV listing and no EPSS score was supplied in the source data.
A high-severity flaw in the Internal Operations component of Oracle Spares Management, part of Oracle E-Business Suite, lets a high-privileged attacker who already holds a valid EBS account and HTTP network access take over the Spares Management module and pivot into connected products. All supported 12.2.3 through 12.2.15 releases are affected, and because the flaw is rated hard to exploit (AC:H) the window for a successful attack depends on satisfying a specific, currently undisclosed technical precondition. No CISA KEV listing, public exploit code, or EPSS score was provided, so the risk is driven by the CVSS 8.0 impact profile and the breadth of EBS deployments rather than by observed exploitation.
Oracle Spares Management, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged authenticated user with HTTP network access take full control of the module. Versions 12.2.3 through 12.2.15 are affected, with a CVSS 3.1 base score of 8.8 reflecting high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis, and no EPSS score was provided, so real-world exploitation status cannot be confirmed from available data.
Authenticated but only low-privileged access to the Oracle Spares Management module in Oracle E-Business Suite 12.2.3 through 12.2.15 is sufficient to seize full control of that module, with high confidentiality, integrity and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The weakness sits in the module's Internal Operations component and is reachable over HTTP with no user interaction required, which makes it practically exploitable by anyone who already holds a valid EBS account. No CISA KEV entry, public exploit code or EPSS score was supplied, so active exploitation and real-world prevalence of attacks remain unconfirmed
Oracle iStore, the e-commerce/shopping cart module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exposed to a cross-site style attack in which a low-privileged authenticated attacker with HTTP network access can induce a second user to interact with crafted content and thereby gain unauthorized read, create, modify, and delete access to iStore data — with the vendor warning the impact can extend to other EBS products. With CVSS 3.1 base 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), the flaw is trivially automatable once an attacker holds any low-privileged account, but exploitation still hinges on victim interaction, which materially lowers real-world risk. No public proof-of-concept, EPSS estimate, or CISA KEV entry was present in the supplied intelligence, so exploitation is assessed as not confirmed in the wild at time of analysis.
Low-privileged users of Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can reach data they should not be able to read through the Shopping Cart component over HTTP. Successful exploitation results in unauthorized access to critical data or complete read access to everything the iStore application can reach, and because the flaw carries a scope change it can also significantly affect other E-Business Suite products. Oracle rates it CVSS 3.1 7.7 (confidentiality only, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated information disclosure in Oracle iStore (Shopping Cart component) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a remote attacker with plain HTTP access read critical data exposed through the storefront, up to and including all data reachable by the iStore application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is trivially automatable given the network vector and lack of credentials or user interaction. No CISA KEV entry, EPSS score, or public proof-of-concept was present in the supplied intelligence, so exploitation is assessed as possible but not confirmed in the wild at time of analysis.
Authenticated, low-privileged attackers with HTTP access to Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can read, create, modify, or delete critical shopping-cart, order, and customer data, giving them full read and write reach into all iStore-accessible records. The flaw sits in the Shopping Cart component and is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is remotely reachable over HTTP with no user interaction and only a low-privilege account. No CISA KEV listing and no public exploit code were identified at time of analysis, so exploitation is currently presumed opportunistic rather than confirmed in the wild.
Oracle Web Applications Desktop Integrator (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) exposes a file download weakness that lets a low-privileged, network-connected user retrieve data they should not be able to reach. Exploitation is rated 'easily exploitable' by Oracle — HTTPS network vector, low complexity, no user interaction — and because the flaw can cross a security boundary (CVSS scope change), successful abuse may expose critical data belonging to other EBS components, not just the Desktop Integrator. CVSS 3.1 base score is 7.7 with confidentiality-only impact; no public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
We need to produce a JSON object with the specified fields. Need to include "legnica" in risk_assessment field only, as lowercase, woven naturally. Let me parse the data: CVE-2026-83130: Oracle Site Hub product of Oracle E-Business Suite, component: Internal Operations. Affected versions 12.2.3-12.2.15. CVSS 3.1 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. CWE: N/A. Tags: Authentication Bypass, Oracle. EUVD ID EUVD-2026-79458. References: nvd link to Oracle security alert cspusep2026.html. No EPSS, no KEV, no POC mentioned. Need product_name: 1-3 words. "Oracle Site Hub" (3 words). Or "Oracle E-Business Suite"? The specific product is Oracle Site Hub, part of E-Business Suite. I'd pick "Oracle Site Hub". Summary: 2-3 sentences plain-language for security professionals, original synthesis, not copy description. Start with specific impact verb and product. E.g., "Low-privileged attackers with network access can modify or delete critical Oracle Site Hub data..." Mention no KEV, no POC. EPSS not provided, so can't mention. But note EPSS risk if notable — none provided. Technical context: Oracle Site Hub within Oracle E-Business Suite 12.2, component Internal Operations, versions 12.2.3 to 12.2.15. CWE N/A — likely access control issue given Authentication Bypass tag. Explain E-Business Suite is a large ERP, Site Hub is a real estate/lease management module? Actually Oracle Site Hub is part of EBS for site/location management. The vulnerability allows low privileged attacker with network access via HTTP to compromise. Root cause probably improper authorization/access control (CWE-284 or CWE-863) leading to integrity impact. But CWE is N/A in input, so note that. Risk assessment: CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N — network attack vector, low complexity, low privileges required (authenticated as low-priv user), no user interaction, scope unchanged, low confidentiality, high integrity, no availability. EPSS not provided. KEV not listed. POC not mentioned. SS
Oracle Sales, the sales module of Oracle E-Business Suite (supported versions 12.2.3 through 12.2.15), exposes critical business data to any low-privileged authenticated user who can reach its HTTP interface. A crafted request against the Internal Operations component bypasses the intended access boundary, and because the CVSS vector carries a scope change (S:C), the exposure is not limited to Oracle Sales — data reachable through additional Oracle products can be read as well. Oracle classifies it as 'easily exploitable' (AV:N/AC:L/PR:L/UI:N, CVSS 3.1 base 7.7, confidentiality-only impact); no public exploit code, EPSS score, or CISA KEV entry was provided in the source data.
Unauthenticated remote attackers with HTTP access to Oracle Sales Offline, a module of Oracle E-Business Suite, can read any data the application exposes on affected versions 12.2.3 through 12.2.15. The flaw sits in the Internal Operations component and requires no credentials, no user interaction and no non-default configuration, yielding a 7.5 confidentiality-only CVSS base score. Exploitation is highly automatable and attractive for bulk data theft, though at the time of analysis there is no public exploit code and no confirmed exploitation (no CISA KEV listing); EPSS is not available in the supplied intelligence.
Oracle Sales Offline, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged authenticated user with HTTP access read critical data far beyond their intended authorization, and Oracle's own scoring marks the impact as a scope change, meaning the flaw in this component can also reach data owned by other EBS products. The CVSS 3.1 base score is 7.7 with high confidentiality impact and no integrity or availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis.
Low-privileged attackers with network access over HTTP can compromise Oracle Sales Online in Oracle E-Business Suite releases 12.2.3 through 12.2.15, exposing critical sales data and allowing limited modification of records. Exploitation requires that a low-privileged account already be held and that a second person (not the attacker) be induced to interact with the application, yet the flaw's scope change means a successful attack can ripple into other E-Business Suite components beyond Sales Online itself. It carries a CVSS 3.1 base score of 7.6, but there is no CISA KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied in the intelligence feed.
Oracle Report Manager, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP. The flaw sits in the Internal Operations component and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity, and availability for the Report Manager component with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data, but the low privilege bar and network reachability make this a strong candidate for post-authentication lateral movement inside an EBS environment.
Oracle Sales Online, a module of Oracle E-Business Suite, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP; the flaw sits in the 'Internal Operations' component and is rated 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with high confidentiality, integrity and availability impact across versions 12.2.3 through 12.2.15. Exploitation needs no user interaction and no elevated privileges, only a valid low-privilege login, making any internet- or partner-facing EBS deployment with this module enabled a realistic target. No public exploit code and no CISA KEV listing were identified at time of analysis, so the immediate driver is exposure and patch lag rather than observed in-the-wild activity.
Oracle Report Manager, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes an internal-operations flaw that lets a low-privileged attacker with HTTPS network access read critical data and degrade service availability. Successful exploitation yields high confidentiality impact against all Report Manager-accessible data plus partial denial of service, giving the flaw a 7.1 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is not confirmed to be active; risk is concentrated in internet- or broadly-reachable EBS Report Manager deployments where ordinary authenticated users exist.
Oracle Report Manager — the reporting and output-management product within Oracle E-Business Suite — can be taken over by an attacker who already holds a low-privileged account on the same instance and can reach the application tier over HTTPS. Affected releases are E-Business Suite 12.2.3 through 12.2.15, covering a very long-lived branch of the ERP platform (per the EUVD record and Oracle's Critical Security Patch Update advisory). Successful exploitation yields full read, write and denial-of-service impact on the Report Manager component (CVSS 3.1 base 8.8: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no EPSS score, CISA KEV entry, or public proof-of-concept is present in the supplied intelligence, so exploitation status should be treated as unconfirmed.
Oracle Marketing, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), contains an easily exploitable flaw in its Audience component that lets a low-privileged attacker with HTTP network access fully compromise the application, resulting in complete loss of confidentiality, integrity, and availability. Oracle's own advisory classifies the issue as takeover-level, and because the attack requires only an authenticated low-privilege account with no user interaction, any tenant with self-service or limited marketing roles should treat it as a priority. No public exploit code or CISA KEV entry was provided in the source data, so active exploitation is not confirmed at time of analysis.
Oracle Alert, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be taken over by an attacker holding only a low-privileged account with HTTP access to the application. Because the flaw sits in the Internal Operations component and requires no user interaction, any valid low-privilege EBS user can reach it and obtain full read/write control over Alert data and functionality, with high confidentiality, integrity and availability impact (CVSS 8.8). There is currently no public exploit code or confirmed in-the-wild exploitation (no CISA KEV listing), but Oracle's out-of-band Critical Security Patch Update is the only authoritative fix, and internet-exposed EBS deployments should treat the missing authentication boundary as the primary risk.
A low-privileged, network-reachable flaw in the Internal Operations component of Oracle User Management (part of Oracle E-Business Suite 12.2.6 through 12.2.15) lets an attacker who already holds a valid low-privileged account take full control of the User Management module. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N), effectively amounting to a takeover of the user-provisioning and authorization layer of the ERP. No public exploit code and no CISA KEV listing were identified at time of analysis, so this should be treated as a patch-now, high-severity issue rather than a confirmed active campaign.
Local privilege escalation in Oracle E-Business Suite's Applications DBA (AD Utilities) lets any attacker holding a valid low-privileged logon on the tier where AD Utilities executes take complete control of the component, with full confidentiality, integrity and availability impact on the affected schemas and utilities. Only versions 12.2.3 through 12.2.15 are affected, and exploitation requires prior host access rather than reachability over the network, so the realistic threat is an insider, a compromised application-tier service account, or a post-exploitation escalation step. No public exploit code was identified and the flaw is not listed as confirmed actively exploited (CISA KEV), so risk is driven by the value of the EBS environment and who already holds a login on that infrastructure.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Applications DBA (AD Utilities) component that lets a high-privileged attacker with network access over HTTP take full control of the Applications DBA subsystem. According to Oracle's advisory language the issue is 'easily exploitable,' meaning low attack complexity once the required privileges are held, and successful exploitation delivers high confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). No public exploit code or CISA KEV entry is present in the supplied intelligence, so exploitation appears limited to attackers who already hold an Applications DBA-level account rather than remote unauthenticated adversaries.
Oracle E-Business Suite Order Management (versions 12.2.5 through 12.2.15) exposes order data through its Product Diagnostic Tools component to any low-privileged user who can reach the HTTP interface. The flaw is easily exploitable — network vector, low complexity, no user interaction — and Oracle notes the impact can spread beyond Order Management into interconnected products, resulting in unauthorized access to critical data or complete access to all Order Management data. No public exploit code or CISA KEV listing was provided at time of analysis; no patch version is specified in the available references beyond the linked Oracle advisory.
Unauthenticated remote attackers can read sensitive data from Oracle Applications Manager within Oracle E-Business Suite 12.2.3 through 12.2.15 by sending crafted HTTP requests to the RapidClone command-line component. The issue is scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning exploitation needs no credentials, no user interaction, and only affects confidentiality — an attacker gains unauthorized access to critical data or all data reachable through Applications Manager. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis, so exploitation appears opportunistic rather than confirmed in the wild.
Oracle Quality, a module of Oracle E-Business Suite, contains a difficult-to-exploit flaw in its Internal Operations component affecting versions 12.2.3 through 12.2.15, allowing a low-privileged attacker with network access via HTTP to take over the module with full confidentiality, integrity and availability impact. Oracle's own advisory rates it CVSS 7.5 with attack complexity High and privileges required Low, meaning an attacker must already hold a valid low-privilege account but can reach the vulnerable code remotely over HTTP. No public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not supplied in the intelligence feed, so real-world exploitation likelihood cannot be quantified from that signal.
Low-privileged authenticated users with HTTP access to Oracle Quality in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Quality records and make limited unauthorized changes to them, because the Internal Operations component fails to enforce proper authorization on its requests. Oracle scores this 7.1 with a network vector, low attack complexity and no user interaction, so exploitation is straightforward for anyone who already holds any valid EBS account. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied in the input.
Oracle Lease and Finance Management, a finance module within Oracle E-Business Suite, can be fully taken over by a high-privileged user who sends crafted HTTP requests to its Internal Operations component in versions 12.2.7 through 12.2.15. Successful exploitation yields complete loss of confidentiality, integrity and availability for the module (CVSS 3.1 base 7.2), meaning an attacker could read and alter lease, financing and contract data and disrupt related business processes. The attack is rated easy to perform once the required privileged account and network path exist, but exploitation is gated behind high privileges, and no public exploit code or CISA KEV listing was identified at the time of analysis.
Low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can leverage a hard-to-reach flaw in the Oracle Partner Management module (Internal Operations component) to read critical data and modify records far beyond their authorization, with the impact crossing into other EBS components because the vulnerability carries a scope change. Oracle rates it CVSS 7.1 and characterizes it as difficult to exploit, and a fix is published in the 2026 Critical Patch Update. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote attackers can read any data reachable through the Audience component of Oracle Marketing in Oracle E-Business Suite versions 12.2.3 through 12.2.15 by sending crafted HTTP requests, with no user interaction required. The flaw is scored 7.5 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N) and is confidentiality-only - integrity and availability of the affected module are unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS probability was supplied with the source data.
We need answer as JSON only. Need synthesize. Need obey. Let's parse input. CVE-2026-83108 Oracle Forms Fusion Middleware. Description: Vulnerability in Oracle Forms product component Forms Services, C/S, Charmode. Supported versions affected 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Successful attacks result in takeover of Oracle Forms. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. But CVSS impacts C/I/A all high, description "takeover" seems maybe more than information disclosure. Tags may be mislabeled? Data quality flags? We can flag "Information Disclosure" as mislabeled_tag? Need careful. CVE description says complete compromise/takeover, impacts C/I/A. "Information Disclosure" tag likely insufficient/wrong. But type mislabeled_tag target "Information Disclosure" suggested maybe "Remote Code Execution"? Is that verifiable? Description says "takeover of Oracle Forms" with high C/I/A. Oracle tags maybe possibly "Critical Patch Update" not technique. But tag "Information Disclosure" is wrong likely. We can include data_quality_flags with mislabeled_tag target "Information Disclosure", suggested maybe null? We need suggested canonical slug if known. Could be "remote-code-execution"? But not explicitly RCE, just takeover. Could be "authentication-bypass"? Hmm. Do not invent. Maybe omit? Actually "mislabeled_tag": target "Information Disclosure" exact wrong. suggested maybe null, confidence medium? Reason: description and CVSS indicate full compromise not just info disclosure. But rule says only if verifiable from references/product. We cannot verify exact correct tag. Could say "mislabeled_tag" confidence medium. But maybe data quality flags only high confidence. The instruction: "only emit a flag when input metadata is clearly wrong and verifiable." Is "Information Disclosure" clearly wrong? Yes description sa
We need answer JSON only. Need synthesize. We have CVE-2026-83107 Oracle Forms component Forms Services, C/S, Charmode. Affected 12.2.1.19.0, 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker network via HTTP to compromise Oracle Forms. Scope change significant impact additional products. Successful attacks result in takeover Oracle Forms. CVSS 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. ENISA EUVD. Reference oracle security alert cspusep2026 (critical patch update?). Need produce fields. Need be careful: Description from Oracle says "high privileged attacker with network access via HTTP" PR:H. But "easily exploitable" AC:L. Impact CIA high, scope changed. Vulnerability type not specified; tags says Information Disclosure. Could be some vulnerability in Forms Services C/S Charmode. Need not invent CWE. Need infer root cause? We don't have CWE. Technical context: Oracle Forms part of Fusion Middleware, used for building enterprise apps, web-deployed Java applets? Forms Services, C/S client/server charmode. Need explain. CPE data? Input lacks CPE strings? It says CPE strings in prompt but no CPE lines. Could use affected versions. No CWE. We can say CWE not provided; root cause class unknown, but Oracle tag info disclosure suggests potentially discloses sensitive data leading to takeover? Wait CVSS says C/I/A high and scope change. With high priv attacker. Possibly a deserialization? But no. We must not infer beyond data. We can note CWE missing. Need risk assessment. CVSS 9.1 but PR:H reduces; EPSS missing, KEV? no KEV provided, POC no. Need state "no public exploit identified at time of analysis"; "KEV status not provided; not listed? Actually no KEV field; we can only say no KEV listing in provided data, but absence not confirmation? We can state "Active exploitation not indicated in provided data; no CISA KEV status provided" maybe. Need not overclaim. Multi-source includes ENISA EUVD. Refere
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 can be fully taken over by a low-privileged, network-positioned attacker who reaches Forms Services over HTTP. Oracle rates the flaw difficult to exploit (AC:H) but complete in impact, with high confidentiality, integrity and availability loss once triggered. No public exploit code has been identified and the issue is not listed in CISA KEV, so current risk is driven by the value of Forms-based business applications rather than by observed exploitation.
We need answer JSON only. Need synthesize. We have CVE description. Need fill fields. Let's parse input. CVE-2026-83105. Oracle Forms product of Oracle Fusion Middleware component Forms Services, C/S, Charmode. Supported versions 12.2.1.19.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Scope change, may significantly impact additional products. Successful attacks result in takeover of Oracle Forms. CVSS 3.1 9.0 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Reported by Oracle. Tags: Information Disclosure, Oracle. ENISA EUVD ID. Affected versions. References [nvd] (None) https://www.oracle.com/security-alerts/cspusep2026.html. No KEV, no POC, no EPSS data? Input lacks EPSS/KEV/POC. Need use all data. We can mention EPSS not provided, KEV not listed, POC not identified. Need not invent. Need product_name 1-3 words: "Oracle Forms" (2 words). Summary original synthesis: "Remote code execution/takeover? The description says result in takeover of Oracle Forms, C/I/A impacts. Difficult to exploit unauthenticated network HTTP. Scope change. Affected Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. No KEV/POC; EPSS unknown. Tags include Information Disclosure but CVSS C/I/A high suggests full compromise, maybe information disclosure? Need be precise: "Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a difficult-to-exploit unauthenticated HTTP vulnerability that can lead to full takeover..." Avoid copying description. Mention actively exploited? No: no public exploit identified. EPSS absent, KEV absent. Could say "At time of analysis no public exploit or active exploitation is identified; EPSS is not provided.". Technical_context: underlying technology: Oracle Forms part of Fusion Middleware, Forms Services/C/S (client/server), Charmode. HTTP network vector. CWE N/A. Root cause class not specified. We can explain Oracle Forms runtime for building enterprise apps, forms services exposed ov
We need answer with JSON only. Need synthesize. Let's parse input. CVE-2026-83104. Description: Vulnerability in Oracle Forms product of Oracle Fusion Middleware. Component Forms Services, C/S, Charmode. Supported versions affected 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Forms. Successful attacks result in unauthorized creation, deletion or modification access to critical data or all Oracle Forms accessible data and unauthorized access to critical data or complete access to all Oracle Forms accessible data. CVSS 3.1 Base Score 9.1 C/I H, A N. Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. CWE N/A. Multi-source: Reported by Oracle. Tags: Authentication Bypass, Oracle. ENISA EUVD ID. Affected versions. References oracle security alerts cspusep2026. No KEV, no EPSS in prompt? No POC. Patch availability? Reference is Oracle advisory likely includes patches. We need infer. Need produce fields. Need product_name: "Oracle Forms" 1-3 words. Good. Summary: original synthesis. Mention remote unauthenticated network via TCP, data confidentiality/integrity high. Not KEV, no POC identified. "Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a network-exploitable issue in Forms Services that lets unauthenticated attackers over TCP read and modify critical data." Need avoid starting with "A vulnerability". Start impact verb: "Unauthenticated remote attackers can compromise Oracle Forms..." Good. Mention no active KEV/public exploit identified. Technical_context: Oracle Forms part of Fusion Middleware, client/server/charmode forms services, TCP protocol. CWE N/A but tag Authentication Bypass; likely missing auth. CPE absent but product identity from affected versions. Need educational and specific. Could mention Oracle Forms runs forms applications, communicates over TCP with Forms Services, C/S and character mode deployments. Root cause likely authentication bypass (tag)
We need answer JSON only. Need analyze. We have CVE. Need produce fields. Let's inspect data. CVE-2026-83103 Oracle Forms product Oracle Fusion Middleware component Forms Services, C/S, Charmode. Versions 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Forms. Scope change; takeover of Oracle Forms; CVSS 3.1 Base 9.1 vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. No CWE. Reported by Oracle. EUVD. References oracle security alerts cspusep2026. Need synthesize. Need product_name: Oracle Forms. Summary original synthesis not paraphrase description. Mention high privilege HTTP, takeover, scope change, no KEV/POC? Input no KEV/POC/EPSS? We need use all data. Since no KEV, no EPSS given. CVSS 9.1. Need risk. technical_context: Oracle Forms part Fusion Middleware, C/S/charmode? CWE N/A. CPE? Actually input no CPE strings shown except EUVD versions and "CPE strings"? Prompt says use CPE data but none present maybe in input absent. We can say no CPE provided. Affected products include versions. Remdiation: Vendor advisory exact maybe patch. References oracle advisory, likely patch available. But no exact patch version. Use "Patch available per vendor advisory" since vendor advisory likely. Need be cautious: absence exact fix. Oracle Critical Patch Update? URL cspusep2026 likely Critical Patch Update for Oracle Supply Chain? But no patch version. Remediation: refer to Oracle security alert, apply patch for Oracle Forms 12.2.1.19.0/14.1.2.0.0; monitor. Need no bullet. Exploit scenario: high privileged attacker via HTTP, compromised account, exploit Forms services, pivot due scope change to other products? Actually scope change affects additional products; takeover Oracle Forms. Need attack chain maybe 3-5 steps. Since high priv, network HTTP; Attack chain: Authenticate with high privileges → Send crafted HTTP request to Forms Services → Exploit flaw
Unauthenticated network attackers can reach Oracle Forms Services (including the C/S and Charmode components) over HTTP and achieve unauthorized access to, or modification and deletion of, critical data held in the application, in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. Oracle rates the issue 7.4 with high confidentiality and integrity impact but explicitly characterizes it as difficult to exploit (AC:H), meaning a favorable timing or state condition is required rather than simple request replay. At the time of analysis there is no confirmed CISA KEV listing and no public exploit code identified; exploitability details remain largely undisclosed by the vendor.
Unauthenticated remote attackers able to reach the Oracle Forms Services HTTP listener can fully compromise Oracle Forms deployments in Oracle Fusion Middleware 12.2.1.19.0 and 14.1.2.0.0, gaining complete control of confidentiality, integrity and availability of the affected service (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N). The flaw resides in the Forms Services, C/S and Charmode component set and is described by Oracle as difficult to exploit, meaning success depends on specific timing or state conditions rather than a trivial one-shot request. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the current exploitation signal is theoretical rather than confirmed in the wild.
We need answer JSON only. Need synthesize. Let's inspect CVE data. CVE-2026-83100 Oracle Forms Oracle Fusion Middleware. Description: vulnerability in Oracle Forms product of Oracle Fusion Middleware component Forms Services, C/S, Charmode. Versions affected 12.2.1.19.0, 14.1.2.0.0. Easily exploitable unauthenticated attacker network via HTTP compromise Oracle Forms. Successful attacks result in takeover. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. ENISA EUVD. Reference Oracle advisory. Need fields: product_name: "Oracle Forms" (specific). summary: original synthesis. Mention critical unauthenticated HTTP vulnerability in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows complete takeover. No KEV, no POC in input — must say no public exploit identified? We have only references. EPSS not provided. Should mention EPSS unknown? risk assessment. Summary: "Critical unauthenticated compromise in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows remote attackers with HTTP access to fully take over affected instances; CISA KEV is not reporting active exploitation and no public exploit code is identified in the provided data." That avoids starts with A vulnerability. Need product. Use active? "Remote takeover of Oracle Forms is possible via HTTP..." Good. technical_context: Underlying technology: Oracle Forms part of Oracle Fusion Middleware, Forms Services, client/server/charmode runtime. Component. CWE N/A. No CPE strings provided. Explain root cause class not specified; likely issue in Forms Services that allows unauthenticated takeover. We cannot speculate. CPE absent, affected versions from EUVD. Reference CWE N/A. Be educational: Oracle Forms is long-standing application framework; Forms Services handles HTTP/HTTPS communication for web deployed forms. C/S and charmode maybe character mode. Root cause not disclosed. We can say CVSS indicates network exploitable no privileges user interaction, scope unchanged, high impact all
We need answer JSON only. Need synthesize. Let's parse input. CVE ID CVE-2026-83099 maybe future? Oracle Forms vulnerability. Description: Oracle Forms product of Oracle Fusion Middleware, component Forms Services, C/S, Charmode. Supported affected 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Scope change. Successful attacks can result in takeover of Oracle Forms. CVSS 3.1 Base Score 10.0 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Reported by Oracle. Tags: Information Disclosure, Oracle. References: nvd None? Oracle security alert cspusep2026. Multi-source includes ENISA. No KEV, POC, EPSS? Not provided. We need every field plain string, JSON object. Ensure product_name 1-3 words: "Oracle Forms". Summary original not copy. Technical context. Risk assessment use all signals; no KEV/POC/EPSS data missing. Affected products. Remediation. Exploit scenario. Exploitation conditions. Attack chain. confidence notes. data quality flags array. prevalence. prevalence_basis. assessed_cvss_vector and cvss40. Need adhere. Key issue: CWE N/A but description maybe not info disclosure? Tags include Information Disclosure though CVSS says confidentiality impact high. We need maybe flag mislabeled tag? Hmm data quality flags: Tags "Information Disclosure, Oracle" maybe product Oracle correct. But vulnerability described takeover, Oracle Forms; "Information Disclosure" tag might be inaccurate? CVSS impacts C/I/A high, scope change, not only information disclosure. But tag can be a technique? They say tags: Information Disclosure, Oracle. Could be mislabeled? Need be cautious. The system asks emit only if clearly wrong. Tag "Information Disclosure" on a vulnerability with full C/I/A and takeover of Oracle Forms might be too narrow/mislabeled. But "Information Disclosure" maybe from EUVD or tag system? Could be wrong if impact includes more. However we don't know maybe the u
We need answer with JSON only. Need synthesize. We have CVE, description Oracle Forms product of Oracle Fusion Middleware, component Forms Services, C/S, Charmode. Versions 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable unauthenticated network via HTTP compromise Oracle Forms, takeover. CVSS 9.8 vector. CWE N/A. Tags Information Disclosure, Oracle. ENISA. References Oracle advisory. Need produce fields. Need obey all rules. product_name: Oracle Forms. summary original not copy desc; start impact verb and product. Could say "Takeover of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 via unauthenticated HTTP attacks allows attackers to fully compromise affected instances." Maybe mention tags information disclosure? But summary who affected what attacker can do. KEV? Input no KEV field. POC unknown. EPSS? Not provided. Need no mention? "No public exploit identified at time of analysis" maybe. Could mention "EPSS not available" maybe. Since critical to include if notable. Let's craft 2-3 sentences. Technical_context: Oracle Forms, part of Fusion Middleware, component Forms Services C/S Charmode, HTTP; CPE absent but affected versions identified. CWE N/A. We can say root cause class not disclosed in CVE data, but advisory suggests critical HTTP-accessible component. Need be educational. Mention C/S (client/server) and Charmode deployments; Forms Services runtime accessible over HTTP. The CWE missing. No CPE data actually absent. We can mention no CPE strings provided in source data, so product/version boundaries rely on advisory. Could mention issue affects Oracle Forms Services component including C/S architecture and character-mode deployments. Risk_assessment: CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS not provided. KEV not specified. POC no. SSVC? We need use signals. Need compare contrast. Since no KEV/POC/EPSS, say no public exploit identified but critical due to network unauthenticated low complexity. "CVSS indicates network vector, unauthenticated, no user in
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 (Fusion Middleware, components Forms Services, C/S and Charmode) can be compromised by a low-privileged attacker with network access over HTTP, resulting in full read/write access to Forms-accessible data plus a partial denial of service. Exploitation is difficult (AC:H) and depends on a victim other than the attacker performing some action (UI:R), but the flaw carries a scope change, meaning a successful attack can significantly affect products beyond the vulnerable component itself. Oracle rates it CVSS 3.1 7.9; no public exploit code, KEV listing or EPSS score was present in the supplied intelligence at time of analysis.
Full takeover of the Siebel CRM Deployment component (Oracle Siebel CRM Server Infrastructure, supported versions 17.0 through 26.7) is possible for a low-privileged user who can log on to the host where the deployment service runs, provided a person other than the attacker can be induced to perform an interaction. Oracle rates it 7.3 under CVSS 3.1 (AV:L/AC:L/PR:L/
A broken authorization flaw in the Proxy User Delegation component of Oracle User Management (Oracle E-Business Suite 12.2.3 through 12.2.15) lets an authenticated, low-privileged user reach the application over HTTP and fully take over the module, with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Because delegation features inherently exercise impersonation logic, a bypass here can translate directly into acting as a higher-privileged user across the suite. No CISA KEV listing, no public exploit code and no EPSS score were supplied with the input; exploitation status is therefore 'no public exploit identified at time of analysis'.
Full takeover of Oracle Depot Repair — the field-service and repair-management module of Oracle E-Business Suite — is possible in versions 12.2.3 through 12.2.15 for any attacker who already holds a high-privileged account and can reach the application over HTTP. The flaw sits in the module's Internal Operations component and permits complete loss of confidentiality, integrity and availability of Depot Repair data and functions. There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is currently limited to actors who obtain or already possess elevated EBS credentials.
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an application-layer access-control weakness that lets a low-privileged user with network access to the EBS HTTP interface create, delete or modify critical calendar data and read a subset of calendar records. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), meaning no user interaction is needed but a valid low-privileged account is a prerequisite. No public exploit code or CISA KEV listing was provided in the source data, and no EPSS score was supplied, so active exploitation is currently unconfirmed.
Low-privileged users with network access to Oracle E-Business Suite 12.2.3 through 12.2.15 can tamper with, create, or delete Applications Calendar data they should not control, and can partially degrade the availability of that component (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N, integrity high and availability low, no confidentiality impact). The flaw sits in the Oracle Common Applications Calendar module of EBS and is rated 'easily exploitable' by the vendor, but it is not a pre-authentication bug: an attacker must already hold a valid low-privileged account and HTTP reachability to the EBS application tier. No CISA KEV listing, EPSS score, or public exploit code was provided with the advisory data, so there is currently no public exploit identified at time of analysis.
Oracle Common Applications, a shared framework component of Oracle E-Business Suite (CRM User Management Framework), fails to properly restrict actions for low-privileged users in versions 12.2.3 through 12.2.15, allowing them to create, delete, or modify critical CRM data and read data they should not access. Exploitation is network-based over HTTP with low complexity, but requires the attacker to already hold a valid low-privileged account and to persuade another user to interact with a crafted request (CVSS 7.3, AV:N/AC:L/PR:L/UI:R). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was provided in the source data.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Core component of the Application Object Library that allows a remote, unauthenticated attacker with HTTP access to bypass authentication and gain unauthorized read and write access to critical application data. Oracle rates the issue 7.4 with a high attack complexity, reflecting that exploitation is possible over the network without credentials but requires conditions an attacker must engineer or discover. No public exploit code has been identified and the issue is not listed in CISA KEV, so at time of analysis this is a patch-now, high-impact confidentiality and integrity risk rather than a confirmed active campaign.
Unauthenticated denial of service in Oracle Siebel CRM Deployment (Server Infrastructure component) affecting release levels 17.0 through 26.7. An attacker who can reach the deployment infrastructure over HTTP can send crafted requests that hang or repeatedly crash the service, producing a complete denial of service with no confidentiality or integrity impact. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied; the risk is driven by the low attack complexity and lack of required credentials rather than by observed exploitation.
Authenticated low-privileged attackers with network reachability can fully take over Oracle Siebel CRM Development (versions 17.0 through 26.7) by exploiting the Configuration Tools component through SQL-based input, resulting in complete loss of confidentiality, integrity, and availability on the affected deployment. Oracle rates this 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a hard-to-execute but network-reachable flaw that requires only a low-privileged account and no user interaction. There is no public exploit identified at time of analysis, no EPSS score supplied, and no CISA KEV listing, so this is currently a patch-cycle priority rather than an observed active campaign.
Unauthenticated remote attackers can reach the Workspaces component of Oracle Siebel CRM Development over HTTP and obtain unauthorized read access to critical application data while also degrading service availability (CVSS 3.1 base 8.2, AV:N/AC:L/PR:N/UI:N). Affected are all Siebel CRM Development releases from 17.0 through 26.7. There is no public exploit code or CISA KEV listing confirmed in the supplied intelligence, so the practical priority depends on whether the Workspaces HTTP interface is exposed beyond trusted internal networks.
Full compromise of Oracle Siebel CRM Deployment (Server Infrastructure component, versions 17.0 through 26.7) is achievable by an authenticated low-privileged user who can reach the deployment tier over HTTP. Oracle's own advisory rates it 8.8 with complete confidentiality, integrity, and availability impact, meaning a single low-privilege account can escalate to takeover of the deployment rather than merely reading data. No CISA KEV listing, no public exploit code, and no EPSS score were included in the source data, so the current exploitation status is unconfirmed and the immediate risk is driven by the breadth of the affected version range combined with trivial attack complexity.
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker who already holds a valid account and can reach the application over HTTP. Successful exploitation gives the attacker unauthorized read, creation, modification, and deletion access to Calendar data and can also cause a partial denial of service, though Oracle rates the flaw as difficult to exploit (CVSS 3.1 7.1, AV:N/AC:H/PR:L/UI:N). No public exploit code or CISA KEV entry was provided in the intelligence feed, and the only authoritative reference is Oracle's Critical Patch Update advisory cspusep2026.
We need to produce JSON with specified fields. Need include "koszalin" only in risk_assessment. Let's craft. Let me parse data. CVE-2026-83178: Oracle Application Object Library product of Oracle E-Business Suite, component Core. Affected versions 12.2.3-12.2.15. "Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Application Object Library." Scope change, takeover. CVSS 8.0 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. References: Oracle security alert cspusep2026.html. ENISA EUVD. Product name: Oracle E-Business Suite? Or Oracle Application Object Library. 1-3 words. "Oracle E-Business Suite" is 4 words incl Oracle? Actually "Oracle E-Business Suite" = 3 words? Oracle (1) E-Business (2) Suite (3). Yes. Or "Oracle Application Object Library" is 4 words. Primary product likely Oracle E-Business Suite. But specific product is Oracle Application Object Library. Product name 1-3 words: "Oracle E-Business Suite" fits 3 words. Could be "Oracle AOL"? No. Use "Oracle E-Business Suite". Summary: 2-3 sentence original synthesis. Must not start with "A vulnerability", etc. Start with impact. E.g. "Privileged attackers with network access can achieve full takeover of Oracle E-Business Suite 12.2.3 through 12.2.15 by exploiting a high-complexity flaw in the Application Object Library Core component." Mention scope change, CVSS 8.0, EPSS not provided, KEV not provided. No public exploit identified at time of analysis. Since no KEV/POC info given. We can state "no public exploit identified at time of analysis" (per rules). Also EPSS not provided. Mention high-privileged required, AC:H. Scope S:C. Technical context: Underlying tech: Oracle E-Business Suite, Application Object Library (AOL) is a foundational component managing concurrent programs, menus, responsibilities, security, and metadata. CWE N/A. Root cause unknown. High privileged attacker, network HTTP. Scope chang
Low-privileged users of Oracle One-to-One Fulfillment (the Documents component of Oracle E-Business Suite 12.2.3 through 12.2.15) can read, create, delete, or modify critical fulfillment and document data over HTTP without any user interaction. Oracle assigns it a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning the attacker only needs network reachability plus a low-privileged account, not administrative rights. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data.
Oracle E-Business Suite's Common Applications module (CRM User Management Framework component) in supported releases 12.2.3 through 12.2.15 can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP, resulting in complete loss of confidentiality, integrity and availability of that component. Oracle rates it CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so the network attack path is simple but the privilege bar is high. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied in the input data.
Improper authorization in the Application Framework component of Oracle CRM Technical Foundation (Oracle E-Business Suite 12.2.3–12.2.15) lets a low-privileged user with ordinary HTTP access to the instance read and alter critical CRM data that should be restricted to higher-privileged roles — integrity and confidentiality are both rated High, availability is unaffected. Oracle scores it 8.1 (AV:N/AC:L/PR:L/UI:N), meaning exploitation is straightforward but requires a valid low-privilege account rather than anonymous access. No public exploit code or active exploitation has been reported in the supplied intelligence, and no EPSS value was provided, so it should be treated as a patch-priority issue rather than an emergency.
Oracle One-to-One Fulfillment, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes unauthorized access to critical data and can be partially disrupted by an attacker holding only a low-privileged account with HTTP access to the application. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/A:L), the issue requires authentication but no user interaction, and yields high confidentiality loss plus a limited availability impact. There is no public exploit code and no CISA KEV entry at time of analysis, and no EPSS score was supplied; the vendor patch is published in the September 2026 Critical Patch Update advisory.
Oracle Sales Online, a component of Oracle E-Business Suite, is affected by an easily exploitable flaw in versions 12.2.3 through 12.2.15 that lets a low-privileged attacker with HTTP network access compromise the application and reach data outside its intended boundary (scope change). Successful exploitation can expose critical data or all Oracle Sales Online-accessible data, plus allow unauthorized insert, update, or delete of some records. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle's Critical Security Patch Update advisory (cspusep2026.html) is the authoritative fix reference and the CVSS 3.1 base score of 8.5 reflects high confidentiality and low integrity impact.
Authenticated low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the One-to-One Fulfillment 'Documents' component to read critical data outside their authorized scope and partially degrade availability of the module. The vendor-assigned CVSS 3.1 base score is 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L), reflecting high confidentiality impact with no integrity impact and only partial denial of service; the scope-change flag indicates that exploitation can significantly affect resources beyond the vulnerable component. There is no CISA KEV listing, no public proof-of-concept identified, and no EPSS data supplied, so exploitation is not confirmed to be active at time of analysis.
An adjacent-network attacker holding a low-privileged Oracle E-Business Suite account can fully take over the Oracle One-to-One Fulfillment module (Documents component) in EBS releases 12.2.3 through 12.2.15, with high confidentiality, integrity and availability impact. Exploitation requires the attacker to sit on the physical communication segment serving the host where One-to-One Fulfillment runs, but needs no user interaction and no elevated privileges once there, making a single craftable request sufficient for complete compromise of the module. No public exploit code and no CISA KEV listing were present in the available intelligence at time of analysis, and no EPSS score was supplied to quantify real-world exploitation likelihood.
Unauthenticated attackers who can reach the One-to-One Fulfillment module of Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP can achieve complete takeover of that component, with high confidentiality, integrity, and availability impact (CVSS 8.1). Oracle characterizes the flaw as difficult to exploit (AC:H), which tempers the unauthenticated network attack vector, and the issue resides in the module's Java Server layer. No public exploit code and no CISA KEV listing were identified at time of analysis, and Oracle published the fix as part of its September 2026 Critical Security Patch Update.
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An unauthenticated remote attacker with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can bypass access controls in the Oracle Application Object Library (FND) Core component and read critical application data, per Oracle's own disclosure (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/C:H/I:N/AN). The flaw is fully automatable — no credentials, no user interaction, low complexity — making it attractive for mass scanning, though its impact is limited to confidentiality (no integrity or availability loss). No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, but no EPSS score was supplied, so real-world exploitation probability is unquantified.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a broken-authorization flaw in the Customer Interaction History module (Outcome-Result component) that allows a low-privileged user with HTTP access to read data well outside their intended privileges. Exploitation is trivial once an attacker holds any valid low-privileged EBS account, and Oracle's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) marks it as an easily exploitable, confidentiality-only issue whose scope change means other EBS modules can be affected. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical risk is driven by the enormous blast radius of an ERP holding financial, HR and customer records rather than by confirmed active exploitation.
Oracle E-Business Suite releases 12.2.3 through 12.2.15 allow a low-privileged, authenticated user with network access to the HTTPS interface to take over the Customer Interaction History module, compromising confidentiality, integrity and availability of that component's data. No public exploit code has been identified and the CVE is not listed in CISA KEV, but the attack is network-reachable with low complexity and no user interaction, so a single valid account is the only real barrier. Exploitation probability metrics (EPSS) were not supplied with this record, so real-world activity cannot be quantified from the available data.
Authenticated low-privileged users can fully compromise the Customer Interaction History module (Outcome-Result component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 over HTTP, achieving complete loss of confidentiality, integrity and availability of that module. Oracle rates the issue 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker needs only a valid low-privilege account and no user interaction, making the barrier to exploitation low for anyone who already holds any EBS login. No public exploit code has been identified and the flaw does not appear in CISA KEV at time of analysis, but the Oracle Critical Patch Update reference (cspusep2026.html) indicates a vendor fix is published and patching should follow normal CPU urgency for internet-facing EBS deployments.
Network-reachable file-upload flaws in Oracle E-Business Suite's Application Object Library (Attachments component, versions 12.2.3 through 12.2.15) allow a low-privileged authenticated user to take over the affected component, earning a CVSS 3.1 base score of 8.8 with High confidentiality, integrity and availability impact and no user interaction. Exploitation needs only a valid low-privilege EBS account plus HTTP access — no privileged role, no crash, no victim action — which makes it an attractive post-authentication escalation path inside ERP deployments. No public exploit code or CISA KEV entry has been identified at time of analysis, and Oracle's cspusep2026 Critical Patch Update is the authoritative fix source.
Unauthenticated attackers able to reach the HTTPS interface of Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the Oracle Application Object Library (Core component) to create, delete, or modify critical data and to read data they should never see. The CVSS 3.1 base score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), meaning no credentials or user interaction are needed but successful exploitation depends on conditions the attacker must satisfy. No public exploit code has been identified and the flaw is not listed in CISA KEV, so it should be treated as a high-severity patch obligation rather than an actively exploited emergency.
Authenticated low-privileged users can compromise Oracle Project Intelligence within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) over HTTP, gaining unauthorized create, delete, and modify access to critical data along with read access to a subset of application data. Oracle rates the issue CVSS 3.1 base 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), reflecting a trivial-to-execute, low-privilege attack whose dominant impact is data integrity rather than availability or broad disclosure. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so exploitation status is unconfirmed.
Oracle Database Server releases 23.4.0 through 23.26.3 contain a flaw in the RDBMS component that allows a low-privileged database account holding the Create Table privilege to escalate to full takeover of the database engine over Oracle Net. The attack is network-reachable, requires no user interaction, and carries high confidentiality, integrity and availability impact, producing a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied in the source data, so the immediate driver is the combination of a low privilege bar and complete database compromise rather than confirmed in-the-wild activity.
Oracle E-Business Suite's Applications DBA component (ADPatch) contains a flaw in versions 12.2.3 through 12.2.15 that allows an attacker who already holds a logon on the host infrastructure to take over Applications DBA without presenting Oracle application credentials. Exploitation requires the attacker to persuade another person to perform some interaction (UI:R) and is scored 7.8 with full confidentiality, integrity and availability impact. No public exploit code, EPSS score, or CISA KEV entry was provided in the available intelligence, so active exploitation is unconfirmed at time of analysis.
Oracle E-Business Suite Applications Manager 12.2.3 through 12.2.15 lets a low-privileged attacker who already holds a logon on the host running Applications Manager read and tamper with critical data through the Command Line - RapidClone component. The flaw is a local-only, low-complexity authorization weakness (CVSS 7.1, AV:L/PR:L/UI:N) that yields high confidentiality and integrity impact with no availability impact, and no scoped privilege escalation beyond the component. No public exploit code has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.
Command-line processing in Oracle Applications Manager, a component of Oracle E-Business Suite 12.2.3 through 12.2.15, can be abused by a high-privileged attacker with network access over HTTP to take full control of the Applications Manager host and, because of a scope change, to significantly impact other linked EBS products. Oracle's own vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates that exploitation is difficult and requires an already-elevated account (a privileged operator, administrator, or equivalent account with access to the RapidClone command-line functionality), and no public exploit code or CISA KEV listing has been identified at time of analysis. No EPSS score was supplied with the source data, so the probability of real-world exploitation cannot be quantified from the available intelligence.
A flaw in the Oracle XML Developers Kit (XDK) component bundled with Oracle Database Server lets a low-privileged database account holding the XDKC privilege execute a network-delivered Oracle Net attack that can lead to full takeover of the XDK component, with high confidentiality, integrity and availability impact. Supported releases 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3 are affected. Oracle classifies the issue as difficult to exploit (AC:H) and no public exploit code or CISA KEV entry has been identified at time of analysis, though any user able to obtain XDKC rights is a viable candidate attacker.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contains an easily exploitable flaw that lets a low-privileged attacker positioned on the physical communication segment adjacent to the Siebel Deployment host read critical data and repeatedly crash the service. Successful exploitation yields complete confidentiality loss of all data accessible to Siebel CRM Deployment plus a repeatable denial-of-service condition, per the Oracle CPU advisory. No public exploit code or CISA KEV listing was identified at time of analysis, and EPSS data was not supplied for this CVE.
We need answer JSON only. Need synthesize. Need follow instructions. CVE-2026-83154 Oracle Siebel CRM End User Open UI SOAP vulnerability. Need produce fields. Need careful. We need use all data. Product_name: "Siebel CRM End User" probably. Single 1-3 words? "Siebel CRM End User" is 4 words but maybe product name. They said specific product name. Could use "Siebel CRM" maybe? Affected product is Siebel CRM End User. Use "Siebel CRM" (2 words). But product_name should specific. hmm. Input product: "Siebel CRM End User". 4 words; instruction 1-3 words. Could "Siebel CRM" or "Siebel CRM End User"? Need obey 1-3 words. Maybe "Siebel CRM" is primary product suite but affected is End User. Use "Siebel CRM". Summary: Need not copy description. Mention remote unauth network via SOAP, critical data read/write, no availability impact, CVSS 9.1. No KEV, no POC? Input no KEV/POC. EPSS? Not provided. Need mention POC absent and EPSS unknown/not available. "no public exploit identified..." Use phrase. Start with specific impact verb and product. E.g. "Unauthorized read and write access to critical data in Oracle Siebel CRM End User versions 17.0 through 26.7 can be achieved by an unauthenticated attacker sending SOAP requests over the network." That's good. Include if KEV no. Data: tags Authentication Bypass, Oracle, ENISA. No CWE. Need mention no patch? References has Oracle advisory URL. Likely patch available but not explicit version? We can infer Oracle security alert may include fixes but data no exact fix version. Need remediation maybe advise apply Oracle CPU July 2026? Wait URL cspusep2026 maybe Critical Patch Update? Use vendor advisory. The URL is https://www.oracle.com/security-alerts/cspusep2026.html. "cspusep2026" maybe maybe? Need not invent. We can say "Vendor advisory available; apply Oracle's recommended Siebel CRM fixes from July 2026 Critical Patch Update" even if no exact version. Need avoid inventing exact. "Patch available per vendor advisory" maybe patch
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 can be fully taken over by a low-privileged attacker who can reach the deployment server over HTTPS, with high impact to confidentiality, integrity and availability. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) and describes it as easily exploitable, meaning a valid low-privilege account plus network reachability to the Deployment tier is sufficient — no user interaction and no elevated privileges are required. No public exploit code or CISA KEV entry is associated with this CVE in the supplied intelligence, and no technical root-cause detail (CWE) has been published, so exploitation in the wild is not confirmed.
Improper authorization control in the Oracle Project Intelligence module of Oracle E-Business Suite allows a low-privileged authenticated user with network access to read, create, modify, or delete data across the module, including records the account should never reach. Affected releases are 12.2.3 through 12.2.15; the vendor's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N, base 8.1) indicates the flaw is trivially automatable once credentials exist, because no user interaction is needed. No public exploit code, KEV listing, or EPSS estimate was supplied with the available intelligence, so active exploitation should be treated as unconfirmed rather than assumed.
We need answer JSON only. Need synthesize. Need follow all requirements. Need parse input: CVE-2026-83151, description Oracle Fusion Middleware Service Delivery Platform component Messaging Enabler, affected 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable unauthenticated network via SOAP to compromise, takeover. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. Reported by Oracle. ENISA. References: nvd None? Actually reference URL oracle security alerts cspusep2026.html. Need cross-reference. Need produce fields. Need determine product_name: "Service Delivery Platform" maybe primary product, Oracle Fusion Middleware. 1-3 words only. Could be "Oracle Service Delivery Platform" (3 words). Good. Summary: not copy description. Need original synthesis. Include actively exploited? KEV? Not provided. Input has no KEV field. We must infer KEV status? There's no KEV status in provided. Need use only data. So likely no KEV. POC? not provided. EPSS? not provided. Need say no public exploit identified, EPSS not available perhaps. Summary: remote unauthenticated takeover via SOAP in Oracle Fusion Middleware Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0; CVSS 9.8; component Messaging Enabler. Need not start "A vulnerability". Start with specific impact verb: "Remote unauthenticated attackers can take over Oracle Service Delivery Platform via SOAP requests..." Use no "A vulnerability". Mention no KEV/POC/EPSS? Maybe "No CISA KEV entry or public exploit details were provided in the source data." Good. Technical_context: Underlying SOAP web service in Oracle Fusion Middleware Service Delivery Platform Messaging Enabler. CWE N/A, but maybe CWE unspecified. Use CPE? Input has not explicit CPE strings, just affected versions. Need say no CPE provided in source; version scope from ENVA. Root cause class not identified (CWE N/A). Could mention SOAP interface likely accepts untrusted XML/SOAP leading to compromise; CWE missing, but impact
Local attackers who can log on to a host running Oracle Application Testing Suite 13.3.0.1 can achieve full takeover of the application, with high impact to confidentiality, integrity and availability. The flaw requires human interaction from someone other than the attacker and is rated high complexity, meaning a foothold on the machine plus a successful social-engineering or timing condition is needed rather than a simple remote request. There is no confirmed CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the source data, so current risk is driven by the local-access precondition and Oracle's own assessment rather than evidence of active exploitation.
We need answer JSON only. Need synthesize. Let's inspect input. CVE-2026-83149. Description says Oracle Application Testing Suite supported version affected 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker with Test Manager for Web Apps privilege with network access via HTTP. Scope change. Impacts confidentiality high, integrity low, availability low. CVSS 9.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L. Tags: Authentication Bypass, Denial Of Service, Oracle. References oracle advisory cspusep2026. No patch info? "Affected versions EUVD". No KEV, no POC, no EPSS? Not provided. Need mention missing. Product name: Oracle Application Testing Suite. Summary original synthesis. Need not copy description. Start impact verb and product. "Critical data exposure and limited integrity/availability impact in Oracle Application Testing Suite 13.3.0.1 allows a low-privileged user with Test Manager for Web Apps privilege to access all application data via HTTP, with scope change affecting additional products. No active exploitation or public exploit is identified; patch details are in Oracle CPU." Need mention no KEV, no POC, EPSS missing. Technical context: Oracle Application Testing Suite, HTTP, CWE N/A but likely? Tags authentication bypass. Need explain root cause? We don't have CWE. Use CPE? Not provided but EUVD affected. Oracle ATS. Need educational: web application, privilege/authorization issue? But do not infer too much? Can state "CWE not specified by NVD, but tag Authentication Bypass suggests missing/inadequate authorization checks; root cause class not confirmed." Mention CVSS scope change indicates vulnerable component may be the Test Manager for Web Apps privilege or module, impacting additional products. Risk assessment: Signals: CVSS 9.1 with AV:N AC:L PR:L UI:N S:C C:H I:L A:L. EPSS not provided. KEV absent. POC absent. So compare: high CVSS due to network low complexity and scope change; but requires low privileged with specific Test
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by an attacker who already controls a low-privileged account holding the 'Test Manager for Web Apps' role: a crafted HTTP request traverses a privilege boundary and grants control of the platform with high confidentiality, integrity and availability impact (CVSS 8.8). Because the vector is AV:N/AC:L/PR:L/UI:N, exploitation is network-reachable and needs no user interaction but does require valid low-privilege credentials, so credential theft or reuse is the practical entry point. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied with this record.
Local privilege escalation and full takeover in Oracle PeopleSoft Enterprise FIN Inventory Brazil 9.1, where any attacker holding a valid low-privileged logon to the host running the application can compromise confidentiality, integrity and availability of the Inventory component entirely. Because the flaw is reached via local access (AV:L, PR:L, UI:N) with low attack complexity, it is most relevant to insider threat, shared-host environments and post-compromise lateral movement on PeopleSoft infrastructure rather than to internet-facing attackers. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied.
Oracle Siebel CRM 17.0 through 26.7 exposes a flaw in the Open UI component that lets a low-privileged, network-positioned attacker compromise a victim's Siebel CRM End User session once that victim is persuaded to interact with attacker-supplied content. Successful exploitation yields unauthorized read, creation, deletion or modification of critical and otherwise inaccessible CRM data, and the scope-change (S:C) rating means the fallout can extend to products beyond Siebel CRM End User itself. Rated CVSS 7.7 with high attack complexity, the bug is difficult to exploit reliably, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Low-privileged attackers with network access to the Siebel Apps - Customer Order Management module (Order Management component) in Oracle Siebel CRM versions 17.0 through 26.7 can craft HTTP requests that, once a second user is induced to interact, allow unauthorized read, creation, modification, and deletion of critical order data, with a scope change that can propagate impact to connected products. The flaw carries a CVSS 3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), but no EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so active exploitation is not confirmed (no public exploit identified at time of analysis). It is an easily exploitable, low-complexity issue, making patch deployment a high priority for any organization running an affected Siebel release.
We need to produce JSON. Need to include "walbrzych" only in risk_assessment, lowercase, woven naturally once. Let's craft. Let's think about CVE-2026-83144. Oracle Siebel CRM, Siebel Apps - Customer Order Management, component Order Management. Versions 17.0-26.7. CVSS 8.7 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. Low privileged attacker with network access via HTTP, requires human interaction from a person other than attacker, scope change. Tags: Authentication Bypass, Oracle. Hmm "Authentication Bypass" tag though CVSS PR:L (low privileged) — so maybe mislabeled? Actually PR:L means authenticated low privilege. Authentication Bypass tag might be mislabeled? The vulnerability might allow bypass but CVSS says PR:L. It's Oracle CPU (Critical Patch Update) - cspusep2026.html maybe "Oracle Siebel CRM" something. Reference: https://www.oracle.com/security-alerts/cspusep2026.html. Note "cspusep2026" — likely "Oracle Critical Patch Update Advisory - ..." Hmm, the URL pattern for Oracle is like https://www.oracle.com/security-alerts/cpujan2026.html. "cspusep2026" unusual. Actually might be a typo in input "cspusep2026". Anyway. CWE: N/A. Description says unauthorized creation, deletion, modification + unauthorized access to critical data. C:H/I:H/A:N. So confidentiality and integrity high, availability none. Product name: "Oracle Siebel CRM" or "Siebel CRM"? 1-3 words. "Oracle Siebel CRM" is 3 words. Good. Summary: Must not start with "A vulnerability". Start with impact + product. "Low-privileged attackers with HTTP access to Oracle Siebel CRM's Customer Order Management module 17.0 through 26.7 can exploit an order management flaw requiring victim interaction to read and modify critical data, with scope change impacting other products." Mention KEV? No KEV. POC? No POC. EPSS? No EPSS provided. So mention no public exploit identified at time of analysis. Maybe: "No public exploit code or CISA KEV listing is currently associated with this CVE, though the CVSS score of 8.7
Unauthenticated network attackers can bypass authentication in the eDetailing component of the Siebel Apps - Life Sciences module shipped with Oracle Siebel CRM, affecting versions 17.0 through 26.7, and gain both read and write access to critical CRM data — provided a human other than the attacker is induced to interact with a crafted HTTP request. Oracle scores this 8.1 (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:N), reflecting full confidentiality and integrity compromise but no availability impact and only the Life Sciences vertical exposed. No public exploit code or active exploitation has been identified at time of analysis, and the vendor advisory is Oracle's September 2026 Critical Security Patch Update (cspusep2026.html).
Improper access control in Oracle Proposals, a module of Oracle E-Business Suite (component: Internal Operations), lets a low-privileged, authenticated attacker reach data outside their authorization boundary over HTTP. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields unauthorized read access to critical Oracle Proposals data with a scope change that can extend impact to other EBS-backed products. Oracle rates the issue 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code or CISA KEV entry is present in the supplied intelligence, so it should be treated as an unpatched-window exposure rather than a confirmed in-the-wild campaign.
Low-privileged, network-reachable users of Oracle Field Service can read data far beyond their authorized scope in Oracle E-Business Suite releases 12.2.3 through 12.2.15, potentially reaching critical data across additional products because the flaw crosses a security scope boundary (CVSS 3.1 7.7, C:H only). The vulnerability is exploitable over HTTP with no user interaction once a low-privileged session exists, and no public exploit code or active exploitation is identified at time of analysis. Oracle has published a Critical Security Patch Update advisory covering this issue; there is no CISA KEV listing and no EPSS score was supplied in the source data.
A high-severity flaw in the Internal Operations component of Oracle Spares Management, part of Oracle E-Business Suite, lets a high-privileged attacker who already holds a valid EBS account and HTTP network access take over the Spares Management module and pivot into connected products. All supported 12.2.3 through 12.2.15 releases are affected, and because the flaw is rated hard to exploit (AC:H) the window for a successful attack depends on satisfying a specific, currently undisclosed technical precondition. No CISA KEV listing, public exploit code, or EPSS score was provided, so the risk is driven by the CVSS 8.0 impact profile and the breadth of EBS deployments rather than by observed exploitation.
Oracle Spares Management, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged authenticated user with HTTP network access take full control of the module. Versions 12.2.3 through 12.2.15 are affected, with a CVSS 3.1 base score of 8.8 reflecting high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis, and no EPSS score was provided, so real-world exploitation status cannot be confirmed from available data.
Authenticated but only low-privileged access to the Oracle Spares Management module in Oracle E-Business Suite 12.2.3 through 12.2.15 is sufficient to seize full control of that module, with high confidentiality, integrity and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The weakness sits in the module's Internal Operations component and is reachable over HTTP with no user interaction required, which makes it practically exploitable by anyone who already holds a valid EBS account. No CISA KEV entry, public exploit code or EPSS score was supplied, so active exploitation and real-world prevalence of attacks remain unconfirmed
Oracle iStore, the e-commerce/shopping cart module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exposed to a cross-site style attack in which a low-privileged authenticated attacker with HTTP network access can induce a second user to interact with crafted content and thereby gain unauthorized read, create, modify, and delete access to iStore data — with the vendor warning the impact can extend to other EBS products. With CVSS 3.1 base 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), the flaw is trivially automatable once an attacker holds any low-privileged account, but exploitation still hinges on victim interaction, which materially lowers real-world risk. No public proof-of-concept, EPSS estimate, or CISA KEV entry was present in the supplied intelligence, so exploitation is assessed as not confirmed in the wild at time of analysis.
Low-privileged users of Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can reach data they should not be able to read through the Shopping Cart component over HTTP. Successful exploitation results in unauthorized access to critical data or complete read access to everything the iStore application can reach, and because the flaw carries a scope change it can also significantly affect other E-Business Suite products. Oracle rates it CVSS 3.1 7.7 (confidentiality only, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated information disclosure in Oracle iStore (Shopping Cart component) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a remote attacker with plain HTTP access read critical data exposed through the storefront, up to and including all data reachable by the iStore application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is trivially automatable given the network vector and lack of credentials or user interaction. No CISA KEV entry, EPSS score, or public proof-of-concept was present in the supplied intelligence, so exploitation is assessed as possible but not confirmed in the wild at time of analysis.
Authenticated, low-privileged attackers with HTTP access to Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can read, create, modify, or delete critical shopping-cart, order, and customer data, giving them full read and write reach into all iStore-accessible records. The flaw sits in the Shopping Cart component and is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is remotely reachable over HTTP with no user interaction and only a low-privilege account. No CISA KEV listing and no public exploit code were identified at time of analysis, so exploitation is currently presumed opportunistic rather than confirmed in the wild.
Oracle Web Applications Desktop Integrator (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) exposes a file download weakness that lets a low-privileged, network-connected user retrieve data they should not be able to reach. Exploitation is rated 'easily exploitable' by Oracle — HTTPS network vector, low complexity, no user interaction — and because the flaw can cross a security boundary (CVSS scope change), successful abuse may expose critical data belonging to other EBS components, not just the Desktop Integrator. CVSS 3.1 base score is 7.7 with confidentiality-only impact; no public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
We need to produce a JSON object with the specified fields. Need to include "legnica" in risk_assessment field only, as lowercase, woven naturally. Let me parse the data: CVE-2026-83130: Oracle Site Hub product of Oracle E-Business Suite, component: Internal Operations. Affected versions 12.2.3-12.2.15. CVSS 3.1 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. CWE: N/A. Tags: Authentication Bypass, Oracle. EUVD ID EUVD-2026-79458. References: nvd link to Oracle security alert cspusep2026.html. No EPSS, no KEV, no POC mentioned. Need product_name: 1-3 words. "Oracle Site Hub" (3 words). Or "Oracle E-Business Suite"? The specific product is Oracle Site Hub, part of E-Business Suite. I'd pick "Oracle Site Hub". Summary: 2-3 sentences plain-language for security professionals, original synthesis, not copy description. Start with specific impact verb and product. E.g., "Low-privileged attackers with network access can modify or delete critical Oracle Site Hub data..." Mention no KEV, no POC. EPSS not provided, so can't mention. But note EPSS risk if notable — none provided. Technical context: Oracle Site Hub within Oracle E-Business Suite 12.2, component Internal Operations, versions 12.2.3 to 12.2.15. CWE N/A — likely access control issue given Authentication Bypass tag. Explain E-Business Suite is a large ERP, Site Hub is a real estate/lease management module? Actually Oracle Site Hub is part of EBS for site/location management. The vulnerability allows low privileged attacker with network access via HTTP to compromise. Root cause probably improper authorization/access control (CWE-284 or CWE-863) leading to integrity impact. But CWE is N/A in input, so note that. Risk assessment: CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N — network attack vector, low complexity, low privileges required (authenticated as low-priv user), no user interaction, scope unchanged, low confidentiality, high integrity, no availability. EPSS not provided. KEV not listed. POC not mentioned. SS
Oracle Sales, the sales module of Oracle E-Business Suite (supported versions 12.2.3 through 12.2.15), exposes critical business data to any low-privileged authenticated user who can reach its HTTP interface. A crafted request against the Internal Operations component bypasses the intended access boundary, and because the CVSS vector carries a scope change (S:C), the exposure is not limited to Oracle Sales — data reachable through additional Oracle products can be read as well. Oracle classifies it as 'easily exploitable' (AV:N/AC:L/PR:L/UI:N, CVSS 3.1 base 7.7, confidentiality-only impact); no public exploit code, EPSS score, or CISA KEV entry was provided in the source data.
Unauthenticated remote attackers with HTTP access to Oracle Sales Offline, a module of Oracle E-Business Suite, can read any data the application exposes on affected versions 12.2.3 through 12.2.15. The flaw sits in the Internal Operations component and requires no credentials, no user interaction and no non-default configuration, yielding a 7.5 confidentiality-only CVSS base score. Exploitation is highly automatable and attractive for bulk data theft, though at the time of analysis there is no public exploit code and no confirmed exploitation (no CISA KEV listing); EPSS is not available in the supplied intelligence.
Oracle Sales Offline, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged authenticated user with HTTP access read critical data far beyond their intended authorization, and Oracle's own scoring marks the impact as a scope change, meaning the flaw in this component can also reach data owned by other EBS products. The CVSS 3.1 base score is 7.7 with high confidentiality impact and no integrity or availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis.
Low-privileged attackers with network access over HTTP can compromise Oracle Sales Online in Oracle E-Business Suite releases 12.2.3 through 12.2.15, exposing critical sales data and allowing limited modification of records. Exploitation requires that a low-privileged account already be held and that a second person (not the attacker) be induced to interact with the application, yet the flaw's scope change means a successful attack can ripple into other E-Business Suite components beyond Sales Online itself. It carries a CVSS 3.1 base score of 7.6, but there is no CISA KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied in the intelligence feed.
Oracle Report Manager, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP. The flaw sits in the Internal Operations component and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity, and availability for the Report Manager component with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data, but the low privilege bar and network reachability make this a strong candidate for post-authentication lateral movement inside an EBS environment.
Oracle Sales Online, a module of Oracle E-Business Suite, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP; the flaw sits in the 'Internal Operations' component and is rated 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with high confidentiality, integrity and availability impact across versions 12.2.3 through 12.2.15. Exploitation needs no user interaction and no elevated privileges, only a valid low-privilege login, making any internet- or partner-facing EBS deployment with this module enabled a realistic target. No public exploit code and no CISA KEV listing were identified at time of analysis, so the immediate driver is exposure and patch lag rather than observed in-the-wild activity.
Oracle Report Manager, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes an internal-operations flaw that lets a low-privileged attacker with HTTPS network access read critical data and degrade service availability. Successful exploitation yields high confidentiality impact against all Report Manager-accessible data plus partial denial of service, giving the flaw a 7.1 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is not confirmed to be active; risk is concentrated in internet- or broadly-reachable EBS Report Manager deployments where ordinary authenticated users exist.
Oracle Report Manager — the reporting and output-management product within Oracle E-Business Suite — can be taken over by an attacker who already holds a low-privileged account on the same instance and can reach the application tier over HTTPS. Affected releases are E-Business Suite 12.2.3 through 12.2.15, covering a very long-lived branch of the ERP platform (per the EUVD record and Oracle's Critical Security Patch Update advisory). Successful exploitation yields full read, write and denial-of-service impact on the Report Manager component (CVSS 3.1 base 8.8: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no EPSS score, CISA KEV entry, or public proof-of-concept is present in the supplied intelligence, so exploitation status should be treated as unconfirmed.
Oracle Marketing, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), contains an easily exploitable flaw in its Audience component that lets a low-privileged attacker with HTTP network access fully compromise the application, resulting in complete loss of confidentiality, integrity, and availability. Oracle's own advisory classifies the issue as takeover-level, and because the attack requires only an authenticated low-privilege account with no user interaction, any tenant with self-service or limited marketing roles should treat it as a priority. No public exploit code or CISA KEV entry was provided in the source data, so active exploitation is not confirmed at time of analysis.
Oracle Alert, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be taken over by an attacker holding only a low-privileged account with HTTP access to the application. Because the flaw sits in the Internal Operations component and requires no user interaction, any valid low-privilege EBS user can reach it and obtain full read/write control over Alert data and functionality, with high confidentiality, integrity and availability impact (CVSS 8.8). There is currently no public exploit code or confirmed in-the-wild exploitation (no CISA KEV listing), but Oracle's out-of-band Critical Security Patch Update is the only authoritative fix, and internet-exposed EBS deployments should treat the missing authentication boundary as the primary risk.
A low-privileged, network-reachable flaw in the Internal Operations component of Oracle User Management (part of Oracle E-Business Suite 12.2.6 through 12.2.15) lets an attacker who already holds a valid low-privileged account take full control of the User Management module. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N), effectively amounting to a takeover of the user-provisioning and authorization layer of the ERP. No public exploit code and no CISA KEV listing were identified at time of analysis, so this should be treated as a patch-now, high-severity issue rather than a confirmed active campaign.
Local privilege escalation in Oracle E-Business Suite's Applications DBA (AD Utilities) lets any attacker holding a valid low-privileged logon on the tier where AD Utilities executes take complete control of the component, with full confidentiality, integrity and availability impact on the affected schemas and utilities. Only versions 12.2.3 through 12.2.15 are affected, and exploitation requires prior host access rather than reachability over the network, so the realistic threat is an insider, a compromised application-tier service account, or a post-exploitation escalation step. No public exploit code was identified and the flaw is not listed as confirmed actively exploited (CISA KEV), so risk is driven by the value of the EBS environment and who already holds a login on that infrastructure.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Applications DBA (AD Utilities) component that lets a high-privileged attacker with network access over HTTP take full control of the Applications DBA subsystem. According to Oracle's advisory language the issue is 'easily exploitable,' meaning low attack complexity once the required privileges are held, and successful exploitation delivers high confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). No public exploit code or CISA KEV entry is present in the supplied intelligence, so exploitation appears limited to attackers who already hold an Applications DBA-level account rather than remote unauthenticated adversaries.
Oracle E-Business Suite Order Management (versions 12.2.5 through 12.2.15) exposes order data through its Product Diagnostic Tools component to any low-privileged user who can reach the HTTP interface. The flaw is easily exploitable — network vector, low complexity, no user interaction — and Oracle notes the impact can spread beyond Order Management into interconnected products, resulting in unauthorized access to critical data or complete access to all Order Management data. No public exploit code or CISA KEV listing was provided at time of analysis; no patch version is specified in the available references beyond the linked Oracle advisory.
Unauthenticated remote attackers can read sensitive data from Oracle Applications Manager within Oracle E-Business Suite 12.2.3 through 12.2.15 by sending crafted HTTP requests to the RapidClone command-line component. The issue is scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning exploitation needs no credentials, no user interaction, and only affects confidentiality — an attacker gains unauthorized access to critical data or all data reachable through Applications Manager. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis, so exploitation appears opportunistic rather than confirmed in the wild.
Oracle Quality, a module of Oracle E-Business Suite, contains a difficult-to-exploit flaw in its Internal Operations component affecting versions 12.2.3 through 12.2.15, allowing a low-privileged attacker with network access via HTTP to take over the module with full confidentiality, integrity and availability impact. Oracle's own advisory rates it CVSS 7.5 with attack complexity High and privileges required Low, meaning an attacker must already hold a valid low-privilege account but can reach the vulnerable code remotely over HTTP. No public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not supplied in the intelligence feed, so real-world exploitation likelihood cannot be quantified from that signal.
Low-privileged authenticated users with HTTP access to Oracle Quality in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Quality records and make limited unauthorized changes to them, because the Internal Operations component fails to enforce proper authorization on its requests. Oracle scores this 7.1 with a network vector, low attack complexity and no user interaction, so exploitation is straightforward for anyone who already holds any valid EBS account. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied in the input.
Oracle Lease and Finance Management, a finance module within Oracle E-Business Suite, can be fully taken over by a high-privileged user who sends crafted HTTP requests to its Internal Operations component in versions 12.2.7 through 12.2.15. Successful exploitation yields complete loss of confidentiality, integrity and availability for the module (CVSS 3.1 base 7.2), meaning an attacker could read and alter lease, financing and contract data and disrupt related business processes. The attack is rated easy to perform once the required privileged account and network path exist, but exploitation is gated behind high privileges, and no public exploit code or CISA KEV listing was identified at the time of analysis.
Low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can leverage a hard-to-reach flaw in the Oracle Partner Management module (Internal Operations component) to read critical data and modify records far beyond their authorization, with the impact crossing into other EBS components because the vulnerability carries a scope change. Oracle rates it CVSS 7.1 and characterizes it as difficult to exploit, and a fix is published in the 2026 Critical Patch Update. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote attackers can read any data reachable through the Audience component of Oracle Marketing in Oracle E-Business Suite versions 12.2.3 through 12.2.15 by sending crafted HTTP requests, with no user interaction required. The flaw is scored 7.5 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N) and is confidentiality-only - integrity and availability of the affected module are unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS probability was supplied with the source data.
We need answer as JSON only. Need synthesize. Need obey. Let's parse input. CVE-2026-83108 Oracle Forms Fusion Middleware. Description: Vulnerability in Oracle Forms product component Forms Services, C/S, Charmode. Supported versions affected 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Successful attacks result in takeover of Oracle Forms. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. But CVSS impacts C/I/A all high, description "takeover" seems maybe more than information disclosure. Tags may be mislabeled? Data quality flags? We can flag "Information Disclosure" as mislabeled_tag? Need careful. CVE description says complete compromise/takeover, impacts C/I/A. "Information Disclosure" tag likely insufficient/wrong. But type mislabeled_tag target "Information Disclosure" suggested maybe "Remote Code Execution"? Is that verifiable? Description says "takeover of Oracle Forms" with high C/I/A. Oracle tags maybe possibly "Critical Patch Update" not technique. But tag "Information Disclosure" is wrong likely. We can include data_quality_flags with mislabeled_tag target "Information Disclosure", suggested maybe null? We need suggested canonical slug if known. Could be "remote-code-execution"? But not explicitly RCE, just takeover. Could be "authentication-bypass"? Hmm. Do not invent. Maybe omit? Actually "mislabeled_tag": target "Information Disclosure" exact wrong. suggested maybe null, confidence medium? Reason: description and CVSS indicate full compromise not just info disclosure. But rule says only if verifiable from references/product. We cannot verify exact correct tag. Could say "mislabeled_tag" confidence medium. But maybe data quality flags only high confidence. The instruction: "only emit a flag when input metadata is clearly wrong and verifiable." Is "Information Disclosure" clearly wrong? Yes description sa
We need answer JSON only. Need synthesize. We have CVE-2026-83107 Oracle Forms component Forms Services, C/S, Charmode. Affected 12.2.1.19.0, 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker network via HTTP to compromise Oracle Forms. Scope change significant impact additional products. Successful attacks result in takeover Oracle Forms. CVSS 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. ENISA EUVD. Reference oracle security alert cspusep2026 (critical patch update?). Need produce fields. Need be careful: Description from Oracle says "high privileged attacker with network access via HTTP" PR:H. But "easily exploitable" AC:L. Impact CIA high, scope changed. Vulnerability type not specified; tags says Information Disclosure. Could be some vulnerability in Forms Services C/S Charmode. Need not invent CWE. Need infer root cause? We don't have CWE. Technical context: Oracle Forms part of Fusion Middleware, used for building enterprise apps, web-deployed Java applets? Forms Services, C/S client/server charmode. Need explain. CPE data? Input lacks CPE strings? It says CPE strings in prompt but no CPE lines. Could use affected versions. No CWE. We can say CWE not provided; root cause class unknown, but Oracle tag info disclosure suggests potentially discloses sensitive data leading to takeover? Wait CVSS says C/I/A high and scope change. With high priv attacker. Possibly a deserialization? But no. We must not infer beyond data. We can note CWE missing. Need risk assessment. CVSS 9.1 but PR:H reduces; EPSS missing, KEV? no KEV provided, POC no. Need state "no public exploit identified at time of analysis"; "KEV status not provided; not listed? Actually no KEV field; we can only say no KEV listing in provided data, but absence not confirmation? We can state "Active exploitation not indicated in provided data; no CISA KEV status provided" maybe. Need not overclaim. Multi-source includes ENISA EUVD. Refere
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 can be fully taken over by a low-privileged, network-positioned attacker who reaches Forms Services over HTTP. Oracle rates the flaw difficult to exploit (AC:H) but complete in impact, with high confidentiality, integrity and availability loss once triggered. No public exploit code has been identified and the issue is not listed in CISA KEV, so current risk is driven by the value of Forms-based business applications rather than by observed exploitation.
We need answer JSON only. Need synthesize. We have CVE description. Need fill fields. Let's parse input. CVE-2026-83105. Oracle Forms product of Oracle Fusion Middleware component Forms Services, C/S, Charmode. Supported versions 12.2.1.19.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Scope change, may significantly impact additional products. Successful attacks result in takeover of Oracle Forms. CVSS 3.1 9.0 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Reported by Oracle. Tags: Information Disclosure, Oracle. ENISA EUVD ID. Affected versions. References [nvd] (None) https://www.oracle.com/security-alerts/cspusep2026.html. No KEV, no POC, no EPSS data? Input lacks EPSS/KEV/POC. Need use all data. We can mention EPSS not provided, KEV not listed, POC not identified. Need not invent. Need product_name 1-3 words: "Oracle Forms" (2 words). Summary original synthesis: "Remote code execution/takeover? The description says result in takeover of Oracle Forms, C/I/A impacts. Difficult to exploit unauthenticated network HTTP. Scope change. Affected Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. No KEV/POC; EPSS unknown. Tags include Information Disclosure but CVSS C/I/A high suggests full compromise, maybe information disclosure? Need be precise: "Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a difficult-to-exploit unauthenticated HTTP vulnerability that can lead to full takeover..." Avoid copying description. Mention actively exploited? No: no public exploit identified. EPSS absent, KEV absent. Could say "At time of analysis no public exploit or active exploitation is identified; EPSS is not provided.". Technical_context: underlying technology: Oracle Forms part of Fusion Middleware, Forms Services/C/S (client/server), Charmode. HTTP network vector. CWE N/A. Root cause class not specified. We can explain Oracle Forms runtime for building enterprise apps, forms services exposed ov
We need answer with JSON only. Need synthesize. Let's parse input. CVE-2026-83104. Description: Vulnerability in Oracle Forms product of Oracle Fusion Middleware. Component Forms Services, C/S, Charmode. Supported versions affected 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Forms. Successful attacks result in unauthorized creation, deletion or modification access to critical data or all Oracle Forms accessible data and unauthorized access to critical data or complete access to all Oracle Forms accessible data. CVSS 3.1 Base Score 9.1 C/I H, A N. Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. CWE N/A. Multi-source: Reported by Oracle. Tags: Authentication Bypass, Oracle. ENISA EUVD ID. Affected versions. References oracle security alerts cspusep2026. No KEV, no EPSS in prompt? No POC. Patch availability? Reference is Oracle advisory likely includes patches. We need infer. Need produce fields. Need product_name: "Oracle Forms" 1-3 words. Good. Summary: original synthesis. Mention remote unauthenticated network via TCP, data confidentiality/integrity high. Not KEV, no POC identified. "Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a network-exploitable issue in Forms Services that lets unauthenticated attackers over TCP read and modify critical data." Need avoid starting with "A vulnerability". Start impact verb: "Unauthenticated remote attackers can compromise Oracle Forms..." Good. Mention no active KEV/public exploit identified. Technical_context: Oracle Forms part of Fusion Middleware, client/server/charmode forms services, TCP protocol. CWE N/A but tag Authentication Bypass; likely missing auth. CPE absent but product identity from affected versions. Need educational and specific. Could mention Oracle Forms runs forms applications, communicates over TCP with Forms Services, C/S and character mode deployments. Root cause likely authentication bypass (tag)
We need answer JSON only. Need analyze. We have CVE. Need produce fields. Let's inspect data. CVE-2026-83103 Oracle Forms product Oracle Fusion Middleware component Forms Services, C/S, Charmode. Versions 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Forms. Scope change; takeover of Oracle Forms; CVSS 3.1 Base 9.1 vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. No CWE. Reported by Oracle. EUVD. References oracle security alerts cspusep2026. Need synthesize. Need product_name: Oracle Forms. Summary original synthesis not paraphrase description. Mention high privilege HTTP, takeover, scope change, no KEV/POC? Input no KEV/POC/EPSS? We need use all data. Since no KEV, no EPSS given. CVSS 9.1. Need risk. technical_context: Oracle Forms part Fusion Middleware, C/S/charmode? CWE N/A. CPE? Actually input no CPE strings shown except EUVD versions and "CPE strings"? Prompt says use CPE data but none present maybe in input absent. We can say no CPE provided. Affected products include versions. Remdiation: Vendor advisory exact maybe patch. References oracle advisory, likely patch available. But no exact patch version. Use "Patch available per vendor advisory" since vendor advisory likely. Need be cautious: absence exact fix. Oracle Critical Patch Update? URL cspusep2026 likely Critical Patch Update for Oracle Supply Chain? But no patch version. Remediation: refer to Oracle security alert, apply patch for Oracle Forms 12.2.1.19.0/14.1.2.0.0; monitor. Need no bullet. Exploit scenario: high privileged attacker via HTTP, compromised account, exploit Forms services, pivot due scope change to other products? Actually scope change affects additional products; takeover Oracle Forms. Need attack chain maybe 3-5 steps. Since high priv, network HTTP; Attack chain: Authenticate with high privileges → Send crafted HTTP request to Forms Services → Exploit flaw
Unauthenticated network attackers can reach Oracle Forms Services (including the C/S and Charmode components) over HTTP and achieve unauthorized access to, or modification and deletion of, critical data held in the application, in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. Oracle rates the issue 7.4 with high confidentiality and integrity impact but explicitly characterizes it as difficult to exploit (AC:H), meaning a favorable timing or state condition is required rather than simple request replay. At the time of analysis there is no confirmed CISA KEV listing and no public exploit code identified; exploitability details remain largely undisclosed by the vendor.
Unauthenticated remote attackers able to reach the Oracle Forms Services HTTP listener can fully compromise Oracle Forms deployments in Oracle Fusion Middleware 12.2.1.19.0 and 14.1.2.0.0, gaining complete control of confidentiality, integrity and availability of the affected service (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N). The flaw resides in the Forms Services, C/S and Charmode component set and is described by Oracle as difficult to exploit, meaning success depends on specific timing or state conditions rather than a trivial one-shot request. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the current exploitation signal is theoretical rather than confirmed in the wild.
We need answer JSON only. Need synthesize. Let's inspect CVE data. CVE-2026-83100 Oracle Forms Oracle Fusion Middleware. Description: vulnerability in Oracle Forms product of Oracle Fusion Middleware component Forms Services, C/S, Charmode. Versions affected 12.2.1.19.0, 14.1.2.0.0. Easily exploitable unauthenticated attacker network via HTTP compromise Oracle Forms. Successful attacks result in takeover. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. ENISA EUVD. Reference Oracle advisory. Need fields: product_name: "Oracle Forms" (specific). summary: original synthesis. Mention critical unauthenticated HTTP vulnerability in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows complete takeover. No KEV, no POC in input — must say no public exploit identified? We have only references. EPSS not provided. Should mention EPSS unknown? risk assessment. Summary: "Critical unauthenticated compromise in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows remote attackers with HTTP access to fully take over affected instances; CISA KEV is not reporting active exploitation and no public exploit code is identified in the provided data." That avoids starts with A vulnerability. Need product. Use active? "Remote takeover of Oracle Forms is possible via HTTP..." Good. technical_context: Underlying technology: Oracle Forms part of Oracle Fusion Middleware, Forms Services, client/server/charmode runtime. Component. CWE N/A. No CPE strings provided. Explain root cause class not specified; likely issue in Forms Services that allows unauthenticated takeover. We cannot speculate. CPE absent, affected versions from EUVD. Reference CWE N/A. Be educational: Oracle Forms is long-standing application framework; Forms Services handles HTTP/HTTPS communication for web deployed forms. C/S and charmode maybe character mode. Root cause not disclosed. We can say CVSS indicates network exploitable no privileges user interaction, scope unchanged, high impact all
We need answer JSON only. Need synthesize. Let's parse input. CVE ID CVE-2026-83099 maybe future? Oracle Forms vulnerability. Description: Oracle Forms product of Oracle Fusion Middleware, component Forms Services, C/S, Charmode. Supported affected 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Scope change. Successful attacks can result in takeover of Oracle Forms. CVSS 3.1 Base Score 10.0 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. CWE N/A. Reported by Oracle. Tags: Information Disclosure, Oracle. References: nvd None? Oracle security alert cspusep2026. Multi-source includes ENISA. No KEV, POC, EPSS? Not provided. We need every field plain string, JSON object. Ensure product_name 1-3 words: "Oracle Forms". Summary original not copy. Technical context. Risk assessment use all signals; no KEV/POC/EPSS data missing. Affected products. Remediation. Exploit scenario. Exploitation conditions. Attack chain. confidence notes. data quality flags array. prevalence. prevalence_basis. assessed_cvss_vector and cvss40. Need adhere. Key issue: CWE N/A but description maybe not info disclosure? Tags include Information Disclosure though CVSS says confidentiality impact high. We need maybe flag mislabeled tag? Hmm data quality flags: Tags "Information Disclosure, Oracle" maybe product Oracle correct. But vulnerability described takeover, Oracle Forms; "Information Disclosure" tag might be inaccurate? CVSS impacts C/I/A high, scope change, not only information disclosure. But tag can be a technique? They say tags: Information Disclosure, Oracle. Could be mislabeled? Need be cautious. The system asks emit only if clearly wrong. Tag "Information Disclosure" on a vulnerability with full C/I/A and takeover of Oracle Forms might be too narrow/mislabeled. But "Information Disclosure" maybe from EUVD or tag system? Could be wrong if impact includes more. However we don't know maybe the u
We need answer with JSON only. Need synthesize. We have CVE, description Oracle Forms product of Oracle Fusion Middleware, component Forms Services, C/S, Charmode. Versions 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable unauthenticated network via HTTP compromise Oracle Forms, takeover. CVSS 9.8 vector. CWE N/A. Tags Information Disclosure, Oracle. ENISA. References Oracle advisory. Need produce fields. Need obey all rules. product_name: Oracle Forms. summary original not copy desc; start impact verb and product. Could say "Takeover of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 via unauthenticated HTTP attacks allows attackers to fully compromise affected instances." Maybe mention tags information disclosure? But summary who affected what attacker can do. KEV? Input no KEV field. POC unknown. EPSS? Not provided. Need no mention? "No public exploit identified at time of analysis" maybe. Could mention "EPSS not available" maybe. Since critical to include if notable. Let's craft 2-3 sentences. Technical_context: Oracle Forms, part of Fusion Middleware, component Forms Services C/S Charmode, HTTP; CPE absent but affected versions identified. CWE N/A. We can say root cause class not disclosed in CVE data, but advisory suggests critical HTTP-accessible component. Need be educational. Mention C/S (client/server) and Charmode deployments; Forms Services runtime accessible over HTTP. The CWE missing. No CPE data actually absent. We can mention no CPE strings provided in source data, so product/version boundaries rely on advisory. Could mention issue affects Oracle Forms Services component including C/S architecture and character-mode deployments. Risk_assessment: CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS not provided. KEV not specified. POC no. SSVC? We need use signals. Need compare contrast. Since no KEV/POC/EPSS, say no public exploit identified but critical due to network unauthenticated low complexity. "CVSS indicates network vector, unauthenticated, no user in
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 (Fusion Middleware, components Forms Services, C/S and Charmode) can be compromised by a low-privileged attacker with network access over HTTP, resulting in full read/write access to Forms-accessible data plus a partial denial of service. Exploitation is difficult (AC:H) and depends on a victim other than the attacker performing some action (UI:R), but the flaw carries a scope change, meaning a successful attack can significantly affect products beyond the vulnerable component itself. Oracle rates it CVSS 3.1 7.9; no public exploit code, KEV listing or EPSS score was present in the supplied intelligence at time of analysis.