Oracle
Monthly
Local privilege escalation in Oracle VM VirtualBox 7.2.20 lets a user who already holds a low-privileged logon on the host take over the VirtualBox instance with low complexity and no user interaction, causing high confidentiality, integrity, and availability impact. The flaw scores 7.8 HIGH and is strictly local (AV:L), so it cannot be reached remotely without prior host access. No public exploit code or CISA KEV entry was identified at time of analysis; risk is concentrated on shared, multi-user, or untrusted local hosts running the affected release.
Authenticated low-privileged users can achieve takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 by sending crafted HTTP requests to its Product Quality Management component, with high confidentiality, integrity and availability impact. The vulnerability is network-reachable at low attack complexity, requires no user interaction, and is limited in the provided data to version 6.2.4; exploitation still requires a valid low-privilege account, so exposure depends on how widely such accounts are issued and whether the application is internet-facing. No public exploit identified at time of analysis; nevertheless, the 8.8 score and post-authentication takeover potential make it a high-priority remediation item.
Authenticated low-privileged users can achieve full takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 through its HTTP interface in the Product Quality Management component. The flaw has a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning high confidentiality, integrity, and availability impact once a valid account is obtained, with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the primary remediation reference.
Authenticated low-privileged users can read, modify, and delete critical Product Quality Management data in Oracle Agile Product Lifecycle Management for Process 6.2.4, and can additionally degrade availability, giving the issue a CVSS 3.1 base score of 8.3. The flaw is reachable over the network via HTTP, requires only a valid low-privilege account (PR:L), needs no user interaction, and has low attack complexity, so exploitation is straightforward once an attacker holds credentials. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the main practical constraints are the authentication prerequisite and the narrow deployment base of this specialized supply-chain product.
Authentication bypass in Oracle Helidon 4.0.0 through 4.5.5 allows unauthenticated remote attackers to read and modify critical application data over HTTP when the helidon-microprofile-security component is used. Oracle rates the issue CVSS 9.1 with high confidentiality and integrity impact and no availability impact, and the vector shows no privileges or user interaction required. No public exploit identified at time of analysis, and the supplied data does not confirm active exploitation (CISA KEV), but the exposure is serious for network-reachable applications relying on the affected security component.
Cross-origin access controls in the helidon-cors component of Oracle Helidon 3.0.0 through 3.2.21 can be bypassed by unauthenticated remote attackers over HTTP, enabling limited unauthorized reads and inserts, updates, or deletes of Helidon-accessible data. Oracle rates the flaw 7.2 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); the scope change means applications and downstream products relying on Helidon CORS may also be affected. No public exploit identified at time of analysis, and real-world CORS abuse may depend on an authenticated victim's browser being induced to make a cross-origin request, so confirm the practical prerequisites against the final Oracle advisory.
Unauthenticated HTTP requests into Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 can be shaped to create, delete, or modify critical application data through the helidon-common-mapper component, with secondary limited read access and a partial denial-of-service effect. Oracle scores it 7.0 with high attack complexity (AC:H), meaning the attacker must satisfy conditions outside their direct control before a crafted request succeeds, so this is a serious but not trivially repeatable flaw. No public exploit code identified at time of analysis, and no EPSS score was provided with the available data.
Unauthorized data modification and limited data disclosure in Oracle Helidon's helidon-grpc-server component affect versions 3.0.0 through 3.2.21, where unauthenticated HTTP/2 requests can update, insert, or delete some Helidon-accessible data and read a subset of it. The CVSS 3.1 base score is 7.2 with a scope change, meaning effects may extend to other products sharing the environment. No public exploit identified at time of analysis.
Denial of service in Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 can let a network attacker hang or repeatedly crash a Helidon process through the helidon-webclient-http2 component, with CVSS 3.1 score 7.5 reflecting availability-only impact. The issue is unauthenticated and requires no user interaction, but it is bounded: the application must actually use the HTTP/2 WebClient path and be able to reach or be reached by a malicious HTTP/2 peer. No public exploit code or CISA KEV entry is identified in the available data, so this is a serious but conditional availability risk rather than confirmed active exploitation.
Oracle Cost Management, a module of Oracle E-Business Suite (releases 12.2.3 through 12.2.15), permits a low-privileged authenticated attacker with HTTP network access to fully compromise the Cost Planning component, resulting in high confidentiality, integrity, and availability impact. Oracle's own advisory characterizes the flaw as easily exploitable and capable of leading to takeover of the module, yielding a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The practical barrier is authentication: the attacker must already hold valid low-privilege EBS credentials, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Oracle E-Business Suite's Application Object Library (DB Privileges component) allows a low-privileged user who can log on to the host where the library executes to take over the affected EBS instance, with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 7.8). All supported releases from 12.2.3 through 12.2.15 are affected. No public exploit code or confirmed active exploitation was identified at time of analysis, and the local-plus-authenticated prerequisite confines realistic risk to insiders and post-compromise lateral movement rather than direct external attack.
Unauthenticated HTTP requests against the Acollect component of Oracle Agile PLM 2.6 can return critical product-lifecycle data, letting any network-positioned attacker read everything the application can access without credentials or user interaction. The impact is confidentiality-only (C:H/I:N/A:N) at CVSS 7.5, so the flaw enables bulk data disclosure rather than tampering or disruption, and exploitation becomes trivial the moment the HTTP interface is reachable. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but with PR:N/AC:L characteristics, internet-facing or partner-exposed instances should be treated as high-priority exposure.
Authenticated low-privileged users can alter or delete critical data and read limited data in Oracle Commerce Platform 11.4.0 through its Dynamo Commerce Server HTTP interface. The assessed CVSS 7.1 vector shows low attack complexity and no user interaction, but exploitation requires a valid account (PR:L), so anonymous compromise is not supported by the available data. No public exploit code or CISA KEV entry is identified at time of analysis, making this a moderate-priority patching item rather than an emergency.
Authenticated low-privileged users with network HTTP access can achieve takeover of Oracle Purchasing 12.2.3 through 12.2.15, with high confidentiality, integrity, and availability impact (CVSS 8.8). The vulnerability is low-complexity and requires no user interaction, but exploitation depends on a valid low-privileged E-Business Suite session and reachability of the Purchasing Internal Operations component. No public exploit identified at time of analysis; the October 2026 Oracle Critical Patch Update is the remediation reference.
Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a low-privileged, authenticated attacker who reaches the Internal Operations component over HTTP, although Oracle rates exploitation as difficult because success depends on conditions outside the attacker's control. The CVSS 7.5 vector shows high confidentiality, integrity, and availability impact, but no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) are present in the supplied intelligence, making this a genuine but second-tier priority. Organizations not running EBS 12.2.x with the Payroll module are not affected.
Authenticated low-privileged attackers with HTTP network access can compromise Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 through a high-complexity flaw in the Internal Operations component, potentially achieving takeover with high confidentiality, integrity, and availability impact. Exploitation requires a valid low-privileged account and non-default preconditions (AC:H), and no public exploit was identified at time of analysis. The vendor rates the issue difficult to exploit, making it a genuine but second-tier priority compared with unauthenticated or actively exploited EBS flaws.
Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a low-privileged, authenticated attacker who can reach the component's Internal Operations interface over HTTP. Oracle describes the issue as difficult to exploit (AC:H) despite high confidentiality, integrity, and availability impact, and the CVSS 3.1 base score is 7.5. No public exploit code or confirmed active exploitation is identified at time of analysis, so the realistic threat profile is a motivated authenticated insider or an attacker who has already obtained low-privileged EBS credentials.
Privilege escalation and potential full compromise of the Oracle Application Object Library in Oracle E-Business Suite 12.2.3 through 12.2.15 allow a low-privileged authenticated attacker with HTTP network access to take over the affected component, with high confidentiality, integrity, and availability impact. This is a genuine but second-tier priority because exploitation is difficult (AC:H) and requires valid low-privileged EBS credentials (PR:L); no public exploit identified at time of analysis and no CISA KEV active-exploitation signal was provided.
Unauthenticated network attackers can read sensitive Oracle Applications Manager data in Oracle E-Business Suite 12.2.3 through 12.2.15 through the Oracle Diagnostics Interfaces component. The vulnerability is remotely reachable over HTTP with low attack complexity and no credentials or user interaction required, yielding a CVSS 3.1 score of 7.5 with confidentiality-only impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is primarily limited by whether the Applications Manager interface is network-accessible.
Local takeover of Oracle Application Testing Suite 13.3.0.1 through its OpenScript component: any user who can log on to the host running the suite can leverage the flaw to gain full control of the product, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The prerequisite is meaningful - the attacker must already hold an authenticated local account on the ATS infrastructure host - but once that condition is met, exploitation is low-complexity and requires no user interaction. There is no remote or network-exploitable path, no public exploit identified at time of analysis, and exposure is effectively bounded to shared or multi-user test servers where lower-tier or untrusted accounts are permitted to log on.
Local takeover of Oracle Application Testing Suite 13.3.0.1 via its OpenScript component allows an authenticated low-privileged user with logon access to the host to compromise the application, with high confidentiality, integrity, and availability impact. Exploitation is difficult (AC:H, described by Oracle as 'difficult to exploit') and requires local access plus a valid low-privileged account, making this a genuine-but-moderate-priority issue rather than a top-tier emergency. No public exploit code or CISA KEV entry was identified at time of analysis.
Takeover of Oracle Materials Requirement Planning (MRP) in Oracle E-Business Suite 12.2.3-12.2.15 is possible for a low-privileged attacker with network access via HTTP to the Internal Operations component, though the high attack complexity makes exploitation difficult. Successful attacks provide high confidentiality, integrity, and availability impact; authentication requirements and environmental timing/state conditions limit the attack surface. No public exploit identified at time of analysis, and the primary vendor reference is Oracle's October 2026 Critical Patch Update advisory.
Oracle Inventory Management 12.2.3 through 12.2.15 can be fully taken over by an authenticated low-privileged attacker who can log on locally to the infrastructure running Oracle E-Business Suite, through a high-complexity flaw in the Internal Operations component. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) reflects mandatory local access and conditions outside the attacker's control, so exploitation is difficult and Oracle labels it accordingly. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis, and no EPSS score was provided.
Product takeover is possible in Oracle Payroll 12.2.3 through 12.2.15, where a low-privileged attacker who can log on locally to the infrastructure hosting the application can exploit a difficult-to-control condition to fully compromise Payroll confidentiality, integrity, and availability. The CVSS 3.1 score is 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), confirming authentication with low privileges is required and that the attack is not network-reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Capacity in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a low-privileged, authenticated attacker who reaches the Internal Operations component over HTTP, with high confidentiality, integrity, and availability impact (CVSS 7.5). Exploitation is rated difficult (AC:H) because it depends on non-default preconditions that are not publicly documented. No public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; defenders should prioritize instances exposing the Capacity module to untrusted networks and verify the October 2026 Oracle CPU guidance.
Oracle Capacity in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a low-privileged authenticated attacker who can reach the Capacity module over HTTP, with high confidentiality, integrity, and availability impact (CVSS 8.8). The CVSS vector requires PR:L, so exploitation is not pre-authentication; any valid low-privileged EBS account is sufficient, making multi-user ERP deployments the main exposure. No public exploit code or confirmed active exploitation was identified in the supplied intelligence, and no EPSS score was provided.
Authenticated low-privileged users of Oracle E-Business Suite can read critical Oracle Capacity data-and potentially data in other linked EBS products-through HTTP requests to the Internal Operations component in versions 12.2.3 through 12.2.15. Exploitation is low-complexity and needs no user interaction, but it requires a valid EBS account (PR:L) and network access; no public exploit identified at time of analysis, making this a mid-to-high priority issue rather than an emergency.
Authenticated low-privilege users can read critical Oracle Capacity data-and, because of a scope change, potentially data from other Oracle E-Business Suite products on the same deployment-in Oracle Capacity 12.2.3 through 12.2.15. The flaw is remotely reachable over HTTP with low attack complexity and no user interaction, but it is not unauthenticated: the attacker must already hold valid EBS credentials. No public exploit code is identified in the supplied intelligence at time of analysis, and the CVSS 3.1 score is 7.7 with confidentiality-only impact.
Remote unauthenticated takeover of Oracle Solaris 11.4 is possible through a flaw in the 'Utility' component, which exposes a network-reachable TCP service to attackers with no credentials or user interaction. Oracle rates the issue CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact; the precise protocol, port, and vulnerable service configuration are not named in the available data and must be confirmed against the Oracle CPU October 2026 advisory. No public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis.
Authenticated low-privileged users with network HTTP access to Oracle Cost Management 12.2.3 through 12.2.15 can potentially take over the Cost Maintenance component, with high confidentiality, integrity, and availability impact (CVSS 7.5). Oracle rates the flaw difficult to exploit (AC:H), and exploitation requires a valid low-privileged E-Business Suite account plus reachable Cost Management deployment. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV.
Takeover of Oracle Sales Foundation, a component of Oracle E-Business Suite, is possible for authenticated low-privileged attackers who can reach the Security API over HTTP in versions 12.2.3 through 12.2.15. Oracle rates this 7.5 with high attack complexity (AC:H) and explicitly describes it as difficult to exploit, so success likely hinges on configuration state, timing, or target-specific reconnaissance rather than a simple request. No public exploit code and no CISA KEV entry were identified at time of analysis, and the required low-privileged EBS account further narrows the realistic attacker population.
Oracle EDI Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes critical EDI data to low-privileged network attackers via HTTP, allowing high confidentiality impact and limited integrity modification with a scope change that can affect additional connected Oracle products. Exploitation requires a valid low-privilege EBS/EDI Gateway account (PR:L) and network reachability to the EDI Gateway component; no public exploit or active exploitation is identified in the available intelligence. The CVSS 3.1 base score is 8.5, reflecting high confidentiality and low integrity impact.
Takeover of Oracle EDI Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for high-privileged attackers who can reach the component over HTTP, with high confidentiality, integrity, and availability impact. The issue is network-reachable, low-complexity, and requires no user interaction, but the CVSS PR:H prerequisite means an attacker must already hold an administrative-level EDI Gateway account, so realistic risk is concentrated among malicious privileged insiders or attackers who have already obtained admin credentials. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated data disclosure in Oracle BI EE 8.2.0.0.0 and 26.01.0.0.0 allows a remote attacker with HTTP access to the Analytics Server to read critical data or all data accessible through the product, with a CVSS 3.1 base score of 7.5 and confidentiality-only impact. No special conditions are required beyond network reachability, so exposure is bounded mainly by whether the Analytics Server HTTP interface is Internet-facing, VPN-restricted, or behind a WAF/reverse proxy. No public exploit identified at time of analysis.
Takeover of Oracle Enterprise Manager 13.5 and 24.1 is achievable by a low-privileged authenticated attacker with HTTP access to the Data Guard Management component. Exploitation requires only network reachability and a low-privilege account, yields high confidentiality, integrity and availability impact, and can affect additional products because of the CVSS scope change; no public exploit identified at time of analysis.
Low-privileged console users can achieve full takeover of Oracle Enterprise Manager for Oracle Database 13.5 and 24.1 through the Data Guard Management component, with scope change extending impact to managed databases and additional products reachable from the management server. The issue is network-reachable over HTTP with low complexity and no user interaction, but it requires a valid low-privileged OEM account (PR:L), so it is not unauthenticated. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 3.1 base score is 9.9.
A local privilege-escalation flaw in the Enterprise Manager Install component of Oracle Enterprise Manager Base Platform lets a low-privileged user who can log on to the host running the platform escalate to full control of the EM Base Platform itself, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.8). Only versions 13.5 and 24.1 are affected, and exploitation is not possible over the network - CVSS vector AV:L/PR:L/UI:N means the attacker needs existing interactive logon plus at least low-privilege credentials on the EM infrastructure, and no user interaction or non-default configuration. There is no public exploit code and no confirmed active exploitation (not in CISA KEV) at time of analysis; fixes are published in Oracle's October 2026 Critical Patch Update advisory.
Authenticated compromise of Oracle Enterprise Manager for Siebel 13.5 and 24.1 can escalate to full takeover through the Configuration Management component, with a low-privileged network attacker able to affect confidentiality, integrity, and availability at CVSS 8.8. The flaw requires only a valid low-privileged account and HTTP access, not user interaction, so exposure is significant wherever such accounts exist; however, no public exploit identified at time of analysis and no CISA KEV confirmation is present, so this is not assessed as an active emergency.
Low-privileged attackers who can reach Oracle Enterprise Manager for Siebel over HTTP can escalate to full takeover of the product's Configuration Management component in versions 13.5 and 24.1, per Oracle's October 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and low attack complexity, but a valid low-privileged account is a hard prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis; EPSS and KEV data were not available in the supplied intelligence, so real-world risk currently rests on the intrinsic severity and the niche deployment footprint of the Siebel management plug-in.
Oracle APEX versions 24.1.0 through 24.1.21, 24.2.0 through 24.2.20, and 26.1.0 through 26.1.4 contain an easily exploitable flaw in the General component that unauthenticated remote attackers can reach over HTTPS to fully compromise the APEX instance, with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 9.8). The Oracle CPU October 2026 advisory is the vendor's reference for this issue, and no public exploit code or CISA KEV listing was identified in the available data at time of analysis. Network exposure is the primary gating factor: any internet-reachable or otherwise attacker-accessibly APEX deployment on an affected release should be treated as high priority for patching.
Unauthenticated denial of service in Oracle Global Lifecycle Management NextGen OUI Framework (the NextGen Installer component) lets a remote attacker who can reach the product's HTTP endpoint hang or repeatedly crash it, wiping out availability of the installer/lifecycle-management service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5), so no credentials, user interaction, or special attacker-side setup are needed - the practical constraint is exposure, since installer endpoints are typically internal or short-lived rather than permanently internet-facing. There are no confidentiality or integrity impacts, so the flaw cannot be chained into data theft or code execution on its own; no public exploit code was identified at time of analysis, and no EPSS or CISA KEV signal was supplied. Affected releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and 15.1.1.0.0.
High-privileged attackers with HTTP reachability to Oracle EDI Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 can fully take over the component, with high impact to confidentiality, integrity, and availability. Exploitation requires existing high application-level privileges (CVSS PR:H) and network access, so anonymous or low-privileged users cannot directly exploit it; realistic abuse is confined to privileged insiders or adversaries who already control a privileged EBS account. No public exploit code or CISA KEV entry is identified in the available intelligence at time of analysis.
Authenticated low-privileged attackers can take over Oracle Enterprise Manager Base Platform 13.5 and 24.1 through the Agent Next Gen component over HTTP. The flaw is easily exploitable (CVSS 8.8, AC:L/UI:N) once any low-privilege account is obtained and the management interface is reachable, with high confidentiality, integrity, and availability impact. No public exploit was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the remediation reference.
Unauthenticated remote attackers who can reach the Siebel CRM Integration EAI HTTP interface can cause a hang or repeatedly crash the integration component, producing a complete denial of service against that service. All supported versions from 17.0 through 26.9 are affected, and the CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability and no confidentiality or integrity effect. No public exploit code or confirmed active exploitation was identified at time of analysis, so realistic risk depends primarily on whether the EAI endpoint is exposed beyond trusted internal networks.
Oracle Trusted Answer Search 26.1 exposes an information-disclosure flaw in its Application expert UI component that lets an attacker with an existing low-privilege account reach critical data over HTTP without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) confirms the attack is network-reachable and low-complexity, but it is not pre-authentication: a valid low-privileged login is the primary barrier, notwithstanding the 'Authentication Bypass' tag applied by the reporter. Because of the scope change (S:C), a successful exploit can expose confidential data belonging to other Oracle products reachable from the same deployment, so the blast radius is larger than the search component alone; no public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Trusted Answer Search 26.1 can allow a low-privileged authenticated attacker with network access to the Application expert UI to create, delete, modify, or read critical data after another user is induced to interact with attacker-supplied content. The CVSS 3.1 score is 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact and possible scope change to additional products, with no availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires both an existing low-privileged account and a separate human victim.
Oracle Trusted Answer Search 26.1 contains a high-severity Application expert UI flaw (CVSS 7.6) that allows a low-privileged authenticated attacker to submit crafted content over HTTP; when another user views that content, the attacker can gain unauthorized read access to critical data and limited insert/update/delete access, with the impact crossing a scope boundary. The attack is gated by valid low-privileged credentials and required victim interaction, so broad opportunistic exploitation is less likely; no public exploit identified at time of analysis.
Oracle Trusted Answer Search 26.1 contains a PL/SQL package flaw that lets low-privileged, authenticated attackers with Oracle Net connectivity fully compromise the component and potentially affect additional products due to a scope change. The CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact; exploitation requires valid low-privilege database credentials rather than anonymous access. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated low-privileged users can achieve integrity compromise and cause repeated denial of service against Oracle Trusted Answer Search 26.1 through a PL/SQL package reachable over Oracle Net, with the CVSS 3.1 score reaching 9.9 because the scope-change flag (S:C) extends the impact to additional products beyond the vulnerable component. Confidentiality exposure is limited to a subset of accessible data, but attackers can create, delete, or modify critical data and hang or repeatedly crash the service. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exposure hinges on whether low-privilege accounts and Oracle Net listener access are broadly granted in a given environment.
Unauthenticated remote takeover of Oracle WebCenter Sites is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0, per Oracle Fusion Middleware's October 2026 advisory. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means network attackers need no credentials or user interaction and can fully compromise confidentiality, integrity, and availability. No public exploit code or CISA KEV entry was identified in the supplied data at time of analysis.
Takeover of Trusted Answer Search 26.1 is possible for unauthenticated network attackers who can reach a vulnerable PL/SQL package over Oracle Net, with full confidentiality, integrity, and availability impact on success. The flaw is difficult to exploit because success depends on a condition outside the attacker's control, and only version 26.1 is listed as affected. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can take over Oracle Siebel CRM Development versions 17.0 through 26.9 through the Siebel Approval Manager component, but only if a targeted user is tricked into interacting with attacker-supplied content over HTTP. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact gated by mandatory user interaction. No public exploit code or confirmed active exploitation is identified in the available intelligence at time of analysis.
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.2.2 expose a confidentiality-only flaw in the Core component that lets a low-privileged, network-positioned user read data well beyond their intended authorization boundary. Because the CVSS vector carries a scope change (S:C) alongside high confidentiality impact, an attacker with valid low-level ORDS credentials can reach critical data and potentially affect other Oracle products reachable through the same deployment, though integrity and availability are untouched and exploitation requires an existing account (PR:L) rather than being fully unauthenticated despite the 'Authentication Bypass' tag. No public exploit code or CISA KEV confirmation was available at time of analysis, and the primary reference is Oracle's October 2026 Critical Patch Update advisory. Note that the 7.7 score reflects confidentiality exposure only; the practical risk is meaningful but not a drop-everything emergency.
Unauthenticated attackers with TCP network reach to Oracle Secure Backup 19.1.0.0.0 or 19.1.0.1.0 can take full control of the backup service, with high confidentiality, integrity and availability impact and a CVSS 3.1 base score of 9.8. The vendor rates the attack as low-complexity with no privileges or user interaction required, so network exposure is the main constraint. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Local privilege escalation in Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 lets an attacker who already holds a valid low-privileged logon on the OSB host take full control of the backup server through the Device Management and Support component. Because the vector requires local access (AV:L) and an existing account (PR:L), the realistic exposure is limited to environments where untrusted users can log on to the OSB infrastructure, but successful exploitation yields complete confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 can be taken over by an authenticated, low-privileged attacker who already has a local logon to the host, with scope change potentially affecting other products on that infrastructure. Exploitation is straightforward once local access exists (AV:L/AC:L/PR:L/UI:N/S:C), but it is not remotely reachable without a prior foothold; no public exploit was identified at time of analysis. This is a credible high-priority issue but not an emergency drop-everything item.
Unauthenticated remote attackers can cause a hang or frequently repeatable crash of Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 by reaching its TCP-exposed service, resulting in complete denial of service with a CVSS 3.1 base score of 8.6 and a scope change that may affect dependent products. This is a genuine high-priority availability risk for environments that run the affected product, but the signals are mixed: no public exploit or CISA KEV entry was provided in the available data, and practical exposure depends on whether the backup service is reachable from untrusted networks. Exploitation requires only network access, with no authentication and no user interaction per the assessed vector.
Local privilege escalation in Oracle Autonomous Health Framework 26.3 through 26.8 allows an authenticated, low-privileged user with a logon on the AHF host to take over the product's Trace File Analyzer component, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8). The flaw cannot be reached remotely or without credentials: exploitation depends entirely on the attacker already holding a local account on the infrastructure where AHF executes, so least-privilege OS accounts and tight host access control directly shrink the exposed population. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the Oracle advisory is the authoritative remediation source.
Local takeover of Oracle Autonomous Health Framework (Trace File Analyzer component) in versions 26.3 through 26.8: any user with an existing low-privileged logon on the Oracle Database or Grid Infrastructure host can exploit the component to gain full control of AHF, with high confidentiality, integrity and availability impact (CVSS 3.1 base score 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remote and needs no victim interaction, so exposure is confined to hosts where untrusted local principals already hold accounts or a foothold - shared and multi-tenant database servers carry the real risk, while single-administrator, tightly controlled hosts are substantially lower risk. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Oracle published it through its October 2026 Critical Patch Update.
Oracle Agile PLM for Process 6.2.4 can be taken over through its Product Quality Management component by unauthenticated remote HTTP requests, but the exploit path is rated high complexity and difficult rather than reliably repeatable. Oracle's October 2026 Critical Patch Update lists the issue with full confidentiality, integrity, and availability impact and no CWE mapping, and no public exploit or CISA KEV entry was identified in the provided intelligence at time of analysis. The combination of network reachability, no privileges or user interaction, and takeover-level impact makes this a high-impact but condition-dependent risk for supply-chain quality environments.
Full takeover of Oracle Product Lifecycle Analytics 3.6.1 is possible for a low-privileged authenticated attacker who can reach the application over the network and deliver a SQL-based attack against its Installation Issues component, with high confidentiality, integrity, and availability impact. Oracle rates the issue difficult to exploit (AC:H) and assigns CVSS 3.1 score 7.5; exploitation requires valid credentials (PR:L) and favorable conditions beyond the attacker's direct control. No CISA KEV entry or public exploit code is identified in the provided intelligence, so this should be handled on the normal Oracle CPU cadence rather than as an emergency.
Unauthenticated information disclosure in the Oracle Siebel CRM Deployment Cloud Gateway lets any remote attacker who can reach the gateway over HTTP read critical data and, per Oracle, potentially all data accessible through that deployment; supported versions 17.0 through 26.9 are affected. The CVSS 3.1 score is 7.5 with confidentiality-only impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction, no privileges, and no integrity or availability effect. Oracle's October 2026 Critical Patch Update advisory is the cited vendor reference and is the source of the fix; no public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Unauthenticated network attackers can read and modify critical data in Oracle Siebel CRM End User through the Portal Framework over HTTPS in versions 17.0 through 26.9. The CVSS 7.4 rating reflects high attack complexity, meaning successful exploitation depends on conditions outside the attacker's control and mass exploitation is less likely; no public exploit code or CISA KEV active exploitation has been identified at time of analysis. Confidentiality and integrity are affected, availability is not, and impact remains within Siebel CRM End User-accessible data.
Takeover of the Oracle EDI Gateway component in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a high-privileged attacker who can reach the application over HTTP, with full confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The critical qualifier is the PR:H prerequisite: the attacker must already hold an elevated EDI Gateway account, so this is not exploitable by unauthenticated or low-privileged users and realistic exposure is confined to trusted operators or adversaries who have already stolen such credentials. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the source data.
Access-control bypass in Oracle Siebel CRM Deployment 17.0 through 26.9 allows an authenticated local low-privileged user on the Siebel host to read or modify critical data through the Server Infrastructure component. The CVSS 3.1 vector requires local access and a valid low-privileged logon (AV:L/PR:L/UI:N), with high confidentiality and integrity impact but no availability impact. No public exploit code or CISA KEV activity was identified at time of analysis, and EPSS was not supplied.
Unauthenticated attackers can read sensitive data from Oracle Siebel CRM End User versions 17.0 through 26.9 by exploiting an authentication bypass in the UIF Open UI component over HTTP. The CVSS 7.5 vector shows network reachability with low complexity, no privileges, and no user interaction, but impact is confined to confidentiality (C:H/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers who can reach an Oracle Siebel CRM Deployment server over HTTP can read critical data or the full set of data accessible to that deployment, affecting versions 17.0 through 26.9 of the Server Infrastructure component. The flaw scores CVSS 3.1 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, meaning no credentials, no user interaction and no special configuration are prerequisites, and impact is limited to confidentiality - no integrity or availability effect is described. Oracle published the fix in its October 2026 Critical Patch Update; no public exploit code has been identified at time of analysis, and no EPSS score was supplied with the available intelligence.
Exposes critical data in Oracle Siebel CRM Deployment 17.0 through 26.9 to unauthenticated remote attackers through the TLS-exposed Server Infrastructure component, carrying a CVSS 3.1 score of 7.5 (High). Impact is confidentiality-only: attackers can read critical or all deployment-accessible CRM data but cannot modify data or disrupt service. No public exploit identified at time of analysis, and no CISA KEV entry was provided.
Low-privileged authenticated attackers can compromise Oracle Siebel CRM Deployment 17.0 through 26.9 over HTTP, gaining high confidentiality and integrity impact and causing partial denial of service (CVSS 8.3, PR:L). The affected Server Infrastructure component allows unauthorized creation, deletion, modification, and access to critical deployment data, and no public exploit code or CISA KEV entry was identified at time of analysis. Although tagged 'Authentication Bypass', the assessed vector requires valid low-privilege credentials and does not represent unauthenticated access.
Unauthorized data access and limited data modification in Oracle Siebel CRM Deployment 17.0 through 26.9 are possible for unauthenticated network attackers able to reach the Server Infrastructure HTTP interface. The CVSS 3.1 score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), reflecting high confidentiality impact and low integrity impact with no availability impact; Oracle tags the issue as an authentication bypass. No CISA KEV entry or public exploit code was identified in the supplied intelligence, so exposure is chiefly governed by whether the Siebel HTTP endpoint is reachable from untrusted networks.
SQL-layer compromise in Oracle Siebel CRM's Life Sciences eDetailing component, affecting versions 17.0 through 26.9, allows an authenticated low-privileged attacker with network access to execute SQL against the application and achieve full takeover, with high confidentiality, integrity, and availability impact. The vendor-assigned CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a low-complexity, no-user-interaction attack once low privileges are obtained; no public exploit identified at time of analysis.
Local takeover in Oracle Autonomous Health Framework 26.3 through 26.8 allows an authenticated low-privileged user with logon to the host to compromise the AHF Instant Diagnostic Replay component, with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 at 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the assessment emphasizes that it is local, not remotely exploitable, and requires a pre-existing host account. No public exploit identified at time of analysis.
Authenticated low-privileged users of the Siebel Life Sciences Web UI in Oracle Siebel CRM versions 17.0 through 26.9 can exploit a scope-changing flaw over HTTP to read and modify critical data beyond their own authorization boundary, but only if they can persuade another user to interact with the attack. The CVSS 3.1 score is 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), with high confidentiality and integrity impact and no availability impact. No public exploit was identified at time of analysis, and there is no CISA KEV entry.
Unauthenticated remote attackers can reach the Integration Broker component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 over HTTP and, by persuading a legitimate user to open a crafted link or act on an attacker-supplied request, obtain unauthorized read access to critical PeopleTools data plus limited unauthorized insert/update/delete capability. The mandatory user-interaction prerequisite (CVSS UI:R) keeps the attack from being an interaction-free, automatable mass-exploitation vector, and the impact is bounded to confidentiality (HIGH) and integrity (LOW) with no availability effect, giving a CVSS 3.1 base score of 7.1. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Takeover of the Siebel CRM Development component (Workflow) is achievable by a low-privileged authenticated attacker who can persuade a second user to interact with crafted Workflow content over HTTP; supported releases 25.12 through 26.9 are affected. Oracle rates this CVSS 3.1 base 7.1, but the vector (AC:H/PR:L/UI:R) stacks valid credentials, victim-driven social engineering, and high attack complexity, so it is a moderate-priority hardening item rather than an emergency. No public exploit code or active exploitation has been identified at time of analysis, and the issue is addressed through Oracle's Critical Patch Update program.
Takeover of Oracle Siebel CRM Cloud Applications is possible through the Siebel Cloud Manager component in supported versions 17.0 through 26.9, where a low-privileged, authenticated attacker with HTTP network reachability can exploit the flaw to gain full control of the application. The CVSS 3.1 score is 9.9 with a scope change (S:C), reflecting that compromise of Cloud Manager can spill over into additional, dependent products, with high confidentiality, integrity, and availability impact. Exploitation requires a valid low-entitlement account or reachable authenticated interface rather than anonymous access, but once that foothold exists, attack complexity is low and no user interaction is needed; no public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the issue in its October 2026 Critical Patch Update.
Unauthenticated attackers positioned on the physical communication segment attached to the hardware running Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.9) can exploit the Siebel Cloud Manager component to obtain complete read and write access to critical application data, with scope change extending the impact to additional products. The CVSS 3.1 base score is 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N): no credentials or user interaction are needed, but the High attack complexity and the requirement to already reside on the adjacent/local network segment substantially constrain real-world exposure, and availability is not affected. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, so the practical risk is concentrated in environments where untrusted parties can reach the Siebel Cloud Manager host's local segment.
Unauthenticated network attackers can cause a hang or frequently repeatable crash of PeopleSoft PeopleTools 8.61-8.63 and obtain limited read and write access to accessible data by inducing a legitimate user to interact with a crafted HTTP-delivered page or link. Oracle rates the issue easily exploitable once that human interaction occurs, with a CVSS 3.1 score of 7.6. No public exploit identified at time of analysis, making this a credible but second-tier priority.
Low-privileged, network-positioned users of PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Test Framework component to cross a security boundary and obtain read/write access to critical PeopleTools data, but only if they can persuade another user to interact with attacker-supplied content. The issue is rated CVSS 8.7 with high confidentiality and integrity impact and no availability impact; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 is achievable through its SQR reporting component, but only under narrow conditions: the attacker must already hold a logon account on the host where PeopleTools executes and must induce a different user to perform an action. Oracle scores this 7.0 High (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), with high attack complexity and a human-interaction requirement that make it a moderate-priority issue rather than an urgent, mass-exploitation threat. No public exploit code or confirmed active exploitation was identified at time of analysis, and PR:N indicates that no PeopleSoft application authentication is needed once local host access has been obtained.
Authenticated low-privileged attackers can achieve takeover of PeopleSoft Enterprise PeopleTools 8.61-8.63 by reaching the SQR component over HTTP, although Oracle rates the flaw as difficult to exploit because of high attack complexity (AC:H). The CVSS 3.1 score is 7.5 with high confidentiality, integrity, and availability impact, and exploitation requires valid low-privileged credentials (PR:L) but no user interaction (UI:N). No public exploit identified at time of analysis, and no CISA KEV confirmation was provided, so risk is concentrated in environments that expose SQR over HTTP and allow low-privileged accounts.
Unauthenticated attackers can tamper with critical data and cause a complete, repeatable denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by targeting the Report Distribution component over HTTP, but only if a legitimate user is induced to interact with the attack. The CVSS 3.1 score is 8.1 with high integrity and availability impact and no confidentiality impact. No public exploit identified at time of analysis, and the risk is high-priority but not an active-exploitation emergency.
Low-privileged, network-reachable attackers can corrupt or destroy data and repeatedly crash Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Report Distribution component exposed over HTTP. Successful exploitation yields high integrity and availability impact - unauthorized creation, deletion or modification of critical PeopleTools data plus hang or repeatable crash conditions approaching complete denial of service - while confidentiality is unaffected (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:H). Exploitation is not unauthenticated: a valid low-privileged account is required, so the realistic threat is insiders or attackers who already hold credentials and can reach the report distribution surface; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated HTTP requests to the SQR component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can return critical application data to anyone who can simply reach the web tier, a confidentiality-only but high-severity exposure scored CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N). Oracle addressed the flaw in its October 2026 Critical Patch Update; no public exploit code and no CISA KEV entry were identified in the data reviewed, so real-world risk hinges on whether the PeopleSoft Internet Architecture and SQR endpoints are internet-reachable or segmented behind VPNs, reverse proxies, or internal networks. This is a credible operational priority rather than an inflated high-CVSS artifact, because the attacker needs no credentials, no user interaction, and no non-default configuration once the endpoint is reachable.
Authenticated low-privilege users can read, create, modify, or delete critical data held in PeopleSoft Enterprise PeopleTools 8.61-8.63 - and, because the CVSS scope is changed, data in connected products as well - by sending crafted requests over HTTP to the SQR component. Exploitation is low-complexity and requires no user interaction, but does require a valid account (PR:L), so exposure is bounded to those who can obtain credentials such as insiders, phished users, or broadly provisioned portal accounts. No public exploit code and no CISA KEV entry were identified at time of analysis; internet-exposed PeopleSoft portals represent the highest realistic risk, and this is a genuine high-priority vulnerability rather than an inflated score.
Oracle PeopleSoft PeopleTools 8.61 through 8.63 can be fully taken over by an unauthenticated attacker who has access to the same physical or adjacent network segment as the host running the PsAdmin component. The flaw is rated CVSS 7.5 with high confidentiality, integrity and availability impact, but exploitation is explicitly difficult (AC:H) and requires network adjacency (AV:A), so it is not reachable from arbitrary internet locations; no public exploit code has been identified and it is not confirmed actively exploited (no CISA KEV listing). Oracle addressed it in the October 2026 Critical Patch Update, so priority should be moderate - patch on a normal cycle and treat segment isolation as the main exposure control.
Unauthenticated network attackers can achieve full takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Business Interlink component, though the high attack complexity - Oracle characterizes the flaw as 'difficult to exploit' - means success depends on conditions beyond the attacker's control, which materially reduces real-world exploitability. The vulnerability carries a CVSS 3.1 base score of 8.1 with complete confidentiality, integrity, and availability impact; no public exploit was identified at time of analysis. This is a genuinely serious but not top-tier-urgent issue, and risk concentrates on internet-exposed PeopleSoft portals where Business Interlink is reachable or in active use.
Takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 is possible through its Business Interlink component, where a low-privileged network attacker who can reach the integration endpoint over HTTP could achieve full confidentiality, integrity, and availability impact. Exploitation is constrained by high attack complexity and the need for valid authenticated access (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; 7.5), and no public exploit identified at time of analysis, with no KEV or POC signal in the provided intelligence.
Unauthenticated HTTP requests to the Report Distribution component in PeopleSoft Enterprise PeopleTools 8.61-8.63 can read critical PeopleSoft data, with Oracle scoring the flaw CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The weakness is described by Oracle as easily exploitable and affects confidentiality only, with no integrity or availability impact; no public exploit code or CISA KEV entry is identified at time of analysis, so risk is mid-tier and driven by the clean remote unauthenticated vector rather than confirmed exploitation.
Authenticated users of Oracle E-Business Suite's Capacity module (component: Internal Operations) in versions 12.2.3 through 12.2.15 can exploit this flaw over HTTP with low attack complexity and no user interaction to read critical Capacity data, perform limited unauthorized inserts/updates/deletes, and cause a partial denial of service within that module. The CVSS 3.1 score is 7.6 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, meaning the attacker must already hold a valid low-privileged EBS account, but no further privilege escalation or victim interaction is required. Oracle addresses it through its Critical Patch Update program; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and scope is unchanged so the compromise does not extend beyond Capacity-accessible data.
Local privilege escalation in Oracle VM VirtualBox 7.2.20 lets a user who already holds a low-privileged logon on the host take over the VirtualBox instance with low complexity and no user interaction, causing high confidentiality, integrity, and availability impact. The flaw scores 7.8 HIGH and is strictly local (AV:L), so it cannot be reached remotely without prior host access. No public exploit code or CISA KEV entry was identified at time of analysis; risk is concentrated on shared, multi-user, or untrusted local hosts running the affected release.
Authenticated low-privileged users can achieve takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 by sending crafted HTTP requests to its Product Quality Management component, with high confidentiality, integrity and availability impact. The vulnerability is network-reachable at low attack complexity, requires no user interaction, and is limited in the provided data to version 6.2.4; exploitation still requires a valid low-privilege account, so exposure depends on how widely such accounts are issued and whether the application is internet-facing. No public exploit identified at time of analysis; nevertheless, the 8.8 score and post-authentication takeover potential make it a high-priority remediation item.
Authenticated low-privileged users can achieve full takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 through its HTTP interface in the Product Quality Management component. The flaw has a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning high confidentiality, integrity, and availability impact once a valid account is obtained, with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the primary remediation reference.
Authenticated low-privileged users can read, modify, and delete critical Product Quality Management data in Oracle Agile Product Lifecycle Management for Process 6.2.4, and can additionally degrade availability, giving the issue a CVSS 3.1 base score of 8.3. The flaw is reachable over the network via HTTP, requires only a valid low-privilege account (PR:L), needs no user interaction, and has low attack complexity, so exploitation is straightforward once an attacker holds credentials. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the main practical constraints are the authentication prerequisite and the narrow deployment base of this specialized supply-chain product.
Authentication bypass in Oracle Helidon 4.0.0 through 4.5.5 allows unauthenticated remote attackers to read and modify critical application data over HTTP when the helidon-microprofile-security component is used. Oracle rates the issue CVSS 9.1 with high confidentiality and integrity impact and no availability impact, and the vector shows no privileges or user interaction required. No public exploit identified at time of analysis, and the supplied data does not confirm active exploitation (CISA KEV), but the exposure is serious for network-reachable applications relying on the affected security component.
Cross-origin access controls in the helidon-cors component of Oracle Helidon 3.0.0 through 3.2.21 can be bypassed by unauthenticated remote attackers over HTTP, enabling limited unauthorized reads and inserts, updates, or deletes of Helidon-accessible data. Oracle rates the flaw 7.2 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); the scope change means applications and downstream products relying on Helidon CORS may also be affected. No public exploit identified at time of analysis, and real-world CORS abuse may depend on an authenticated victim's browser being induced to make a cross-origin request, so confirm the practical prerequisites against the final Oracle advisory.
Unauthenticated HTTP requests into Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 can be shaped to create, delete, or modify critical application data through the helidon-common-mapper component, with secondary limited read access and a partial denial-of-service effect. Oracle scores it 7.0 with high attack complexity (AC:H), meaning the attacker must satisfy conditions outside their direct control before a crafted request succeeds, so this is a serious but not trivially repeatable flaw. No public exploit code identified at time of analysis, and no EPSS score was provided with the available data.
Unauthorized data modification and limited data disclosure in Oracle Helidon's helidon-grpc-server component affect versions 3.0.0 through 3.2.21, where unauthenticated HTTP/2 requests can update, insert, or delete some Helidon-accessible data and read a subset of it. The CVSS 3.1 base score is 7.2 with a scope change, meaning effects may extend to other products sharing the environment. No public exploit identified at time of analysis.
Denial of service in Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 can let a network attacker hang or repeatedly crash a Helidon process through the helidon-webclient-http2 component, with CVSS 3.1 score 7.5 reflecting availability-only impact. The issue is unauthenticated and requires no user interaction, but it is bounded: the application must actually use the HTTP/2 WebClient path and be able to reach or be reached by a malicious HTTP/2 peer. No public exploit code or CISA KEV entry is identified in the available data, so this is a serious but conditional availability risk rather than confirmed active exploitation.
Oracle Cost Management, a module of Oracle E-Business Suite (releases 12.2.3 through 12.2.15), permits a low-privileged authenticated attacker with HTTP network access to fully compromise the Cost Planning component, resulting in high confidentiality, integrity, and availability impact. Oracle's own advisory characterizes the flaw as easily exploitable and capable of leading to takeover of the module, yielding a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The practical barrier is authentication: the attacker must already hold valid low-privilege EBS credentials, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Oracle E-Business Suite's Application Object Library (DB Privileges component) allows a low-privileged user who can log on to the host where the library executes to take over the affected EBS instance, with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 7.8). All supported releases from 12.2.3 through 12.2.15 are affected. No public exploit code or confirmed active exploitation was identified at time of analysis, and the local-plus-authenticated prerequisite confines realistic risk to insiders and post-compromise lateral movement rather than direct external attack.
Unauthenticated HTTP requests against the Acollect component of Oracle Agile PLM 2.6 can return critical product-lifecycle data, letting any network-positioned attacker read everything the application can access without credentials or user interaction. The impact is confidentiality-only (C:H/I:N/A:N) at CVSS 7.5, so the flaw enables bulk data disclosure rather than tampering or disruption, and exploitation becomes trivial the moment the HTTP interface is reachable. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but with PR:N/AC:L characteristics, internet-facing or partner-exposed instances should be treated as high-priority exposure.
Authenticated low-privileged users can alter or delete critical data and read limited data in Oracle Commerce Platform 11.4.0 through its Dynamo Commerce Server HTTP interface. The assessed CVSS 7.1 vector shows low attack complexity and no user interaction, but exploitation requires a valid account (PR:L), so anonymous compromise is not supported by the available data. No public exploit code or CISA KEV entry is identified at time of analysis, making this a moderate-priority patching item rather than an emergency.
Authenticated low-privileged users with network HTTP access can achieve takeover of Oracle Purchasing 12.2.3 through 12.2.15, with high confidentiality, integrity, and availability impact (CVSS 8.8). The vulnerability is low-complexity and requires no user interaction, but exploitation depends on a valid low-privileged E-Business Suite session and reachability of the Purchasing Internal Operations component. No public exploit identified at time of analysis; the October 2026 Oracle Critical Patch Update is the remediation reference.
Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a low-privileged, authenticated attacker who reaches the Internal Operations component over HTTP, although Oracle rates exploitation as difficult because success depends on conditions outside the attacker's control. The CVSS 7.5 vector shows high confidentiality, integrity, and availability impact, but no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) are present in the supplied intelligence, making this a genuine but second-tier priority. Organizations not running EBS 12.2.x with the Payroll module are not affected.
Authenticated low-privileged attackers with HTTP network access can compromise Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 through a high-complexity flaw in the Internal Operations component, potentially achieving takeover with high confidentiality, integrity, and availability impact. Exploitation requires a valid low-privileged account and non-default preconditions (AC:H), and no public exploit was identified at time of analysis. The vendor rates the issue difficult to exploit, making it a genuine but second-tier priority compared with unauthenticated or actively exploited EBS flaws.
Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a low-privileged, authenticated attacker who can reach the component's Internal Operations interface over HTTP. Oracle describes the issue as difficult to exploit (AC:H) despite high confidentiality, integrity, and availability impact, and the CVSS 3.1 base score is 7.5. No public exploit code or confirmed active exploitation is identified at time of analysis, so the realistic threat profile is a motivated authenticated insider or an attacker who has already obtained low-privileged EBS credentials.
Privilege escalation and potential full compromise of the Oracle Application Object Library in Oracle E-Business Suite 12.2.3 through 12.2.15 allow a low-privileged authenticated attacker with HTTP network access to take over the affected component, with high confidentiality, integrity, and availability impact. This is a genuine but second-tier priority because exploitation is difficult (AC:H) and requires valid low-privileged EBS credentials (PR:L); no public exploit identified at time of analysis and no CISA KEV active-exploitation signal was provided.
Unauthenticated network attackers can read sensitive Oracle Applications Manager data in Oracle E-Business Suite 12.2.3 through 12.2.15 through the Oracle Diagnostics Interfaces component. The vulnerability is remotely reachable over HTTP with low attack complexity and no credentials or user interaction required, yielding a CVSS 3.1 score of 7.5 with confidentiality-only impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is primarily limited by whether the Applications Manager interface is network-accessible.
Local takeover of Oracle Application Testing Suite 13.3.0.1 through its OpenScript component: any user who can log on to the host running the suite can leverage the flaw to gain full control of the product, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The prerequisite is meaningful - the attacker must already hold an authenticated local account on the ATS infrastructure host - but once that condition is met, exploitation is low-complexity and requires no user interaction. There is no remote or network-exploitable path, no public exploit identified at time of analysis, and exposure is effectively bounded to shared or multi-user test servers where lower-tier or untrusted accounts are permitted to log on.
Local takeover of Oracle Application Testing Suite 13.3.0.1 via its OpenScript component allows an authenticated low-privileged user with logon access to the host to compromise the application, with high confidentiality, integrity, and availability impact. Exploitation is difficult (AC:H, described by Oracle as 'difficult to exploit') and requires local access plus a valid low-privileged account, making this a genuine-but-moderate-priority issue rather than a top-tier emergency. No public exploit code or CISA KEV entry was identified at time of analysis.
Takeover of Oracle Materials Requirement Planning (MRP) in Oracle E-Business Suite 12.2.3-12.2.15 is possible for a low-privileged attacker with network access via HTTP to the Internal Operations component, though the high attack complexity makes exploitation difficult. Successful attacks provide high confidentiality, integrity, and availability impact; authentication requirements and environmental timing/state conditions limit the attack surface. No public exploit identified at time of analysis, and the primary vendor reference is Oracle's October 2026 Critical Patch Update advisory.
Oracle Inventory Management 12.2.3 through 12.2.15 can be fully taken over by an authenticated low-privileged attacker who can log on locally to the infrastructure running Oracle E-Business Suite, through a high-complexity flaw in the Internal Operations component. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) reflects mandatory local access and conditions outside the attacker's control, so exploitation is difficult and Oracle labels it accordingly. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis, and no EPSS score was provided.
Product takeover is possible in Oracle Payroll 12.2.3 through 12.2.15, where a low-privileged attacker who can log on locally to the infrastructure hosting the application can exploit a difficult-to-control condition to fully compromise Payroll confidentiality, integrity, and availability. The CVSS 3.1 score is 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), confirming authentication with low privileges is required and that the attack is not network-reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Capacity in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a low-privileged, authenticated attacker who reaches the Internal Operations component over HTTP, with high confidentiality, integrity, and availability impact (CVSS 7.5). Exploitation is rated difficult (AC:H) because it depends on non-default preconditions that are not publicly documented. No public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; defenders should prioritize instances exposing the Capacity module to untrusted networks and verify the October 2026 Oracle CPU guidance.
Oracle Capacity in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a low-privileged authenticated attacker who can reach the Capacity module over HTTP, with high confidentiality, integrity, and availability impact (CVSS 8.8). The CVSS vector requires PR:L, so exploitation is not pre-authentication; any valid low-privileged EBS account is sufficient, making multi-user ERP deployments the main exposure. No public exploit code or confirmed active exploitation was identified in the supplied intelligence, and no EPSS score was provided.
Authenticated low-privileged users of Oracle E-Business Suite can read critical Oracle Capacity data-and potentially data in other linked EBS products-through HTTP requests to the Internal Operations component in versions 12.2.3 through 12.2.15. Exploitation is low-complexity and needs no user interaction, but it requires a valid EBS account (PR:L) and network access; no public exploit identified at time of analysis, making this a mid-to-high priority issue rather than an emergency.
Authenticated low-privilege users can read critical Oracle Capacity data-and, because of a scope change, potentially data from other Oracle E-Business Suite products on the same deployment-in Oracle Capacity 12.2.3 through 12.2.15. The flaw is remotely reachable over HTTP with low attack complexity and no user interaction, but it is not unauthenticated: the attacker must already hold valid EBS credentials. No public exploit code is identified in the supplied intelligence at time of analysis, and the CVSS 3.1 score is 7.7 with confidentiality-only impact.
Remote unauthenticated takeover of Oracle Solaris 11.4 is possible through a flaw in the 'Utility' component, which exposes a network-reachable TCP service to attackers with no credentials or user interaction. Oracle rates the issue CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact; the precise protocol, port, and vulnerable service configuration are not named in the available data and must be confirmed against the Oracle CPU October 2026 advisory. No public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis.
Authenticated low-privileged users with network HTTP access to Oracle Cost Management 12.2.3 through 12.2.15 can potentially take over the Cost Maintenance component, with high confidentiality, integrity, and availability impact (CVSS 7.5). Oracle rates the flaw difficult to exploit (AC:H), and exploitation requires a valid low-privileged E-Business Suite account plus reachable Cost Management deployment. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV.
Takeover of Oracle Sales Foundation, a component of Oracle E-Business Suite, is possible for authenticated low-privileged attackers who can reach the Security API over HTTP in versions 12.2.3 through 12.2.15. Oracle rates this 7.5 with high attack complexity (AC:H) and explicitly describes it as difficult to exploit, so success likely hinges on configuration state, timing, or target-specific reconnaissance rather than a simple request. No public exploit code and no CISA KEV entry were identified at time of analysis, and the required low-privileged EBS account further narrows the realistic attacker population.
Oracle EDI Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes critical EDI data to low-privileged network attackers via HTTP, allowing high confidentiality impact and limited integrity modification with a scope change that can affect additional connected Oracle products. Exploitation requires a valid low-privilege EBS/EDI Gateway account (PR:L) and network reachability to the EDI Gateway component; no public exploit or active exploitation is identified in the available intelligence. The CVSS 3.1 base score is 8.5, reflecting high confidentiality and low integrity impact.
Takeover of Oracle EDI Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for high-privileged attackers who can reach the component over HTTP, with high confidentiality, integrity, and availability impact. The issue is network-reachable, low-complexity, and requires no user interaction, but the CVSS PR:H prerequisite means an attacker must already hold an administrative-level EDI Gateway account, so realistic risk is concentrated among malicious privileged insiders or attackers who have already obtained admin credentials. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated data disclosure in Oracle BI EE 8.2.0.0.0 and 26.01.0.0.0 allows a remote attacker with HTTP access to the Analytics Server to read critical data or all data accessible through the product, with a CVSS 3.1 base score of 7.5 and confidentiality-only impact. No special conditions are required beyond network reachability, so exposure is bounded mainly by whether the Analytics Server HTTP interface is Internet-facing, VPN-restricted, or behind a WAF/reverse proxy. No public exploit identified at time of analysis.
Takeover of Oracle Enterprise Manager 13.5 and 24.1 is achievable by a low-privileged authenticated attacker with HTTP access to the Data Guard Management component. Exploitation requires only network reachability and a low-privilege account, yields high confidentiality, integrity and availability impact, and can affect additional products because of the CVSS scope change; no public exploit identified at time of analysis.
Low-privileged console users can achieve full takeover of Oracle Enterprise Manager for Oracle Database 13.5 and 24.1 through the Data Guard Management component, with scope change extending impact to managed databases and additional products reachable from the management server. The issue is network-reachable over HTTP with low complexity and no user interaction, but it requires a valid low-privileged OEM account (PR:L), so it is not unauthenticated. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 3.1 base score is 9.9.
A local privilege-escalation flaw in the Enterprise Manager Install component of Oracle Enterprise Manager Base Platform lets a low-privileged user who can log on to the host running the platform escalate to full control of the EM Base Platform itself, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.8). Only versions 13.5 and 24.1 are affected, and exploitation is not possible over the network - CVSS vector AV:L/PR:L/UI:N means the attacker needs existing interactive logon plus at least low-privilege credentials on the EM infrastructure, and no user interaction or non-default configuration. There is no public exploit code and no confirmed active exploitation (not in CISA KEV) at time of analysis; fixes are published in Oracle's October 2026 Critical Patch Update advisory.
Authenticated compromise of Oracle Enterprise Manager for Siebel 13.5 and 24.1 can escalate to full takeover through the Configuration Management component, with a low-privileged network attacker able to affect confidentiality, integrity, and availability at CVSS 8.8. The flaw requires only a valid low-privileged account and HTTP access, not user interaction, so exposure is significant wherever such accounts exist; however, no public exploit identified at time of analysis and no CISA KEV confirmation is present, so this is not assessed as an active emergency.
Low-privileged attackers who can reach Oracle Enterprise Manager for Siebel over HTTP can escalate to full takeover of the product's Configuration Management component in versions 13.5 and 24.1, per Oracle's October 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and low attack complexity, but a valid low-privileged account is a hard prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis; EPSS and KEV data were not available in the supplied intelligence, so real-world risk currently rests on the intrinsic severity and the niche deployment footprint of the Siebel management plug-in.
Oracle APEX versions 24.1.0 through 24.1.21, 24.2.0 through 24.2.20, and 26.1.0 through 26.1.4 contain an easily exploitable flaw in the General component that unauthenticated remote attackers can reach over HTTPS to fully compromise the APEX instance, with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 9.8). The Oracle CPU October 2026 advisory is the vendor's reference for this issue, and no public exploit code or CISA KEV listing was identified in the available data at time of analysis. Network exposure is the primary gating factor: any internet-reachable or otherwise attacker-accessibly APEX deployment on an affected release should be treated as high priority for patching.
Unauthenticated denial of service in Oracle Global Lifecycle Management NextGen OUI Framework (the NextGen Installer component) lets a remote attacker who can reach the product's HTTP endpoint hang or repeatedly crash it, wiping out availability of the installer/lifecycle-management service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5), so no credentials, user interaction, or special attacker-side setup are needed - the practical constraint is exposure, since installer endpoints are typically internal or short-lived rather than permanently internet-facing. There are no confidentiality or integrity impacts, so the flaw cannot be chained into data theft or code execution on its own; no public exploit code was identified at time of analysis, and no EPSS or CISA KEV signal was supplied. Affected releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and 15.1.1.0.0.
High-privileged attackers with HTTP reachability to Oracle EDI Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 can fully take over the component, with high impact to confidentiality, integrity, and availability. Exploitation requires existing high application-level privileges (CVSS PR:H) and network access, so anonymous or low-privileged users cannot directly exploit it; realistic abuse is confined to privileged insiders or adversaries who already control a privileged EBS account. No public exploit code or CISA KEV entry is identified in the available intelligence at time of analysis.
Authenticated low-privileged attackers can take over Oracle Enterprise Manager Base Platform 13.5 and 24.1 through the Agent Next Gen component over HTTP. The flaw is easily exploitable (CVSS 8.8, AC:L/UI:N) once any low-privilege account is obtained and the management interface is reachable, with high confidentiality, integrity, and availability impact. No public exploit was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the remediation reference.
Unauthenticated remote attackers who can reach the Siebel CRM Integration EAI HTTP interface can cause a hang or repeatedly crash the integration component, producing a complete denial of service against that service. All supported versions from 17.0 through 26.9 are affected, and the CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability and no confidentiality or integrity effect. No public exploit code or confirmed active exploitation was identified at time of analysis, so realistic risk depends primarily on whether the EAI endpoint is exposed beyond trusted internal networks.
Oracle Trusted Answer Search 26.1 exposes an information-disclosure flaw in its Application expert UI component that lets an attacker with an existing low-privilege account reach critical data over HTTP without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) confirms the attack is network-reachable and low-complexity, but it is not pre-authentication: a valid low-privileged login is the primary barrier, notwithstanding the 'Authentication Bypass' tag applied by the reporter. Because of the scope change (S:C), a successful exploit can expose confidential data belonging to other Oracle products reachable from the same deployment, so the blast radius is larger than the search component alone; no public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Trusted Answer Search 26.1 can allow a low-privileged authenticated attacker with network access to the Application expert UI to create, delete, modify, or read critical data after another user is induced to interact with attacker-supplied content. The CVSS 3.1 score is 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact and possible scope change to additional products, with no availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires both an existing low-privileged account and a separate human victim.
Oracle Trusted Answer Search 26.1 contains a high-severity Application expert UI flaw (CVSS 7.6) that allows a low-privileged authenticated attacker to submit crafted content over HTTP; when another user views that content, the attacker can gain unauthorized read access to critical data and limited insert/update/delete access, with the impact crossing a scope boundary. The attack is gated by valid low-privileged credentials and required victim interaction, so broad opportunistic exploitation is less likely; no public exploit identified at time of analysis.
Oracle Trusted Answer Search 26.1 contains a PL/SQL package flaw that lets low-privileged, authenticated attackers with Oracle Net connectivity fully compromise the component and potentially affect additional products due to a scope change. The CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact; exploitation requires valid low-privilege database credentials rather than anonymous access. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated low-privileged users can achieve integrity compromise and cause repeated denial of service against Oracle Trusted Answer Search 26.1 through a PL/SQL package reachable over Oracle Net, with the CVSS 3.1 score reaching 9.9 because the scope-change flag (S:C) extends the impact to additional products beyond the vulnerable component. Confidentiality exposure is limited to a subset of accessible data, but attackers can create, delete, or modify critical data and hang or repeatedly crash the service. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exposure hinges on whether low-privilege accounts and Oracle Net listener access are broadly granted in a given environment.
Unauthenticated remote takeover of Oracle WebCenter Sites is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0, per Oracle Fusion Middleware's October 2026 advisory. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means network attackers need no credentials or user interaction and can fully compromise confidentiality, integrity, and availability. No public exploit code or CISA KEV entry was identified in the supplied data at time of analysis.
Takeover of Trusted Answer Search 26.1 is possible for unauthenticated network attackers who can reach a vulnerable PL/SQL package over Oracle Net, with full confidentiality, integrity, and availability impact on success. The flaw is difficult to exploit because success depends on a condition outside the attacker's control, and only version 26.1 is listed as affected. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can take over Oracle Siebel CRM Development versions 17.0 through 26.9 through the Siebel Approval Manager component, but only if a targeted user is tricked into interacting with attacker-supplied content over HTTP. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact gated by mandatory user interaction. No public exploit code or confirmed active exploitation is identified in the available intelligence at time of analysis.
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.2.2 expose a confidentiality-only flaw in the Core component that lets a low-privileged, network-positioned user read data well beyond their intended authorization boundary. Because the CVSS vector carries a scope change (S:C) alongside high confidentiality impact, an attacker with valid low-level ORDS credentials can reach critical data and potentially affect other Oracle products reachable through the same deployment, though integrity and availability are untouched and exploitation requires an existing account (PR:L) rather than being fully unauthenticated despite the 'Authentication Bypass' tag. No public exploit code or CISA KEV confirmation was available at time of analysis, and the primary reference is Oracle's October 2026 Critical Patch Update advisory. Note that the 7.7 score reflects confidentiality exposure only; the practical risk is meaningful but not a drop-everything emergency.
Unauthenticated attackers with TCP network reach to Oracle Secure Backup 19.1.0.0.0 or 19.1.0.1.0 can take full control of the backup service, with high confidentiality, integrity and availability impact and a CVSS 3.1 base score of 9.8. The vendor rates the attack as low-complexity with no privileges or user interaction required, so network exposure is the main constraint. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Local privilege escalation in Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 lets an attacker who already holds a valid low-privileged logon on the OSB host take full control of the backup server through the Device Management and Support component. Because the vector requires local access (AV:L) and an existing account (PR:L), the realistic exposure is limited to environments where untrusted users can log on to the OSB infrastructure, but successful exploitation yields complete confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 can be taken over by an authenticated, low-privileged attacker who already has a local logon to the host, with scope change potentially affecting other products on that infrastructure. Exploitation is straightforward once local access exists (AV:L/AC:L/PR:L/UI:N/S:C), but it is not remotely reachable without a prior foothold; no public exploit was identified at time of analysis. This is a credible high-priority issue but not an emergency drop-everything item.
Unauthenticated remote attackers can cause a hang or frequently repeatable crash of Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 by reaching its TCP-exposed service, resulting in complete denial of service with a CVSS 3.1 base score of 8.6 and a scope change that may affect dependent products. This is a genuine high-priority availability risk for environments that run the affected product, but the signals are mixed: no public exploit or CISA KEV entry was provided in the available data, and practical exposure depends on whether the backup service is reachable from untrusted networks. Exploitation requires only network access, with no authentication and no user interaction per the assessed vector.
Local privilege escalation in Oracle Autonomous Health Framework 26.3 through 26.8 allows an authenticated, low-privileged user with a logon on the AHF host to take over the product's Trace File Analyzer component, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8). The flaw cannot be reached remotely or without credentials: exploitation depends entirely on the attacker already holding a local account on the infrastructure where AHF executes, so least-privilege OS accounts and tight host access control directly shrink the exposed population. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the Oracle advisory is the authoritative remediation source.
Local takeover of Oracle Autonomous Health Framework (Trace File Analyzer component) in versions 26.3 through 26.8: any user with an existing low-privileged logon on the Oracle Database or Grid Infrastructure host can exploit the component to gain full control of AHF, with high confidentiality, integrity and availability impact (CVSS 3.1 base score 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remote and needs no victim interaction, so exposure is confined to hosts where untrusted local principals already hold accounts or a foothold - shared and multi-tenant database servers carry the real risk, while single-administrator, tightly controlled hosts are substantially lower risk. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Oracle published it through its October 2026 Critical Patch Update.
Oracle Agile PLM for Process 6.2.4 can be taken over through its Product Quality Management component by unauthenticated remote HTTP requests, but the exploit path is rated high complexity and difficult rather than reliably repeatable. Oracle's October 2026 Critical Patch Update lists the issue with full confidentiality, integrity, and availability impact and no CWE mapping, and no public exploit or CISA KEV entry was identified in the provided intelligence at time of analysis. The combination of network reachability, no privileges or user interaction, and takeover-level impact makes this a high-impact but condition-dependent risk for supply-chain quality environments.
Full takeover of Oracle Product Lifecycle Analytics 3.6.1 is possible for a low-privileged authenticated attacker who can reach the application over the network and deliver a SQL-based attack against its Installation Issues component, with high confidentiality, integrity, and availability impact. Oracle rates the issue difficult to exploit (AC:H) and assigns CVSS 3.1 score 7.5; exploitation requires valid credentials (PR:L) and favorable conditions beyond the attacker's direct control. No CISA KEV entry or public exploit code is identified in the provided intelligence, so this should be handled on the normal Oracle CPU cadence rather than as an emergency.
Unauthenticated information disclosure in the Oracle Siebel CRM Deployment Cloud Gateway lets any remote attacker who can reach the gateway over HTTP read critical data and, per Oracle, potentially all data accessible through that deployment; supported versions 17.0 through 26.9 are affected. The CVSS 3.1 score is 7.5 with confidentiality-only impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction, no privileges, and no integrity or availability effect. Oracle's October 2026 Critical Patch Update advisory is the cited vendor reference and is the source of the fix; no public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Unauthenticated network attackers can read and modify critical data in Oracle Siebel CRM End User through the Portal Framework over HTTPS in versions 17.0 through 26.9. The CVSS 7.4 rating reflects high attack complexity, meaning successful exploitation depends on conditions outside the attacker's control and mass exploitation is less likely; no public exploit code or CISA KEV active exploitation has been identified at time of analysis. Confidentiality and integrity are affected, availability is not, and impact remains within Siebel CRM End User-accessible data.
Takeover of the Oracle EDI Gateway component in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a high-privileged attacker who can reach the application over HTTP, with full confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The critical qualifier is the PR:H prerequisite: the attacker must already hold an elevated EDI Gateway account, so this is not exploitable by unauthenticated or low-privileged users and realistic exposure is confined to trusted operators or adversaries who have already stolen such credentials. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the source data.
Access-control bypass in Oracle Siebel CRM Deployment 17.0 through 26.9 allows an authenticated local low-privileged user on the Siebel host to read or modify critical data through the Server Infrastructure component. The CVSS 3.1 vector requires local access and a valid low-privileged logon (AV:L/PR:L/UI:N), with high confidentiality and integrity impact but no availability impact. No public exploit code or CISA KEV activity was identified at time of analysis, and EPSS was not supplied.
Unauthenticated attackers can read sensitive data from Oracle Siebel CRM End User versions 17.0 through 26.9 by exploiting an authentication bypass in the UIF Open UI component over HTTP. The CVSS 7.5 vector shows network reachability with low complexity, no privileges, and no user interaction, but impact is confined to confidentiality (C:H/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers who can reach an Oracle Siebel CRM Deployment server over HTTP can read critical data or the full set of data accessible to that deployment, affecting versions 17.0 through 26.9 of the Server Infrastructure component. The flaw scores CVSS 3.1 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, meaning no credentials, no user interaction and no special configuration are prerequisites, and impact is limited to confidentiality - no integrity or availability effect is described. Oracle published the fix in its October 2026 Critical Patch Update; no public exploit code has been identified at time of analysis, and no EPSS score was supplied with the available intelligence.
Exposes critical data in Oracle Siebel CRM Deployment 17.0 through 26.9 to unauthenticated remote attackers through the TLS-exposed Server Infrastructure component, carrying a CVSS 3.1 score of 7.5 (High). Impact is confidentiality-only: attackers can read critical or all deployment-accessible CRM data but cannot modify data or disrupt service. No public exploit identified at time of analysis, and no CISA KEV entry was provided.
Low-privileged authenticated attackers can compromise Oracle Siebel CRM Deployment 17.0 through 26.9 over HTTP, gaining high confidentiality and integrity impact and causing partial denial of service (CVSS 8.3, PR:L). The affected Server Infrastructure component allows unauthorized creation, deletion, modification, and access to critical deployment data, and no public exploit code or CISA KEV entry was identified at time of analysis. Although tagged 'Authentication Bypass', the assessed vector requires valid low-privilege credentials and does not represent unauthenticated access.
Unauthorized data access and limited data modification in Oracle Siebel CRM Deployment 17.0 through 26.9 are possible for unauthenticated network attackers able to reach the Server Infrastructure HTTP interface. The CVSS 3.1 score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), reflecting high confidentiality impact and low integrity impact with no availability impact; Oracle tags the issue as an authentication bypass. No CISA KEV entry or public exploit code was identified in the supplied intelligence, so exposure is chiefly governed by whether the Siebel HTTP endpoint is reachable from untrusted networks.
SQL-layer compromise in Oracle Siebel CRM's Life Sciences eDetailing component, affecting versions 17.0 through 26.9, allows an authenticated low-privileged attacker with network access to execute SQL against the application and achieve full takeover, with high confidentiality, integrity, and availability impact. The vendor-assigned CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a low-complexity, no-user-interaction attack once low privileges are obtained; no public exploit identified at time of analysis.
Local takeover in Oracle Autonomous Health Framework 26.3 through 26.8 allows an authenticated low-privileged user with logon to the host to compromise the AHF Instant Diagnostic Replay component, with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 at 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the assessment emphasizes that it is local, not remotely exploitable, and requires a pre-existing host account. No public exploit identified at time of analysis.
Authenticated low-privileged users of the Siebel Life Sciences Web UI in Oracle Siebel CRM versions 17.0 through 26.9 can exploit a scope-changing flaw over HTTP to read and modify critical data beyond their own authorization boundary, but only if they can persuade another user to interact with the attack. The CVSS 3.1 score is 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), with high confidentiality and integrity impact and no availability impact. No public exploit was identified at time of analysis, and there is no CISA KEV entry.
Unauthenticated remote attackers can reach the Integration Broker component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 over HTTP and, by persuading a legitimate user to open a crafted link or act on an attacker-supplied request, obtain unauthorized read access to critical PeopleTools data plus limited unauthorized insert/update/delete capability. The mandatory user-interaction prerequisite (CVSS UI:R) keeps the attack from being an interaction-free, automatable mass-exploitation vector, and the impact is bounded to confidentiality (HIGH) and integrity (LOW) with no availability effect, giving a CVSS 3.1 base score of 7.1. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Takeover of the Siebel CRM Development component (Workflow) is achievable by a low-privileged authenticated attacker who can persuade a second user to interact with crafted Workflow content over HTTP; supported releases 25.12 through 26.9 are affected. Oracle rates this CVSS 3.1 base 7.1, but the vector (AC:H/PR:L/UI:R) stacks valid credentials, victim-driven social engineering, and high attack complexity, so it is a moderate-priority hardening item rather than an emergency. No public exploit code or active exploitation has been identified at time of analysis, and the issue is addressed through Oracle's Critical Patch Update program.
Takeover of Oracle Siebel CRM Cloud Applications is possible through the Siebel Cloud Manager component in supported versions 17.0 through 26.9, where a low-privileged, authenticated attacker with HTTP network reachability can exploit the flaw to gain full control of the application. The CVSS 3.1 score is 9.9 with a scope change (S:C), reflecting that compromise of Cloud Manager can spill over into additional, dependent products, with high confidentiality, integrity, and availability impact. Exploitation requires a valid low-entitlement account or reachable authenticated interface rather than anonymous access, but once that foothold exists, attack complexity is low and no user interaction is needed; no public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the issue in its October 2026 Critical Patch Update.
Unauthenticated attackers positioned on the physical communication segment attached to the hardware running Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.9) can exploit the Siebel Cloud Manager component to obtain complete read and write access to critical application data, with scope change extending the impact to additional products. The CVSS 3.1 base score is 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N): no credentials or user interaction are needed, but the High attack complexity and the requirement to already reside on the adjacent/local network segment substantially constrain real-world exposure, and availability is not affected. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, so the practical risk is concentrated in environments where untrusted parties can reach the Siebel Cloud Manager host's local segment.
Unauthenticated network attackers can cause a hang or frequently repeatable crash of PeopleSoft PeopleTools 8.61-8.63 and obtain limited read and write access to accessible data by inducing a legitimate user to interact with a crafted HTTP-delivered page or link. Oracle rates the issue easily exploitable once that human interaction occurs, with a CVSS 3.1 score of 7.6. No public exploit identified at time of analysis, making this a credible but second-tier priority.
Low-privileged, network-positioned users of PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Test Framework component to cross a security boundary and obtain read/write access to critical PeopleTools data, but only if they can persuade another user to interact with attacker-supplied content. The issue is rated CVSS 8.7 with high confidentiality and integrity impact and no availability impact; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 is achievable through its SQR reporting component, but only under narrow conditions: the attacker must already hold a logon account on the host where PeopleTools executes and must induce a different user to perform an action. Oracle scores this 7.0 High (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), with high attack complexity and a human-interaction requirement that make it a moderate-priority issue rather than an urgent, mass-exploitation threat. No public exploit code or confirmed active exploitation was identified at time of analysis, and PR:N indicates that no PeopleSoft application authentication is needed once local host access has been obtained.
Authenticated low-privileged attackers can achieve takeover of PeopleSoft Enterprise PeopleTools 8.61-8.63 by reaching the SQR component over HTTP, although Oracle rates the flaw as difficult to exploit because of high attack complexity (AC:H). The CVSS 3.1 score is 7.5 with high confidentiality, integrity, and availability impact, and exploitation requires valid low-privileged credentials (PR:L) but no user interaction (UI:N). No public exploit identified at time of analysis, and no CISA KEV confirmation was provided, so risk is concentrated in environments that expose SQR over HTTP and allow low-privileged accounts.
Unauthenticated attackers can tamper with critical data and cause a complete, repeatable denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by targeting the Report Distribution component over HTTP, but only if a legitimate user is induced to interact with the attack. The CVSS 3.1 score is 8.1 with high integrity and availability impact and no confidentiality impact. No public exploit identified at time of analysis, and the risk is high-priority but not an active-exploitation emergency.
Low-privileged, network-reachable attackers can corrupt or destroy data and repeatedly crash Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Report Distribution component exposed over HTTP. Successful exploitation yields high integrity and availability impact - unauthorized creation, deletion or modification of critical PeopleTools data plus hang or repeatable crash conditions approaching complete denial of service - while confidentiality is unaffected (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:H). Exploitation is not unauthenticated: a valid low-privileged account is required, so the realistic threat is insiders or attackers who already hold credentials and can reach the report distribution surface; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated HTTP requests to the SQR component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can return critical application data to anyone who can simply reach the web tier, a confidentiality-only but high-severity exposure scored CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N). Oracle addressed the flaw in its October 2026 Critical Patch Update; no public exploit code and no CISA KEV entry were identified in the data reviewed, so real-world risk hinges on whether the PeopleSoft Internet Architecture and SQR endpoints are internet-reachable or segmented behind VPNs, reverse proxies, or internal networks. This is a credible operational priority rather than an inflated high-CVSS artifact, because the attacker needs no credentials, no user interaction, and no non-default configuration once the endpoint is reachable.
Authenticated low-privilege users can read, create, modify, or delete critical data held in PeopleSoft Enterprise PeopleTools 8.61-8.63 - and, because the CVSS scope is changed, data in connected products as well - by sending crafted requests over HTTP to the SQR component. Exploitation is low-complexity and requires no user interaction, but does require a valid account (PR:L), so exposure is bounded to those who can obtain credentials such as insiders, phished users, or broadly provisioned portal accounts. No public exploit code and no CISA KEV entry were identified at time of analysis; internet-exposed PeopleSoft portals represent the highest realistic risk, and this is a genuine high-priority vulnerability rather than an inflated score.
Oracle PeopleSoft PeopleTools 8.61 through 8.63 can be fully taken over by an unauthenticated attacker who has access to the same physical or adjacent network segment as the host running the PsAdmin component. The flaw is rated CVSS 7.5 with high confidentiality, integrity and availability impact, but exploitation is explicitly difficult (AC:H) and requires network adjacency (AV:A), so it is not reachable from arbitrary internet locations; no public exploit code has been identified and it is not confirmed actively exploited (no CISA KEV listing). Oracle addressed it in the October 2026 Critical Patch Update, so priority should be moderate - patch on a normal cycle and treat segment isolation as the main exposure control.
Unauthenticated network attackers can achieve full takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Business Interlink component, though the high attack complexity - Oracle characterizes the flaw as 'difficult to exploit' - means success depends on conditions beyond the attacker's control, which materially reduces real-world exploitability. The vulnerability carries a CVSS 3.1 base score of 8.1 with complete confidentiality, integrity, and availability impact; no public exploit was identified at time of analysis. This is a genuinely serious but not top-tier-urgent issue, and risk concentrates on internet-exposed PeopleSoft portals where Business Interlink is reachable or in active use.
Takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 is possible through its Business Interlink component, where a low-privileged network attacker who can reach the integration endpoint over HTTP could achieve full confidentiality, integrity, and availability impact. Exploitation is constrained by high attack complexity and the need for valid authenticated access (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; 7.5), and no public exploit identified at time of analysis, with no KEV or POC signal in the provided intelligence.
Unauthenticated HTTP requests to the Report Distribution component in PeopleSoft Enterprise PeopleTools 8.61-8.63 can read critical PeopleSoft data, with Oracle scoring the flaw CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The weakness is described by Oracle as easily exploitable and affects confidentiality only, with no integrity or availability impact; no public exploit code or CISA KEV entry is identified at time of analysis, so risk is mid-tier and driven by the clean remote unauthenticated vector rather than confirmed exploitation.
Authenticated users of Oracle E-Business Suite's Capacity module (component: Internal Operations) in versions 12.2.3 through 12.2.15 can exploit this flaw over HTTP with low attack complexity and no user interaction to read critical Capacity data, perform limited unauthorized inserts/updates/deletes, and cause a partial denial of service within that module. The CVSS 3.1 score is 7.6 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, meaning the attacker must already hold a valid low-privileged EBS account, but no further privilege escalation or victim interaction is required. Oracle addresses it through its Critical Patch Update program; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and scope is unchanged so the compromise does not extend beyond Capacity-accessible data.