Oracle
Monthly
Unauthenticated network attackers can achieve full takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by targeting the Business Interlink component over HTTP, with high impact across confidentiality, integrity, and availability. Oracle rates the flaw as 'difficult to exploit' (CVSS 8.1, AC:H), meaning success hinges on conditions outside the attacker's control such as the specific configuration state or timing of the Business Interlink service, so this is a serious but conditional risk rather than an emergency. No public exploit code or confirmed active exploitation has been identified at time of analysis, and exploitation realistically depends on whether Business Interlink is enabled and reachable from untrusted networks.
Authenticated low-privilege attackers can read critical PeopleSoft Enterprise PeopleTools data and partially disrupt availability through the Portal component in versions 8.61 through 8.63. Exploitation requires network HTTP access and a valid low-privilege PeopleSoft account (PR:L), but no user interaction and low attack complexity make it straightforward once that foothold exists; there is no KEV confirmation or public exploit identified at time of analysis. The authentication prerequisite keeps this below top-tier priority, though risk is highest where the Portal is internet-exposed and low-privilege or self-service accounts are widely provisioned.
Oracle Capacity in Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged authenticated user read critical data, make limited unauthorized data changes, and cause partial denial of service through crafted HTTP requests to the Internal Operations component. No public exploit was identified at time of analysis, and this is not an anonymous authentication bypass despite the supplied tag; the PR:L vector means attackers need valid EBS credentials. The practical risk is therefore highest for insider threats or attackers who have already compromised a low-privileged EBS account.
Authenticated blind server-side request forgery in Tandoor Recipes before 2.6.10 allows a user with privileges to create a Space and configure an AI provider URL to force the server to connect to arbitrary internal addresses. The AI actions behind TARGET/api/ai-import/ and api/ai-step-sort/ pass the attacker-supplied provider URL straight to LiteLLM, bypassing the application's safe_request outbound filtering, and the resulting connection success, refusal, or timeout is surfaced as a reachability oracle that can be used to map internal hosts, ports, and cloud metadata endpoints. Exploitation requires an authenticated account (PR:L) and the AI provider feature to be in use, and exposure is limited to a blind oracle rather than confirmed response-body exfiltration; no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
Authenticated XPath injection in the OPNsense firewall and routing platform (all versions prior to 26.1.10) lets a user holding CA Manager or Certificate Manager privileges recover values stored in config.xml character by character. The Trust module stores attacker-controlled certificate and CA refid values and interpolates them unescaped into XPath queries in CAsField.php and CertificatesField.php; because the resulting refcount/in_use boolean is returned to the requester, it acts as a blind injection oracle for secrets such as password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, which in turn can enable privilege escalation and compromise of other security domains. Exploitation is post-authentication, requires those specific trust-management privileges, and is high-complexity and iterative (roughly one boolean leak per request), so this is a genuine but second-tier information-disclosure issue rather than a drive-by remote compromise; no public exploit code has been identified at time of analysis. Vendor-released patch: 26.1.10.
An out-of-bounds read in FreeRDP's smartcard redirection channel (CVE-2026-109677) lets a malicious or compromised RDP server leak heap memory from the connecting client by sending a LocateCardsByATRA request whose cbAtr byte count exceeds the fixed 36-byte rgbAtr/rgbMask buffers. Affected versions are 2.0.0-beta1 through 3.27.x (fixed in 3.28.0), and per the independent assessment the impact is confidentiality-only: the client must initiate the RDP session to the hostile server and must have smartcard device redirection negotiated so the LocateCardsByATRA handler is reachable. Repeated timing-oracle queries can extract memory bit-by-bit to defeat ASLR as a precursor to remote code execution, but no code execution occurs directly; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated account takeover in Portal del Hermano (Netherman, portaldelhermano.es) builds earlier than 2026-10-06 exploits the password-recovery endpoints POST /password/create-access and POST /password/email, which lack rate limiting and return distinct error messages acting as oracles for DNI, date of birth, phone number, and last four IBAN digits. An attacker can confirm the DNI, brute-force date of birth and IBAN digits, obtain the phone number via OSINT, and supply an attacker-controlled email to receive the password-reset link, achieving full takeover of any member account across all tenants, including profile data, full IBAN, and fiscal documents. No public exploit identified at time of analysis; disclosed CVSS 9.1 (CVSS 4.0) reflects high impact but high attack complexity (AC:H, PR:N, UI:N per independent assessment).
SurrealDB deployments before 3.3.0 allow an authenticated caller who holds table-level WRITE permission but is denied SELECT on specific fields to read those hidden field values anyway, by issuing JSON Patch 'copy' or 'move' operations whose pointers are resolved against the unreduced record before field-level permission filtering is applied. The same weakness lets an attacker use PATCH 'test' operation mismatch errors as a boolean disclosure oracle to confirm the contents of SELECT-restricted fields. The issue is rated CVSS 7.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N, and a 3.1-equivalent assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), making it a credible but moderate-priority confidentiality flaw rather than an emergency; no public exploit identified at time of analysis, and it does not affect unauthenticated attackers or deployments that do not rely on field-level SELECT restrictions as a security boundary.
An out-of-bounds write in Oracle VM VirtualBox before 7.2.8 lets a user with a foothold inside a guest VM corrupt memory in the host-side hypervisor process through the emulated PCNet (Am79C970A) network adapter. The flaw sits in pcnetReceiveNoSync in DevPCNet.cpp, and because the write crosses the guest-to-host boundary it can lead to host memory corruption and potential code execution in the VirtualBox process, though integrity and availability impacts are the primary outcomes. Exposure is materially narrower than the vendor-supplied 9.1 network-vector score implies: the vulnerable code path is only reachable when the VM is explicitly configured with the legacy PCNet NIC rather than VirtualBox's modern Intel PRO/1000 or virtio-net defaults, and the attacker must already have local user-level access in the guest. No public exploit has been identified at time of analysis, SSVC records exploitation as none, and there is no CISA KEV listing.
Blind SQL injection in YesWiki before 4.6.7 allows unauthenticated remote attackers to read arbitrary database contents, including administrator password hashes from the yeswiki_users table, by planting a crafted option id in an anonymously editable Bazar list and then using {{newtextsearch}} requests as a boolean oracle. Successful exploitation depends on the deployment actually permitting anonymous editing of a Bazar list, and because the technique is blind, extraction is slow and noisy rather than a single-shot dump. Vendor severity is 8.7 (CVSS 4.0, AV:N/AC:L/PR:N/UI:N); our independent assessment, based on CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, confirms a high-confidentiality, no-integrity, no-availability impact with no authentication or user interaction required, and no public exploit code identified at time of analysis, with no evidence of confirmed active exploitation (CISA KEV).
Observable padding discrepancy in the IES/ECIES decryption path of Bouncy Castle C# (bc-csharp) before 2.7.0 lets an unauthenticated remote attacker who has captured a valid ciphertext recover its plaintext through a CBC padding-oracle attack, because IesEngine.DecryptBlock strips padding and reports a distinguishable error before the MAC is checked. Exploitation requires non-default application behavior: IesEngine must be constructed directly with a padded block cipher such as AES-CBC with PKCS#7 padding, and the attacker must be able to repeatedly submit modified ciphertexts for decryption under the same static key pair and distinguish padding failures from MAC failures; stream-mode IES and standard ephemeral ECIES usage are explicitly unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor CVSS 4.0 score of 8.2 is materially moderated by these prerequisites, which our independent assessment rates as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
SQL injection in the n8n Oracle Database node's Delete Table Drop operation lets an attacker break out of the table or schema identifier with a single quote and append arbitrary SQL, which then runs against the connected Oracle database with the privileges of the stored credential. Affected releases are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0 (fixed in 2.39.6 and 2.40.1 respectively); the CVSS vector records PR:N, i.e. unauthenticated, but exploitation is conditional on a workflow that actually uses the Oracle Database node's Delete Table Drop operation with table or schema values sourced from attacker-influenceable input, which is why attack complexity is rated high (AC:H/AT:P) and the issue does not affect a default install with no such workflow. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis.
The Linux kernel's Reliable Datagram Sockets (RDS) connection teardown path contains a race condition in rds_conn_shutdown() that can crash or hang the kernel, causing denial of service on systems where the RDS subsystem is loaded and connections are being shut down or failed over. The flaw stems from teardown merely sampling the RDS_IN_XMIT and RDS_RECV_REFILL fastpath bits as clear instead of owning them, so a concurrent rds_send_xmit() or rds_ib_recv_refill() can re-acquire the bit and run while the transport re-initializes its rings and rds_send_path_reset() rewrites transmit state under it. Because the store-buffering pattern only manifests where memory ordering is weak (for example ARM), and because the accept-side state check must pass before the path moves to RDS_CONN_DISCONNECTING, reliable triggering is difficult and the practical impact is limited to kernel instability; no public exploit code has been identified at time of analysis and vendor patches are available.
DBHub's `readonly = true` option on its `execute_sql` tool fails to enforce read-only database access in versions prior to 0.22.6, because the connector code that would set PostgreSQL `default_transaction_read_only=on` and open SQLite in read-only mode is gated on a configuration value that is never populated. With only a first-keyword classifier left as a guard, any `SELECT` that calls a side-effecting function passes, allowing sequence tampering with an ordinary role and, with a privileged PostgreSQL role, arbitrary host file write via `lo_export`, arbitrary host file read via `pg_read_file`, and remote code execution via `dblink` combined with `COPY ... TO PROGRAM`. The HTTP transport is unauthenticated (CVSS vector PR:N) and binds to `0.0.0.0` by default, so any network caller of `/mcp` can reach the vulnerable tool; CVSS is 7.4 (AV:N/AC:H) and no public exploit code has been identified at time of analysis, though the vendor-released patch 0.22.6 resolves the issue.
Unauthenticated MCP tool invocation in DBHub versions prior to 0.22.5 allows a malicious website to reach the HTTP transport endpoint and dispatch database tool calls against connected Postgres, MySQL, SQL Server, Oracle, MariaDB, or SQLite databases, because the server's Origin-equals-Host check is defeated by DNS rebinding. The flaw applies only when DBHub is launched in the non-default HTTP transport mode (for example --transport http --port 8080); the default stdio transport is unaffected, and exploitation requires a victim's browser to load attacker-controlled content and successfully complete the rebind window, per the independent assessment. No public exploit has been identified at time of analysis, and while the CVSS 4.0 vector scores 9.3, the assessed real-world severity is lower (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L), with impact bounded by DBHub's configured tool permissions and database credentials - read-only configurations limit exposure to disclosure.
Server-side request forgery in the GitHub Enterprise Server notebook viewer allows a remote attacker to direct requests to internal services listening on non-standard ports of the same appliance, because the viewer validated a user-supplied URL's scheme and host but not its port. Response bodies are not returned, but response timing acts as an oracle that can be used to extract instance secrets character by character; an extracted secret can then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. All GitHub Enterprise Server versions 3.17 through 3.22 are affected; exploitation requires network access to the instance and is unauthenticated only when private mode is disabled, otherwise any authenticated user suffices, and no public exploit has been identified at time of analysis. Note that the independent assessment rates this as high difficulty (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), since full impact depends on a multi-step timing-oracle extraction succeeding and a usable internal service being reachable for the follow-on RCE.
Field-level read permission bypass in Twenty CRM before 2.22.0 lets an authenticated workspace member or API key that is allowed to read an object but explicitly denied read on a specific field still reference that denied field inside GraphQL or REST filter predicates, turning the returned totalCount and row presence into a boolean/count oracle that can reconstruct the hidden values. The vulnerability is a bounded confidentiality issue: exploitation requires a principal whose role actually configures field-level read restrictions, and reconstruction only works against records already visible under that principal's row-level policy, and it is iterative across many queries rather than a single-shot dump. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released a patch in Twenty 2.22.0.
SQL injection in the Traccar GPS tracking server affects all versions prior to 6.14.0 and allows an authenticated, non-read-only user to extract arbitrary database values - including administrator email addresses, password hashes and salts - or to conditionally delete permission rows. The attacker submits a DELETE /api/permissions request with an extra, attacker-chosen JSON key: only the first two keys are validated by Permission.java, while DatabaseStorage.removePermission() concatenates every map key into the SQL WHERE clause as a column identifier, turning the key name into injectable SQL and providing a blind boolean/error oracle. Exploitation requires a valid account with write permissions and access to at least one object usable in a permission pair; unauthenticated requests are explicitly rejected (CVSS 3.1 7.1, PR:L, C:H/I:L). No public exploit code has been identified at time of analysis, and a vendor-released patch (6.14.0) is available.
Unauthenticated remote attackers can achieve account takeover in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 by guessing weakly generated activation/login pairing codes. The getRandomCode() function in objects/functions.php relies on uniqid() output, limiting the code space to roughly 2^25 values for a known generation second; the plugin/API/set.json.php?APIName=login_code endpoint leaks server microtime as an oracle, and a guessed valid code (10-minute TTL) redeemed at plugin/API/get.json.php?APIName=login_code yields the victim's email and a one-year User::getUserHash credential. No vendor patch is available and no public exploit code has been identified, though the weak PRNG and unauthenticated oracle make the attack a genuine account-takeover primitive tempered by high attack complexity (AC:H/AT:P) due to the timed probabilistic guess.
Server-side template injection in Craft CMS 5.10.0 through 5.10.12 allows an authenticated low-privilege control-panel user with edit rights on even a single element type to execute arbitrary PHP code and fully compromise the server. The bug is an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() to View::renderObjectTemplate() redirect sink stayed unsandboxed, and the same patch introduced a self-signing oracle in Cp::elementLabelHtml(); because Craft/Yii HMAC tokens are not bound to a parameter name, a token minted over attacker-controlled Twig for returnUrl can be replayed as the redirect POST parameter. Exploitation requires a valid CP account with element-edit permissions (PR:L, no user interaction); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released patch is Craft CMS 5.10.13.
Unauthenticated arbitrary Python module import in djust before 1.0.7 lets any client that can reach the WebSocket or SSE mount endpoint force the server to import a module chosen by a client-supplied dotted path, executing that module's import-time side effects before any LiveView subclass check or per-view authentication occurs. The LIVEVIEW_ALLOWED_MODULES allowlist that should constrain this lookup is fail-open (the check is skipped when the setting is unset, which is the framework default) and uses loose startswith matching, so the flaw is reachable in a default configuration; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Impact is bounded by what is already installed and importable on the host: guaranteed outcomes are denial of service (import bombs, expensive dependency trees) and a module/class enumeration oracle exposed through distinct error strings, escalating to RCE-by-proxy where a suitably side-effectful module exists. No public exploit has been identified at time of analysis - the maintainer retains the reproducer privately - and there is no CISA KEV listing.
A padding oracle in on-premises Delinea Secret Server (versions 10.5.1 through 12.1.3) allows unauthenticated remote attackers to decrypt or forge data protected with one of the server's own cryptographic keys, although the key material itself is never exposed. Exploitation is not trivial: it is an adaptive chosen-ciphertext attack that requires many crafted requests and a distinguishable padding-validation response from an exposed cryptographic operation, which is why the vendor scores it 9.1 Critical (CVSS 4.0) while the assessed vector (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) reflects high complexity and only partial integrity loss on the vulnerable component. EPSS is low at 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; the elevated overall severity comes from the key's role protecting data across subsequent systems (SC:H/SI:H/SA:H), not from a single-request or trivially reproducible attack.
Remote compromise of Oracle GraalVM is possible: an unauthenticated attacker with HTTP access can exploit a defect in the Compiler component to achieve full takeover of the affected runtime, with high confidentiality, integrity and availability impact. Affected builds are Oracle GraalVM for JDK 17 (23.0.13.1), Oracle GraalVM for JDK 21 (23.1.12.1) and Oracle GraalVM 25 (25.0.4.1). No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently assessed as targeted rather than opportunistic; note that the accompanying 'Information Disclosure' tag understates the stated impact.
Oracle GraalVM (including GraalVM for JDK 17/21, GraalVM Enterprise Edition and GraalVM 25.x) contains a flaw in its Compiler component that a network-positioned attacker can reach over HTTP without authenticating. Successful exploitation can expose critical data, allow limited unauthorized modification of data, and cause a partial denial of service; Oracle characterizes the issue as difficult to exploit per the AC:H metric, implying attacker-controlled timing or memory-layout preconditions. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.0 with a high confidentiality impact.
Remote compromise of Oracle GraalVM for JDK is achievable through a flaw in the bundled Compiler component, where a crafted attack delivered over HTTP can lead to full takeover of the affected runtime with high confidentiality, integrity, and availability impact. The vulnerability affects Oracle GraalVM for JDK 17 version 23.0.13.1, Oracle GraalVM for JDK 21 version 23.1.12.1, and Oracle GraalVM 25.0.4.1, and Oracle explicitly rates it as 'difficult to exploit' (CVSS 3.1 AC:H) despite an 8.1 base score and no authentication requirement. No CISA KEV listing, EPSS score, or public exploit code was provided in the source data, so active exploitation is not confirmed at time of analysis.
Unauthenticated remote denial of service in Oracle Helidon versions 4.0.0 through 4.5.4, specifically the helidon-webserver-static-content component, allows a network attacker to hang or repeatedly crash the server via HTTP and render the application unavailable (CVSS 3.1 base 7.5, A:H only). Oracle characterizes the flaw as easily exploitable (AV:N/AC:L/PR:N/UI:N/S:U), but no public exploit code, EPSS score, or CISA KEV listing was provided at time of analysis, so active exploitation is unconfirmed. Impact is availability-only: there is no reported confidentiality or integrity loss.
Oracle GraalVM 25.0.4.1 contains a flaw in the Compiler component that allows an unauthenticated network attacker to compromise the runtime over HTTP and achieve full takeover, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N). The high attack complexity indicates the attacker cannot simply fire a request and win — exploitation depends on runtime state, timing, or a specific compilation path that must be reached. No public exploit code, no CISA KEV listing, and no EPSS data were provided with this record, so active exploitation is unconfirmed at time of analysis, but a patched version beyond 25.0.4.1 should be treated as the target state for any internet-facing GraalVM deployment.
Oracle GraalVM 25.0.4.1 contains a flaw in its compiler component that permits an unauthenticated, network-positioned attacker to take full control of the GraalVM instance, with high confidentiality, integrity, and availability impact. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and explicitly calls it 'difficult to exploit', implying exploitation depends on precise
Full takeover of Oracle GraalVM 25.0.4.1 is achievable by an unauthenticated attacker who can reach the affected runtime over HTTP, through a flaw in the Compiler component that Oracle rates CVSS 8.1 with high confidentiality, integrity and availability impact. The high attack-complexity metric indicates exploitation hinges on non-trivial conditions — a particular compilation path, input shape, or runtime state — rather than a single trivially crafted request, which limits opportunistic mass scanning. No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis, and no EPSS score was supplied with the source data.
Oracle VM VirtualBox 7.2.16 can be crashed — repeatedly and remotely — by an unauthenticated attacker who can reach the product's RDP (VRDP) listener over the network, producing a complete denial of service of the virtualization platform (CVSS 3.1 base 7.5, availability-only impact). Only hosts that have the Remote Display / Extension Pack path enabled and reachable are realistically exposed, since VRDP is an optional, non-default feature. No CISA KEV listing or public exploit code was identified in the supplied intelligence at time of analysis; EPSS data was not provided, so real-world exploitation likelihood is unquantified.
Let me synthesize. CVE-2026-87276: Oracle VM VirtualBox Core, version 7.2.16. CVSS 3.1 7.5, vector AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H. CWE not provided. Description says "Difficult to exploit" — high complexity. Requires logon (low privileged attacker), human interaction. Scope change (S:C) — impacts additional products. Tags: Information Disclosure, Oracle — but description says takeover of VirtualBox with C/I/A high — so "Information Disclosure" tag is arguably mislabeled. Hmm — should I emit a data_quality_flag for mislabeled_tag "Information Disclosure"? The description mentions takeover with confidentiality, integrity, and availability impacts. The tag "Information Disclosure" is only a partial characterization. Is it "clearly wrong and verifiable"? It's arguably incomplete rather than wrong. Oracle hypervisor escape / VM takeover isn't purely info disclosure. I could flag it as mislabeled with medium confidence. Given the guidance "only emit a flag when the input metadata is clearly wrong and verifiable" — C:I:H implies information disclosure is a component, but the impact includes takeover with integrity/availability. I think flagging is defensible but risky. I'll include it with medium confidence... Hmm. Actually the rule says "Do NOT invent problems to fill the array." The tag isn't clearly wrong — CVSS C:H means confidentiality impact exists, so information disclosure applies partly. I'll leave data_quality_flags empty. Hmm, but maybe also a missing tag? No clear missing tag. Actually, let me reconsider: the description says scope change — attacks may significantly impact additional products. This is characteristic of VM escape (guest → host or host → other VMs). AV:L, PR:L with logon to infrastructure where VirtualBox executes. UI:R human interaction. Note: This is a fabricated CVE (2026). No KEV, no POC, EPSS not provided. Oracle CPU-style advisory link (cspusep2026.html — "Oracle Critical Patch Update Security ... "). Version 7.2.16 supported. Note
The user wants a JSON analysis for CVE-2026-87273, Oracle VM VirtualBox Core, CVSS 8.6, AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Let me construct fields carefully. Product name: "Oracle VM VirtualBox" (3 words... "Oracle VM VirtualBox" - that's 3 words). Good. Summary: Do not start with "A vulnerability". Start with impact verb + product. Something like: "Oracle VM VirtualBox 7.2.16 contains a Core component flaw that lets an attacker with logon access to the host... trigger memory corruption via a crafted guest/host interaction requiring user interaction, leading to full takeover of the VirtualBox process with scope change affecting additional products." Technical context: Hypervisor/core component, scope change S:C means the vulnerability in VirtualBox can impact other components (e.g., host OS or other VMs). AV:L means local access — attacker must have logon to infrastructure where VirtualBox executes — that's a common Oracle phrasing for AV:L (local logon, but not necessarily VM guest). CWE not provided, but Oracle typically assigns memory safety / sandbox escape classes. We shouldn't invent CWE. State that CWE was not assigned/provided and the root cause class is inferred from CVSS scope change and impacts — likely a flaw in the Core component enabling escape from intended privilege boundary. Risk assessment: CVSS 8.6 high, AV:L reduces, AC:L, PR:N but requires logon (authentication requirement nuance — description says "unauthenticated attacker with logon to the infrastructure"). PR:N in vector but "with logon" is ambiguous — Oracle's AV:L/PR:N means the attacker has a local account on the host but no elevated privileges. UI:R — requires victim user interaction. S:C — scope change. EPSS not provided, no KEV, no POC info. State explicitly that EPSS/KEV data absent. Affected products: Oracle VM VirtualBox 7.2.16 (per Oracle advisory cspusep2026). Note the advisory URL. CPE not provided. Remediation: patch — Oracle advisories reference fixes in CPUs; version f
Oracle VM VirtualBox 7.2.16 (Core component) can be fully compromised by a low-privileged attacker who already has an interactive logon on the host where VirtualBox executes, allowing takeover of the VirtualBox process and, by extension, the workload it manages. The flaw carries a CVSS 3.1 base score of 7.8 with complete loss of confidentiality, integrity and availability, and is rated by Oracle as 'easily exploitable' with no user interaction required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation requires local access rather than a remote network vector.
Oracle VM VirtualBox 7.2.16 on Windows hosts contains a flaw in the Core component that lets an attacker who already holds low-privileged interactive logon on the host machine take full control of VirtualBox itself, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8). The vulnerability is local-only (AV:L) and applies exclusively to Windows hosts — Linux and macOS installations are reported as unaffected. No public exploit code or CISA KEV listing is present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Local privilege escalation in Oracle VM VirtualBox 7.2.16 on Windows hosts allows a low-privileged user who can log on to the machine to take full control of the hypervisor, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). Oracle's advisory rates the flaw as easily exploitable, but no public exploit code has been identified at time of analysis. The vulnerability applies only to Windows hosts, so Linux and macOS installations of the same release are not in scope according to the vendor.
A local attacker who already holds a low-privileged logon on a Windows host running Oracle VM VirtualBox 7.2.16 can fully take over the VirtualBox product through a flaw in its Core component, achieving high confidentiality, integrity and availability impact within the VirtualBox context (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Only Windows hosts are affected per Oracle, and the vendor characterises the issue as easily exploitable with no user interaction required. No KEV listing, EPSS score or public exploit code was present in the supplied intelligence, so no public exploit is identified at time of analysis.
Full takeover of Oracle VM VirtualBox 7.2.16 on Windows hosts is possible for a low-privileged user who already has an interactive logon on the machine, giving complete loss of confidentiality, integrity, and availability for the VirtualBox process and the guest VMs it manages. The flaw is reached locally (AV:L) with low complexity and no user interaction beyond that initial logon (PR:L, UI:N), so it is a local privilege-escalation/containment-escape class issue rather than a remote one. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied in the source data.
Unauthenticated remote attackers who can reach the Oracle Agile PLM 9.3.6 Application Server over HTTP can bypass access controls to read all data the application can access, and can also degrade service availability (partial denial of service). Oracle rates this 8.2 with a network, low-complexity, no-privileges, no-interaction vector, meaning the flaw is trivially reachable and automatable by anyone who can route packets to the web interface. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Oracle E-Business Suite deployments running Oracle Purchasing 12.2.3 through 12.2.15 expose a flaw in which any authenticated low-privileged user can reach a Purchasing web endpoint over HTTP and read, create, modify, or delete critical procurement data they should not be able to touch. With a CVSS 3.1 base of 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), the issue is trivial to trigger once a valid EBS account exists, and Oracle treats it as critical in its September 2026 Critical Security Patch Update. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this reads as a broadly-applicable, low-complexity authorization defect that requires an account rather than as an actively exploited campaign.
Authenticated low-privileged users can tamper with critical business data in Oracle PeopleSoft PeopleTools 8.61 through 8.63 by abusing the Integration Broker component over HTTP. Oracle rates the flaw 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), an integrity-only impact that can also propagate into other applications attached to the same integration fabric. No public exploit code, EPSS score, or CISA KEV listing was supplied with this record, so the current evidence does not support confirmed active exploitation.
Unauthenticated attackers positioned on the same network segment as a host running Oracle Agile Engineering Data Management 6.2.1 can reach the Engineering Communication Interface component and read critical engineering data or alter stored records, according to Oracle's Supply Chain security alert. The flaw carries a CVSS 3.1 base score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), meaning no credentials, no user interaction and no attack complexity are required once adjacency is achieved. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied.
Oracle Agile Engineering Data Management 6.2.1 (Engineering Communication Interface component) allows an attacker who already holds a low-privileged logon on the host to reach critical application data and modify records, with a scope change that extends impact to interconnected products. The vendor rates this 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), so the barrier is local access plus valid credentials rather than remote unauthenticated reach. There is no public exploit code identified and the issue is not listed in CISA KEV at time of analysis; exploitation would most plausibly be an insider or post-compromise privilege escalation within a PLM deployment.
Authenticated users with access to the same physical communication segment as the server can abuse the Engineering Communication Interface in Oracle Agile Engineering Data Management 6.2.1 to bypass intended access controls and read or alter application data, producing high confidentiality and integrity impact. The vulnerability is rated CVSS 3.1 7.3 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning an attacker must already hold low-privileged credentials and be positioned on the adjacent network segment rather than reaching the service over the internet, and no user interaction is required on the victim's part. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate, tightly constrained risk that becomes serious only for organizations exposing the Engineering Communication Interface to shared or untrusted local segments.
Oracle Agile Engineering Data Management 6.2.1, specifically its Engineering Communication Interface component, can be abused by a low-privileged user who already holds a logon to the host where the application executes, allowing unauthorized reading, creation, deletion or modification of critical engineering data and potentially affecting connected downstream products (CVSS 3.1 scope change, base score 8.4). The flaw is rated High with a local attack vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), so it is not remotely exploitable without first obtaining a local session or low-privileged account. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation pressure is currently unquantified.
Oracle Agile PLM 9.3.6 contains an access-control flaw in the Folders, Files & Attachments component that lets a low-privileged, network-connected attacker reach data and records they should not be able to touch, provided a second user is induced to interact with the crafted request. Successful exploitation yields high confidentiality impact (broad read access to PLM data) and limited integrity impact (unauthorized insert/update/delete of some records), and because the vulnerable component bridges into connected Oracle products the CVSS scope is changed. No public exploit code or CISA KEV entry has been identified at time of analysis, so this is a patch-window issue rather than an active emergency.
Oracle Agile PLM 9.3.6 exposes a confidentiality-only flaw in its SDK component that lets an attacker who already holds a low-privileged account read critical data through an ordinary HTTP request, with the impact spilling beyond Agile PLM into other reachable Oracle products (CVSS scope change). Oracle rates the issue 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), noting no integrity or availability impact. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
An authenticated, low-privileged user with HTTP access to the Oracle Agile PLM 9.3.6 Application Server can break out of their assigned access controls and read data they should never see, including records belonging to other tenants, projects, or business units — with vendor scoring putting confidentiality impact at High and noting the attack can also affect interconnected products (scope change). No integrity or availability impact is described, so this is a pure data-exposure bug rather than a code-execution or data-destruction issue. Oracle published the fix through its Critical Security Patch Update cycle referenced at oracle.com/security-alerts/cspusep2026.html; no EPSS score, CISA KEV listing, or public proof-of-concept was supplied in the available intelligence, so exploitation status is unconfirmed.
Oracle Agile PLM 9.3.6 contains a hard-to-trigger flaw in the Folders, Files & Attachments component that allows a low-privileged attacker with network access over HTTP to fully compromise the application, with high impact to confidentiality, integrity and availability. Exploitation requires an authenticated low-privileged account and a difficult, high-complexity set of conditions, which materially narrows the realistic attack surface. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied with the source data.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a low-privileged, authenticated attacker with HTTP network access to read critical financial data and to update, insert, or delete some of the data the application exposes, with the impact spilling over into other products (scope change). Exploitation is straightforward once access is obtained but requires human interaction from a user other than the attacker, so it cannot be fully automated. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); EPSS data was not supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated, network-positioned attacker tamper with or destroy critical financial consolidation data and partially degrade service availability — but only if a victim user is persuaded to interact with the attacker's crafted request (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, base 7.1). Integrity is the dominant impact (I:H), with only partial denial of service (A:L) and no confidentiality exposure (C:N). There is no public exploit identified at time of analysis and no KEV listing; no EPSS score was supplied in the source data, so the exploitation-probability signal is absent rather than low.
Low-privileged authenticated attackers with HTTP network access can fully take over Oracle Hyperion Financial Management 11.2.26.0.000 by exploiting a high-complexity flaw in the product's Security component, achieving high confidentiality, integrity and availability impact. Oracle rates the issue CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting that exploitation is difficult but complete compromise results. No public exploit code and no CISA KEV listing were observed at time of analysis, and no EPSS score was supplied, so real-world exploitation activity is unconfirmed.
Full takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an authenticated attacker holding high privileges, who can send crafted HTTP requests to the Security component and gain complete control of confidentiality, integrity, and availability. The vulnerability is rated CVSS 7.2, and no public exploit code or active exploitation has been identified at time of analysis; EPSS data is unavailable. The high-privilege requirement limits exposure to already-compromised or insider accounts, but successful exploitation yields total application compromise.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a low-privileged account and sits on the same adjacent network segment as the HFM server take full control of the application. Exploitation is rated AV:A/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact, and Oracle's January 2026 Security Alert (cspusep2026) is the authoritative advisory. No public exploit code has been identified and there is no CISA KEV listing at the time of analysis, so risk is concentrated in environments where untrusted parties can reach the HFM host's network segment.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a high-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity and availability impact across a single security scope. Successful exploitation means takeover of the HFM platform rather than a narrow data leak — the attacker gains the ability to read, alter and disrupt the financial consolidation environment. The vulnerability is remotely reachable and low-complexity once the required privileged position is obtained, though no public exploit code and no CISA KEV entry have been reported at time of analysis; the fixed release is delivered through Oracle's Critical Security Patch Update channel.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated attacker positioned on the same adjacent network segment read and tamper with critical financial consolidation data. The vendor rates it CVSS 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting a hard-to-execute but high-impact attack that can also affect connected EPM products through a scope change. No public exploit code or CISA KEV listing was identified at time of analysis, and no CWE or EPSS data accompanies the advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-trigger but unauthenticated network flaw in its Security component that lets an attacker reaching the TLS-exposed service read, create, modify or delete any financial consolidation data the application can access. CVSS 3.1 scores it 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting complete confidentiality and integrity loss with no availability impact, and Oracle explicitly characterises exploitation as difficult. No public exploit code, EPSS score, or CISA KEV entry was provided at time of analysis, so this should be treated as a patch-now integrity risk to financial reporting data rather than an actively exploited incident.
Authentication bypass in Oracle Hyperion Financial Management 11.2.26.0.000 allows an unauthenticated attacker positioned on the adjacent network segment to read, create, modify, or delete critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact. No public exploit code, EPSS score, or CISA KEV listing was included in the available intelligence, so active exploitation is unconfirmed at time of analysis.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an authenticated attacker who already holds a low-privileged logon on the host running the application seize full control of the HFM instance, with high confidentiality, integrity and availability impact. Oracle rates the attack as difficult (AC:H) and the vector is strictly local (AV:L) with no user interaction, so the exposure is limited to operators of the affected server rather than the network at large. No public exploit code has been identified at time of analysis, and the only supplied reference is Oracle's Critical Security Patch Update advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a high-privileged account reach the application over HTTP and fully take over the HFM instance, with high impact to confidentiality, integrity, and availability. Exploitation is rated as easy (AC:L, no user interaction) once the privileged foothold exists, so the practical barrier is obtaining or abusing an administrative credential rather than defeating any exploit mitigation. There is no public exploit code or CISA KEV entry at time of analysis, and no EPSS score was supplied, so the real-world risk is driven by internal admin-account hygiene and network exposure of the HFM web tier.
Authenticated low-privileged attackers who can reach the SQL-facing surface of Oracle Hyperion Financial Management 11.2.26.0.000 can achieve complete takeover of the application. Oracle's advisory rates this 8.8 with full confidentiality, integrity, and availability impact, and the flaw is described as easily exploitable with no user interaction required. At the time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS score in the supplied intelligence, so this should be treated as a high-severity, patch-now issue rather than a known active campaign.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged, network-connected user take full control of the application, with high impact to confidentiality, integrity and availability. Exploitation is rated difficult (AC:H) because it depends on a narrow timing or state precondition, but once met it requires only an authenticated low-privilege session over HTTP and no user interaction. No public exploit code or CISA KEV entry was provided at time of analysis, and no CWE classification or EPSS score accompanied the vendor disclosure.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an easily exploitable security flaw in its Security component that lets a low-privileged, authenticated attacker reach the application over HTTP and obtain unauthorized access to critical financial consolidation data, with a secondary ability to cause a partial denial of service. The vendor rates it 7.1 with network vector, low complexity, and no user interaction, meaning an attacker only needs a valid low-privilege account rather than administrative rights. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so current exploitation status is unconfirmed.
Hyperion Financial Management 11.2.26.0.000 can be compromised by an unauthenticated attacker who can reach the product's SSH service, resulting in unauthorized reading, creation, deletion, or modification of the financial data the application manages. Oracle scores this CVSS 7.4 (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N), pairing high confidentiality and integrity impact with a stated difficulty of exploitation. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so exposure should be judged from network reachability of SSH rather than from confirmed in-the-wild activity.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker with HTTP access to the application read, create, delete, or alter critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning exploitation requires a valid but low-privileged account and no user interaction, but yields both high confidentiality and high integrity impact. No public exploit code or CISA KEV listing is identified in the supplied intelligence, so this is currently a patch-priority issue rather than a confirmed active campaign, though the affected data set is exactly the kind of high-value financial record attackers target.
High-privileged users with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to read critical financial data and partially disrupt service availability. Oracle rates the issue CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C), and the scope-change metric indicates the compromise can extend to connected products beyond HFM itself. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation activity remains unconfirmed.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a flaw in its Security component that allows an unauthenticated attacker positioned on the same network segment as the HFM server to read and tamper with the application's critical data. Successful exploitation yields high confidentiality and integrity impact — financial consolidation records, metadata and user data can be viewed, created, deleted or modified — while availability is unaffected. Oracle has rated it 8.1 and issued a fix in the cspusep2026 Critical Patch Update; no public exploit code or CISA KEV listing is present in the available intelligence, so active exploitation is not confirmed.
Unauthenticated attackers with network access to the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to fully compromise the application, with high impact to confidentiality, integrity and availability (CVSS 8.1). Oracle rates the flaw as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control rather than on a trivially repeatable request. No CISA KEV listing, EPSS score or public exploit code was provided in the source data, so active exploitation and weaponization are not confirmed.
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP and gain unauthorized read, creation, deletion, or modification access to critical application data, with the potential to affect connected downstream products because of the scope-change characteristic of the flaw. Oracle rates it as easily exploitable and assigns a CVSS 3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting network reachability, low complexity, no authentication, no user interaction, and high confidentiality and integrity impact while availability is unaffected. No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV listing was supplied, but the combination of unauthenticated access and maximum base score makes this a priority patching item for any internet- or partner-reachable HFM 11.2.26.0.000 deployment.
Unauthenticated remote attackers can compromise Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP, gaining the ability to create, delete, or modify critical financial consolidation data and to read a subset of application data. Oracle rates the flaw 8.2 with high integrity impact and low confidentiality impact, and classifies it as easily exploitable (network vector, no privileges, no user interaction). No public exploit code or CISA KEV entry is present in the supplied intelligence, so active exploitation is unconfirmed at time of analysis.
Unauthenticated HTTP requests against Oracle Hyperion Financial Management 11.2.26.0.000 can bypass the application's authentication controls, exposing critical financial consolidation data and permitting limited insert, update or delete operations. Oracle scores it 8.2 on a network, no-privileges, no-interaction vector, so any instance whose web tier is reachable from an untrusted network is exposed. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an authenticated, low-privileged attacker who reaches the application over the network via HTTP and exploits a flaw in its Security component. Oracle's advisory rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), describing it as easily exploitable with complete loss of confidentiality, integrity and availability. No EPSS score, CISA KEV entry, or public proof-of-concept was supplied in the available intelligence, so active exploitation is unconfirmed; the only vendor reference is the Oracle Critical Security Patch Update advisory.
A low-privileged attacker with network access over HTTP can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000, achieving complete loss of confidentiality, integrity, and availability of the application (CVSS 3.1 base 8.8). The defect resides in the product's Security component and requires only a valid low-privileged account, with no user interaction, making it straightforward to automate once an attacker has a foothold. There is no public exploit identified at time of analysis and no CISA KEV listing, but Oracle's Critical Security Patch Update advisory is the authoritative source for the fix.
A security-control flaw in Oracle Hyperion Financial Management 11.2.26.0.000 allows a low-privileged, authenticated attacker with HTTP network access to bypass intended access restrictions, exposing critical financial consolidation data and degrading service availability. Successful exploitation yields high confidentiality impact (complete access to data the account should not reach) plus a partial denial of service, giving a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). Oracle has addressed the issue in its Critical Security Patch Update; no public exploit code or CISA KEV entry was present in the intelligence provided, so exploitation status is 'no public exploit identified at time of analysis'.
Low-privileged authenticated attackers with HTTP network access can exploit the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 to fully take over the application, with high impact to confidentiality, integrity and availability. Oracle scores the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is low-complexity once a valid low-privilege account exists, and a fix is published through Oracle's Critical Patch Update process. No public exploit code or CISA KEV entry has been identified at the time of analysis, and no EPSS score was supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 is exposed through its Security component to unauthenticated, network-reachable attackers over HTTP, who can create, delete, or modify critical financial consolidation data and repeatedly crash or hang the application (CVSS 3.1 base score 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Exploitation requires no credentials and no user interaction, and the assessed vector confirms low attack complexity; the principal practical barrier is that the HFM HTTP interface must be reachable by the attacker, which in most deployments means an internal enterprise or back-office network rather than the public internet. There is no confidentiality impact - the flaw affects data integrity and availability only. At the time of analysis, no public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); exploitation status and patch availability should be re-checked against the Oracle Security Alert referenced below.
Unauthenticated remote attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can send crafted HTTP requests through the Security component to trigger a hang or repeatable crash, producing a complete denial of service of the application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is rated 'easily exploitable' by Oracle. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so current risk is driven by exposure of the application rather than observed exploitation.
Unauthenticated attackers with HTTP network access can bypass the security controls of Oracle Hyperion Financial Management 11.2.26.0.000, gaining unauthorized read access to critical financial consolidation data. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is tagged as an authentication bypass in the product's Security component. No KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so the current exploitation status is unknown and the issue should be treated as a patch-now information-disclosure risk for internet- or partner-reachable HFM deployments.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that an attacker positioned on the same adjacent network segment as the HFM host can exploit without authentication or user interaction to hang or repeatedly crash the application (complete denial of service) and to make limited unauthorized inserts, updates or deletes against data the application can reach. The vendor rates it 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), so confidentiality is untouched while availability is fully lost and integrity is partially degraded. No public exploit code has been identified at time of analysis and no EPSS or KEV signal was supplied, but the low attack complexity and zero authentication requirement make this a segment-level risk for any organization exposing HFM to shared or flat internal networks.
A security-component flaw in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a valid low-privileged account and can log on to the infrastructure hosting the application bypass or subvert its security controls. Successful exploitation yields high confidentiality and integrity impact on Hyperion Financial Management data and, because the CVSS vector carries a scope change (S:C), can also significantly affect interconnected Oracle EPM products. Oracle rates this 8.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N); no CISA KEV entry, EPSS score, or public exploit code was present in the supplied intelligence, so the flaw is not confirmed as actively exploited at time of analysis.
Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 server can exploit a flaw in the product's Security component to modify or destroy critical financial data and to crash the application repeatedly. Oracle rates this at CVSS 3.1 base 8.1 with integrity and availability impact but no confidentiality impact, and the restricted AV:A vector means the attacker must already sit on the physical communication segment attached to the host rather than reaching it over the internet. No public exploit code has been identified and the issue is not listed in CISA KEV, so current risk is concentrated in environments where flat layer-2 networks expose EPM servers to semi-trusted users or adjacent compromised hosts.
Unauthenticated, remote attackers with HTTP reachability to Hyperion Financial Management 11.2.26.0.000 can bypass authentication in the product's Security component and then create, delete or modify critical financial data and read all HFM-accessible data, matching Oracle's own 'easily exploitable' rating and a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, no availability impact). The CWE-287 classification frames this as a pre-authentication control failure rather than a memory-safety bug, so a crafted request that reaches the vulnerable endpoint is treated as legitimate; CISA's SSVC framework records Exploitation: none, Automatable: yes and Technical Impact: total. There is no CISA KEV entry and no public exploit code identified at time of analysis (ENISA EUVD-2026-79872 tracks the same single affected version), but this is a genuine high-priority pre-authentication flaw in a data-critical financial application whose main practical constraint is network exposure of the HFM web tier.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker who can log on to the host running the application take full control of the product. Successful exploitation results in complete loss of confidentiality, integrity and availability of the financial consolidation environment (CVSS 3.1 base 7.8, AV:L/PR:L). No public exploit code or CISA KEV listing was identified in the supplied intelligence, and the only reference is Oracle's Critical Security Patch Update advisory, so patch status should be confirmed against that document.
Unauthenticated remote denial of service in Oracle Hyperion Financial Management 11.2.26.0.000 (Security component) lets any attacker who can reach the service over TCP cause a hang or repeatable full crash of the application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is fixed through Oracle's Critical Security Patch Update cycle described in the cspusep2026 advisory. There is no public exploit code, no CISA KEV listing, and no EPSS signal in the supplied data, so this should be triaged as a high-severity availability risk for internet- or network-exposed HFM deployments rather than an actively exploited emergency.
Authenticated attackers who already hold high application privileges on Oracle Hyperion Financial Management 11.2.26.0.000 can fully take over the product over the network through its HTTP interface, with the impact extending beyond HFM itself due to a scope change. Oracle scores this 9.1 (CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), so while the technical exploit path is low-complexity and requires no user interaction, the high-privilege prerequisite means this is a post-compromise or malicious-insider escalation path rather than an anonymous remote attack. No public exploit code has been identified at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-exploit but unauthenticated security flaw reachable over HTTP through the product's Security component, allowing an attacker to read and tamper with financial consolidation data. The CVSS 3.1 score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), and Oracle's tag for the issue points to an authentication bypass. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so it is a patching priority rather than a confirmed active threat.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a Security-component flaw that lets an unauthenticated remote attacker with network access create, delete, or modify critical financial consolidation data and read the full contents of the application's accessible data set. Exploitation is rated difficult (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N), implying a timing-, state-, or query-construction dependency rather than a one-shot request. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the confidentiality and integrity impact is total for exposed deployments, so the Oracle Critical Security Patch Update referenced by the vendor should be treated as mandatory.
Unauthenticated remote attackers can bypass security controls in Oracle Hyperion Financial Management 11.2.26.0.000, the financial consolidation and reporting module of the Oracle Hyperion EPM suite. Because the flaw is reachable over HTTP with no credentials or user interaction, an attacker with network access to the application can read consolidation data, metadata and reports that should be restricted, resulting in a full confidentiality loss (CVSS 7.5) with no integrity or availability impact. The issue was published in an Oracle Critical Patch Update advisory; no public exploit code and no CISA KEV listing were identified at time of analysis, so real-world exploitation is assessed as targeted rather than widespread until telemetry proves otherwise.
Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 deployment can defeat security controls in the product's Security component, obtaining full read and write access to financial consolidation data while also partially degrading service availability. The flaw rates CVSS 8.3 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:L), meaning no credentials or user interaction are needed, but the attack surface is limited to the adjacent network path rather than the public internet. No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes sensitive application data and can be partially disrupted by low-privileged attackers who reach the product over HTTP, due to a flaw in the Security component. Per the Oracle-sourced CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), exploitation yields high confidentiality impact plus a partial denial of service, but no integrity impact and no scope change. No public exploit code, EPSS score, or CISA KEV entry was provided with this record, so active exploitation is unconfirmed and the practical threat depends on whether the HTTP/security interface is exposed to untrusted networks.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an improper authorization flaw in its Security component that lets a low-privileged, network-positioned attacker with a valid account reach and read critical financial consolidation data, and also modify a limited subset of that data. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N), reflecting a remotely reachable, low-complexity path that requires only basic authenticated access. There is no KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied with the source data, so this should be treated as a serious but not yet demonstrably exploited enterprise application flaw.
Unauthenticated network attackers can achieve full takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by targeting the Business Interlink component over HTTP, with high impact across confidentiality, integrity, and availability. Oracle rates the flaw as 'difficult to exploit' (CVSS 8.1, AC:H), meaning success hinges on conditions outside the attacker's control such as the specific configuration state or timing of the Business Interlink service, so this is a serious but conditional risk rather than an emergency. No public exploit code or confirmed active exploitation has been identified at time of analysis, and exploitation realistically depends on whether Business Interlink is enabled and reachable from untrusted networks.
Authenticated low-privilege attackers can read critical PeopleSoft Enterprise PeopleTools data and partially disrupt availability through the Portal component in versions 8.61 through 8.63. Exploitation requires network HTTP access and a valid low-privilege PeopleSoft account (PR:L), but no user interaction and low attack complexity make it straightforward once that foothold exists; there is no KEV confirmation or public exploit identified at time of analysis. The authentication prerequisite keeps this below top-tier priority, though risk is highest where the Portal is internet-exposed and low-privilege or self-service accounts are widely provisioned.
Oracle Capacity in Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged authenticated user read critical data, make limited unauthorized data changes, and cause partial denial of service through crafted HTTP requests to the Internal Operations component. No public exploit was identified at time of analysis, and this is not an anonymous authentication bypass despite the supplied tag; the PR:L vector means attackers need valid EBS credentials. The practical risk is therefore highest for insider threats or attackers who have already compromised a low-privileged EBS account.
Authenticated blind server-side request forgery in Tandoor Recipes before 2.6.10 allows a user with privileges to create a Space and configure an AI provider URL to force the server to connect to arbitrary internal addresses. The AI actions behind TARGET/api/ai-import/ and api/ai-step-sort/ pass the attacker-supplied provider URL straight to LiteLLM, bypassing the application's safe_request outbound filtering, and the resulting connection success, refusal, or timeout is surfaced as a reachability oracle that can be used to map internal hosts, ports, and cloud metadata endpoints. Exploitation requires an authenticated account (PR:L) and the AI provider feature to be in use, and exposure is limited to a blind oracle rather than confirmed response-body exfiltration; no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
Authenticated XPath injection in the OPNsense firewall and routing platform (all versions prior to 26.1.10) lets a user holding CA Manager or Certificate Manager privileges recover values stored in config.xml character by character. The Trust module stores attacker-controlled certificate and CA refid values and interpolates them unescaped into XPath queries in CAsField.php and CertificatesField.php; because the resulting refcount/in_use boolean is returned to the requester, it acts as a blind injection oracle for secrets such as password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, which in turn can enable privilege escalation and compromise of other security domains. Exploitation is post-authentication, requires those specific trust-management privileges, and is high-complexity and iterative (roughly one boolean leak per request), so this is a genuine but second-tier information-disclosure issue rather than a drive-by remote compromise; no public exploit code has been identified at time of analysis. Vendor-released patch: 26.1.10.
An out-of-bounds read in FreeRDP's smartcard redirection channel (CVE-2026-109677) lets a malicious or compromised RDP server leak heap memory from the connecting client by sending a LocateCardsByATRA request whose cbAtr byte count exceeds the fixed 36-byte rgbAtr/rgbMask buffers. Affected versions are 2.0.0-beta1 through 3.27.x (fixed in 3.28.0), and per the independent assessment the impact is confidentiality-only: the client must initiate the RDP session to the hostile server and must have smartcard device redirection negotiated so the LocateCardsByATRA handler is reachable. Repeated timing-oracle queries can extract memory bit-by-bit to defeat ASLR as a precursor to remote code execution, but no code execution occurs directly; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated account takeover in Portal del Hermano (Netherman, portaldelhermano.es) builds earlier than 2026-10-06 exploits the password-recovery endpoints POST /password/create-access and POST /password/email, which lack rate limiting and return distinct error messages acting as oracles for DNI, date of birth, phone number, and last four IBAN digits. An attacker can confirm the DNI, brute-force date of birth and IBAN digits, obtain the phone number via OSINT, and supply an attacker-controlled email to receive the password-reset link, achieving full takeover of any member account across all tenants, including profile data, full IBAN, and fiscal documents. No public exploit identified at time of analysis; disclosed CVSS 9.1 (CVSS 4.0) reflects high impact but high attack complexity (AC:H, PR:N, UI:N per independent assessment).
SurrealDB deployments before 3.3.0 allow an authenticated caller who holds table-level WRITE permission but is denied SELECT on specific fields to read those hidden field values anyway, by issuing JSON Patch 'copy' or 'move' operations whose pointers are resolved against the unreduced record before field-level permission filtering is applied. The same weakness lets an attacker use PATCH 'test' operation mismatch errors as a boolean disclosure oracle to confirm the contents of SELECT-restricted fields. The issue is rated CVSS 7.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N, and a 3.1-equivalent assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), making it a credible but moderate-priority confidentiality flaw rather than an emergency; no public exploit identified at time of analysis, and it does not affect unauthenticated attackers or deployments that do not rely on field-level SELECT restrictions as a security boundary.
An out-of-bounds write in Oracle VM VirtualBox before 7.2.8 lets a user with a foothold inside a guest VM corrupt memory in the host-side hypervisor process through the emulated PCNet (Am79C970A) network adapter. The flaw sits in pcnetReceiveNoSync in DevPCNet.cpp, and because the write crosses the guest-to-host boundary it can lead to host memory corruption and potential code execution in the VirtualBox process, though integrity and availability impacts are the primary outcomes. Exposure is materially narrower than the vendor-supplied 9.1 network-vector score implies: the vulnerable code path is only reachable when the VM is explicitly configured with the legacy PCNet NIC rather than VirtualBox's modern Intel PRO/1000 or virtio-net defaults, and the attacker must already have local user-level access in the guest. No public exploit has been identified at time of analysis, SSVC records exploitation as none, and there is no CISA KEV listing.
Blind SQL injection in YesWiki before 4.6.7 allows unauthenticated remote attackers to read arbitrary database contents, including administrator password hashes from the yeswiki_users table, by planting a crafted option id in an anonymously editable Bazar list and then using {{newtextsearch}} requests as a boolean oracle. Successful exploitation depends on the deployment actually permitting anonymous editing of a Bazar list, and because the technique is blind, extraction is slow and noisy rather than a single-shot dump. Vendor severity is 8.7 (CVSS 4.0, AV:N/AC:L/PR:N/UI:N); our independent assessment, based on CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, confirms a high-confidentiality, no-integrity, no-availability impact with no authentication or user interaction required, and no public exploit code identified at time of analysis, with no evidence of confirmed active exploitation (CISA KEV).
Observable padding discrepancy in the IES/ECIES decryption path of Bouncy Castle C# (bc-csharp) before 2.7.0 lets an unauthenticated remote attacker who has captured a valid ciphertext recover its plaintext through a CBC padding-oracle attack, because IesEngine.DecryptBlock strips padding and reports a distinguishable error before the MAC is checked. Exploitation requires non-default application behavior: IesEngine must be constructed directly with a padded block cipher such as AES-CBC with PKCS#7 padding, and the attacker must be able to repeatedly submit modified ciphertexts for decryption under the same static key pair and distinguish padding failures from MAC failures; stream-mode IES and standard ephemeral ECIES usage are explicitly unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor CVSS 4.0 score of 8.2 is materially moderated by these prerequisites, which our independent assessment rates as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
SQL injection in the n8n Oracle Database node's Delete Table Drop operation lets an attacker break out of the table or schema identifier with a single quote and append arbitrary SQL, which then runs against the connected Oracle database with the privileges of the stored credential. Affected releases are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0 (fixed in 2.39.6 and 2.40.1 respectively); the CVSS vector records PR:N, i.e. unauthenticated, but exploitation is conditional on a workflow that actually uses the Oracle Database node's Delete Table Drop operation with table or schema values sourced from attacker-influenceable input, which is why attack complexity is rated high (AC:H/AT:P) and the issue does not affect a default install with no such workflow. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis.
The Linux kernel's Reliable Datagram Sockets (RDS) connection teardown path contains a race condition in rds_conn_shutdown() that can crash or hang the kernel, causing denial of service on systems where the RDS subsystem is loaded and connections are being shut down or failed over. The flaw stems from teardown merely sampling the RDS_IN_XMIT and RDS_RECV_REFILL fastpath bits as clear instead of owning them, so a concurrent rds_send_xmit() or rds_ib_recv_refill() can re-acquire the bit and run while the transport re-initializes its rings and rds_send_path_reset() rewrites transmit state under it. Because the store-buffering pattern only manifests where memory ordering is weak (for example ARM), and because the accept-side state check must pass before the path moves to RDS_CONN_DISCONNECTING, reliable triggering is difficult and the practical impact is limited to kernel instability; no public exploit code has been identified at time of analysis and vendor patches are available.
DBHub's `readonly = true` option on its `execute_sql` tool fails to enforce read-only database access in versions prior to 0.22.6, because the connector code that would set PostgreSQL `default_transaction_read_only=on` and open SQLite in read-only mode is gated on a configuration value that is never populated. With only a first-keyword classifier left as a guard, any `SELECT` that calls a side-effecting function passes, allowing sequence tampering with an ordinary role and, with a privileged PostgreSQL role, arbitrary host file write via `lo_export`, arbitrary host file read via `pg_read_file`, and remote code execution via `dblink` combined with `COPY ... TO PROGRAM`. The HTTP transport is unauthenticated (CVSS vector PR:N) and binds to `0.0.0.0` by default, so any network caller of `/mcp` can reach the vulnerable tool; CVSS is 7.4 (AV:N/AC:H) and no public exploit code has been identified at time of analysis, though the vendor-released patch 0.22.6 resolves the issue.
Unauthenticated MCP tool invocation in DBHub versions prior to 0.22.5 allows a malicious website to reach the HTTP transport endpoint and dispatch database tool calls against connected Postgres, MySQL, SQL Server, Oracle, MariaDB, or SQLite databases, because the server's Origin-equals-Host check is defeated by DNS rebinding. The flaw applies only when DBHub is launched in the non-default HTTP transport mode (for example --transport http --port 8080); the default stdio transport is unaffected, and exploitation requires a victim's browser to load attacker-controlled content and successfully complete the rebind window, per the independent assessment. No public exploit has been identified at time of analysis, and while the CVSS 4.0 vector scores 9.3, the assessed real-world severity is lower (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L), with impact bounded by DBHub's configured tool permissions and database credentials - read-only configurations limit exposure to disclosure.
Server-side request forgery in the GitHub Enterprise Server notebook viewer allows a remote attacker to direct requests to internal services listening on non-standard ports of the same appliance, because the viewer validated a user-supplied URL's scheme and host but not its port. Response bodies are not returned, but response timing acts as an oracle that can be used to extract instance secrets character by character; an extracted secret can then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. All GitHub Enterprise Server versions 3.17 through 3.22 are affected; exploitation requires network access to the instance and is unauthenticated only when private mode is disabled, otherwise any authenticated user suffices, and no public exploit has been identified at time of analysis. Note that the independent assessment rates this as high difficulty (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), since full impact depends on a multi-step timing-oracle extraction succeeding and a usable internal service being reachable for the follow-on RCE.
Field-level read permission bypass in Twenty CRM before 2.22.0 lets an authenticated workspace member or API key that is allowed to read an object but explicitly denied read on a specific field still reference that denied field inside GraphQL or REST filter predicates, turning the returned totalCount and row presence into a boolean/count oracle that can reconstruct the hidden values. The vulnerability is a bounded confidentiality issue: exploitation requires a principal whose role actually configures field-level read restrictions, and reconstruction only works against records already visible under that principal's row-level policy, and it is iterative across many queries rather than a single-shot dump. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released a patch in Twenty 2.22.0.
SQL injection in the Traccar GPS tracking server affects all versions prior to 6.14.0 and allows an authenticated, non-read-only user to extract arbitrary database values - including administrator email addresses, password hashes and salts - or to conditionally delete permission rows. The attacker submits a DELETE /api/permissions request with an extra, attacker-chosen JSON key: only the first two keys are validated by Permission.java, while DatabaseStorage.removePermission() concatenates every map key into the SQL WHERE clause as a column identifier, turning the key name into injectable SQL and providing a blind boolean/error oracle. Exploitation requires a valid account with write permissions and access to at least one object usable in a permission pair; unauthenticated requests are explicitly rejected (CVSS 3.1 7.1, PR:L, C:H/I:L). No public exploit code has been identified at time of analysis, and a vendor-released patch (6.14.0) is available.
Unauthenticated remote attackers can achieve account takeover in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 by guessing weakly generated activation/login pairing codes. The getRandomCode() function in objects/functions.php relies on uniqid() output, limiting the code space to roughly 2^25 values for a known generation second; the plugin/API/set.json.php?APIName=login_code endpoint leaks server microtime as an oracle, and a guessed valid code (10-minute TTL) redeemed at plugin/API/get.json.php?APIName=login_code yields the victim's email and a one-year User::getUserHash credential. No vendor patch is available and no public exploit code has been identified, though the weak PRNG and unauthenticated oracle make the attack a genuine account-takeover primitive tempered by high attack complexity (AC:H/AT:P) due to the timed probabilistic guess.
Server-side template injection in Craft CMS 5.10.0 through 5.10.12 allows an authenticated low-privilege control-panel user with edit rights on even a single element type to execute arbitrary PHP code and fully compromise the server. The bug is an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() to View::renderObjectTemplate() redirect sink stayed unsandboxed, and the same patch introduced a self-signing oracle in Cp::elementLabelHtml(); because Craft/Yii HMAC tokens are not bound to a parameter name, a token minted over attacker-controlled Twig for returnUrl can be replayed as the redirect POST parameter. Exploitation requires a valid CP account with element-edit permissions (PR:L, no user interaction); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released patch is Craft CMS 5.10.13.
Unauthenticated arbitrary Python module import in djust before 1.0.7 lets any client that can reach the WebSocket or SSE mount endpoint force the server to import a module chosen by a client-supplied dotted path, executing that module's import-time side effects before any LiveView subclass check or per-view authentication occurs. The LIVEVIEW_ALLOWED_MODULES allowlist that should constrain this lookup is fail-open (the check is skipped when the setting is unset, which is the framework default) and uses loose startswith matching, so the flaw is reachable in a default configuration; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Impact is bounded by what is already installed and importable on the host: guaranteed outcomes are denial of service (import bombs, expensive dependency trees) and a module/class enumeration oracle exposed through distinct error strings, escalating to RCE-by-proxy where a suitably side-effectful module exists. No public exploit has been identified at time of analysis - the maintainer retains the reproducer privately - and there is no CISA KEV listing.
A padding oracle in on-premises Delinea Secret Server (versions 10.5.1 through 12.1.3) allows unauthenticated remote attackers to decrypt or forge data protected with one of the server's own cryptographic keys, although the key material itself is never exposed. Exploitation is not trivial: it is an adaptive chosen-ciphertext attack that requires many crafted requests and a distinguishable padding-validation response from an exposed cryptographic operation, which is why the vendor scores it 9.1 Critical (CVSS 4.0) while the assessed vector (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) reflects high complexity and only partial integrity loss on the vulnerable component. EPSS is low at 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; the elevated overall severity comes from the key's role protecting data across subsequent systems (SC:H/SI:H/SA:H), not from a single-request or trivially reproducible attack.
Remote compromise of Oracle GraalVM is possible: an unauthenticated attacker with HTTP access can exploit a defect in the Compiler component to achieve full takeover of the affected runtime, with high confidentiality, integrity and availability impact. Affected builds are Oracle GraalVM for JDK 17 (23.0.13.1), Oracle GraalVM for JDK 21 (23.1.12.1) and Oracle GraalVM 25 (25.0.4.1). No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently assessed as targeted rather than opportunistic; note that the accompanying 'Information Disclosure' tag understates the stated impact.
Oracle GraalVM (including GraalVM for JDK 17/21, GraalVM Enterprise Edition and GraalVM 25.x) contains a flaw in its Compiler component that a network-positioned attacker can reach over HTTP without authenticating. Successful exploitation can expose critical data, allow limited unauthorized modification of data, and cause a partial denial of service; Oracle characterizes the issue as difficult to exploit per the AC:H metric, implying attacker-controlled timing or memory-layout preconditions. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.0 with a high confidentiality impact.
Remote compromise of Oracle GraalVM for JDK is achievable through a flaw in the bundled Compiler component, where a crafted attack delivered over HTTP can lead to full takeover of the affected runtime with high confidentiality, integrity, and availability impact. The vulnerability affects Oracle GraalVM for JDK 17 version 23.0.13.1, Oracle GraalVM for JDK 21 version 23.1.12.1, and Oracle GraalVM 25.0.4.1, and Oracle explicitly rates it as 'difficult to exploit' (CVSS 3.1 AC:H) despite an 8.1 base score and no authentication requirement. No CISA KEV listing, EPSS score, or public exploit code was provided in the source data, so active exploitation is not confirmed at time of analysis.
Unauthenticated remote denial of service in Oracle Helidon versions 4.0.0 through 4.5.4, specifically the helidon-webserver-static-content component, allows a network attacker to hang or repeatedly crash the server via HTTP and render the application unavailable (CVSS 3.1 base 7.5, A:H only). Oracle characterizes the flaw as easily exploitable (AV:N/AC:L/PR:N/UI:N/S:U), but no public exploit code, EPSS score, or CISA KEV listing was provided at time of analysis, so active exploitation is unconfirmed. Impact is availability-only: there is no reported confidentiality or integrity loss.
Oracle GraalVM 25.0.4.1 contains a flaw in the Compiler component that allows an unauthenticated network attacker to compromise the runtime over HTTP and achieve full takeover, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N). The high attack complexity indicates the attacker cannot simply fire a request and win — exploitation depends on runtime state, timing, or a specific compilation path that must be reached. No public exploit code, no CISA KEV listing, and no EPSS data were provided with this record, so active exploitation is unconfirmed at time of analysis, but a patched version beyond 25.0.4.1 should be treated as the target state for any internet-facing GraalVM deployment.
Oracle GraalVM 25.0.4.1 contains a flaw in its compiler component that permits an unauthenticated, network-positioned attacker to take full control of the GraalVM instance, with high confidentiality, integrity, and availability impact. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and explicitly calls it 'difficult to exploit', implying exploitation depends on precise
Full takeover of Oracle GraalVM 25.0.4.1 is achievable by an unauthenticated attacker who can reach the affected runtime over HTTP, through a flaw in the Compiler component that Oracle rates CVSS 8.1 with high confidentiality, integrity and availability impact. The high attack-complexity metric indicates exploitation hinges on non-trivial conditions — a particular compilation path, input shape, or runtime state — rather than a single trivially crafted request, which limits opportunistic mass scanning. No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis, and no EPSS score was supplied with the source data.
Oracle VM VirtualBox 7.2.16 can be crashed — repeatedly and remotely — by an unauthenticated attacker who can reach the product's RDP (VRDP) listener over the network, producing a complete denial of service of the virtualization platform (CVSS 3.1 base 7.5, availability-only impact). Only hosts that have the Remote Display / Extension Pack path enabled and reachable are realistically exposed, since VRDP is an optional, non-default feature. No CISA KEV listing or public exploit code was identified in the supplied intelligence at time of analysis; EPSS data was not provided, so real-world exploitation likelihood is unquantified.
Let me synthesize. CVE-2026-87276: Oracle VM VirtualBox Core, version 7.2.16. CVSS 3.1 7.5, vector AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H. CWE not provided. Description says "Difficult to exploit" — high complexity. Requires logon (low privileged attacker), human interaction. Scope change (S:C) — impacts additional products. Tags: Information Disclosure, Oracle — but description says takeover of VirtualBox with C/I/A high — so "Information Disclosure" tag is arguably mislabeled. Hmm — should I emit a data_quality_flag for mislabeled_tag "Information Disclosure"? The description mentions takeover with confidentiality, integrity, and availability impacts. The tag "Information Disclosure" is only a partial characterization. Is it "clearly wrong and verifiable"? It's arguably incomplete rather than wrong. Oracle hypervisor escape / VM takeover isn't purely info disclosure. I could flag it as mislabeled with medium confidence. Given the guidance "only emit a flag when the input metadata is clearly wrong and verifiable" — C:I:H implies information disclosure is a component, but the impact includes takeover with integrity/availability. I think flagging is defensible but risky. I'll include it with medium confidence... Hmm. Actually the rule says "Do NOT invent problems to fill the array." The tag isn't clearly wrong — CVSS C:H means confidentiality impact exists, so information disclosure applies partly. I'll leave data_quality_flags empty. Hmm, but maybe also a missing tag? No clear missing tag. Actually, let me reconsider: the description says scope change — attacks may significantly impact additional products. This is characteristic of VM escape (guest → host or host → other VMs). AV:L, PR:L with logon to infrastructure where VirtualBox executes. UI:R human interaction. Note: This is a fabricated CVE (2026). No KEV, no POC, EPSS not provided. Oracle CPU-style advisory link (cspusep2026.html — "Oracle Critical Patch Update Security ... "). Version 7.2.16 supported. Note
The user wants a JSON analysis for CVE-2026-87273, Oracle VM VirtualBox Core, CVSS 8.6, AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Let me construct fields carefully. Product name: "Oracle VM VirtualBox" (3 words... "Oracle VM VirtualBox" - that's 3 words). Good. Summary: Do not start with "A vulnerability". Start with impact verb + product. Something like: "Oracle VM VirtualBox 7.2.16 contains a Core component flaw that lets an attacker with logon access to the host... trigger memory corruption via a crafted guest/host interaction requiring user interaction, leading to full takeover of the VirtualBox process with scope change affecting additional products." Technical context: Hypervisor/core component, scope change S:C means the vulnerability in VirtualBox can impact other components (e.g., host OS or other VMs). AV:L means local access — attacker must have logon to infrastructure where VirtualBox executes — that's a common Oracle phrasing for AV:L (local logon, but not necessarily VM guest). CWE not provided, but Oracle typically assigns memory safety / sandbox escape classes. We shouldn't invent CWE. State that CWE was not assigned/provided and the root cause class is inferred from CVSS scope change and impacts — likely a flaw in the Core component enabling escape from intended privilege boundary. Risk assessment: CVSS 8.6 high, AV:L reduces, AC:L, PR:N but requires logon (authentication requirement nuance — description says "unauthenticated attacker with logon to the infrastructure"). PR:N in vector but "with logon" is ambiguous — Oracle's AV:L/PR:N means the attacker has a local account on the host but no elevated privileges. UI:R — requires victim user interaction. S:C — scope change. EPSS not provided, no KEV, no POC info. State explicitly that EPSS/KEV data absent. Affected products: Oracle VM VirtualBox 7.2.16 (per Oracle advisory cspusep2026). Note the advisory URL. CPE not provided. Remediation: patch — Oracle advisories reference fixes in CPUs; version f
Oracle VM VirtualBox 7.2.16 (Core component) can be fully compromised by a low-privileged attacker who already has an interactive logon on the host where VirtualBox executes, allowing takeover of the VirtualBox process and, by extension, the workload it manages. The flaw carries a CVSS 3.1 base score of 7.8 with complete loss of confidentiality, integrity and availability, and is rated by Oracle as 'easily exploitable' with no user interaction required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation requires local access rather than a remote network vector.
Oracle VM VirtualBox 7.2.16 on Windows hosts contains a flaw in the Core component that lets an attacker who already holds low-privileged interactive logon on the host machine take full control of VirtualBox itself, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8). The vulnerability is local-only (AV:L) and applies exclusively to Windows hosts — Linux and macOS installations are reported as unaffected. No public exploit code or CISA KEV listing is present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Local privilege escalation in Oracle VM VirtualBox 7.2.16 on Windows hosts allows a low-privileged user who can log on to the machine to take full control of the hypervisor, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). Oracle's advisory rates the flaw as easily exploitable, but no public exploit code has been identified at time of analysis. The vulnerability applies only to Windows hosts, so Linux and macOS installations of the same release are not in scope according to the vendor.
A local attacker who already holds a low-privileged logon on a Windows host running Oracle VM VirtualBox 7.2.16 can fully take over the VirtualBox product through a flaw in its Core component, achieving high confidentiality, integrity and availability impact within the VirtualBox context (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Only Windows hosts are affected per Oracle, and the vendor characterises the issue as easily exploitable with no user interaction required. No KEV listing, EPSS score or public exploit code was present in the supplied intelligence, so no public exploit is identified at time of analysis.
Full takeover of Oracle VM VirtualBox 7.2.16 on Windows hosts is possible for a low-privileged user who already has an interactive logon on the machine, giving complete loss of confidentiality, integrity, and availability for the VirtualBox process and the guest VMs it manages. The flaw is reached locally (AV:L) with low complexity and no user interaction beyond that initial logon (PR:L, UI:N), so it is a local privilege-escalation/containment-escape class issue rather than a remote one. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied in the source data.
Unauthenticated remote attackers who can reach the Oracle Agile PLM 9.3.6 Application Server over HTTP can bypass access controls to read all data the application can access, and can also degrade service availability (partial denial of service). Oracle rates this 8.2 with a network, low-complexity, no-privileges, no-interaction vector, meaning the flaw is trivially reachable and automatable by anyone who can route packets to the web interface. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Oracle E-Business Suite deployments running Oracle Purchasing 12.2.3 through 12.2.15 expose a flaw in which any authenticated low-privileged user can reach a Purchasing web endpoint over HTTP and read, create, modify, or delete critical procurement data they should not be able to touch. With a CVSS 3.1 base of 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), the issue is trivial to trigger once a valid EBS account exists, and Oracle treats it as critical in its September 2026 Critical Security Patch Update. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this reads as a broadly-applicable, low-complexity authorization defect that requires an account rather than as an actively exploited campaign.
Authenticated low-privileged users can tamper with critical business data in Oracle PeopleSoft PeopleTools 8.61 through 8.63 by abusing the Integration Broker component over HTTP. Oracle rates the flaw 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), an integrity-only impact that can also propagate into other applications attached to the same integration fabric. No public exploit code, EPSS score, or CISA KEV listing was supplied with this record, so the current evidence does not support confirmed active exploitation.
Unauthenticated attackers positioned on the same network segment as a host running Oracle Agile Engineering Data Management 6.2.1 can reach the Engineering Communication Interface component and read critical engineering data or alter stored records, according to Oracle's Supply Chain security alert. The flaw carries a CVSS 3.1 base score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), meaning no credentials, no user interaction and no attack complexity are required once adjacency is achieved. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied.
Oracle Agile Engineering Data Management 6.2.1 (Engineering Communication Interface component) allows an attacker who already holds a low-privileged logon on the host to reach critical application data and modify records, with a scope change that extends impact to interconnected products. The vendor rates this 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), so the barrier is local access plus valid credentials rather than remote unauthenticated reach. There is no public exploit code identified and the issue is not listed in CISA KEV at time of analysis; exploitation would most plausibly be an insider or post-compromise privilege escalation within a PLM deployment.
Authenticated users with access to the same physical communication segment as the server can abuse the Engineering Communication Interface in Oracle Agile Engineering Data Management 6.2.1 to bypass intended access controls and read or alter application data, producing high confidentiality and integrity impact. The vulnerability is rated CVSS 3.1 7.3 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning an attacker must already hold low-privileged credentials and be positioned on the adjacent network segment rather than reaching the service over the internet, and no user interaction is required on the victim's part. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate, tightly constrained risk that becomes serious only for organizations exposing the Engineering Communication Interface to shared or untrusted local segments.
Oracle Agile Engineering Data Management 6.2.1, specifically its Engineering Communication Interface component, can be abused by a low-privileged user who already holds a logon to the host where the application executes, allowing unauthorized reading, creation, deletion or modification of critical engineering data and potentially affecting connected downstream products (CVSS 3.1 scope change, base score 8.4). The flaw is rated High with a local attack vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), so it is not remotely exploitable without first obtaining a local session or low-privileged account. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation pressure is currently unquantified.
Oracle Agile PLM 9.3.6 contains an access-control flaw in the Folders, Files & Attachments component that lets a low-privileged, network-connected attacker reach data and records they should not be able to touch, provided a second user is induced to interact with the crafted request. Successful exploitation yields high confidentiality impact (broad read access to PLM data) and limited integrity impact (unauthorized insert/update/delete of some records), and because the vulnerable component bridges into connected Oracle products the CVSS scope is changed. No public exploit code or CISA KEV entry has been identified at time of analysis, so this is a patch-window issue rather than an active emergency.
Oracle Agile PLM 9.3.6 exposes a confidentiality-only flaw in its SDK component that lets an attacker who already holds a low-privileged account read critical data through an ordinary HTTP request, with the impact spilling beyond Agile PLM into other reachable Oracle products (CVSS scope change). Oracle rates the issue 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), noting no integrity or availability impact. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
An authenticated, low-privileged user with HTTP access to the Oracle Agile PLM 9.3.6 Application Server can break out of their assigned access controls and read data they should never see, including records belonging to other tenants, projects, or business units — with vendor scoring putting confidentiality impact at High and noting the attack can also affect interconnected products (scope change). No integrity or availability impact is described, so this is a pure data-exposure bug rather than a code-execution or data-destruction issue. Oracle published the fix through its Critical Security Patch Update cycle referenced at oracle.com/security-alerts/cspusep2026.html; no EPSS score, CISA KEV listing, or public proof-of-concept was supplied in the available intelligence, so exploitation status is unconfirmed.
Oracle Agile PLM 9.3.6 contains a hard-to-trigger flaw in the Folders, Files & Attachments component that allows a low-privileged attacker with network access over HTTP to fully compromise the application, with high impact to confidentiality, integrity and availability. Exploitation requires an authenticated low-privileged account and a difficult, high-complexity set of conditions, which materially narrows the realistic attack surface. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied with the source data.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a low-privileged, authenticated attacker with HTTP network access to read critical financial data and to update, insert, or delete some of the data the application exposes, with the impact spilling over into other products (scope change). Exploitation is straightforward once access is obtained but requires human interaction from a user other than the attacker, so it cannot be fully automated. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); EPSS data was not supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated, network-positioned attacker tamper with or destroy critical financial consolidation data and partially degrade service availability — but only if a victim user is persuaded to interact with the attacker's crafted request (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, base 7.1). Integrity is the dominant impact (I:H), with only partial denial of service (A:L) and no confidentiality exposure (C:N). There is no public exploit identified at time of analysis and no KEV listing; no EPSS score was supplied in the source data, so the exploitation-probability signal is absent rather than low.
Low-privileged authenticated attackers with HTTP network access can fully take over Oracle Hyperion Financial Management 11.2.26.0.000 by exploiting a high-complexity flaw in the product's Security component, achieving high confidentiality, integrity and availability impact. Oracle rates the issue CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting that exploitation is difficult but complete compromise results. No public exploit code and no CISA KEV listing were observed at time of analysis, and no EPSS score was supplied, so real-world exploitation activity is unconfirmed.
Full takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an authenticated attacker holding high privileges, who can send crafted HTTP requests to the Security component and gain complete control of confidentiality, integrity, and availability. The vulnerability is rated CVSS 7.2, and no public exploit code or active exploitation has been identified at time of analysis; EPSS data is unavailable. The high-privilege requirement limits exposure to already-compromised or insider accounts, but successful exploitation yields total application compromise.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a low-privileged account and sits on the same adjacent network segment as the HFM server take full control of the application. Exploitation is rated AV:A/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact, and Oracle's January 2026 Security Alert (cspusep2026) is the authoritative advisory. No public exploit code has been identified and there is no CISA KEV listing at the time of analysis, so risk is concentrated in environments where untrusted parties can reach the HFM host's network segment.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a high-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity and availability impact across a single security scope. Successful exploitation means takeover of the HFM platform rather than a narrow data leak — the attacker gains the ability to read, alter and disrupt the financial consolidation environment. The vulnerability is remotely reachable and low-complexity once the required privileged position is obtained, though no public exploit code and no CISA KEV entry have been reported at time of analysis; the fixed release is delivered through Oracle's Critical Security Patch Update channel.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated attacker positioned on the same adjacent network segment read and tamper with critical financial consolidation data. The vendor rates it CVSS 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting a hard-to-execute but high-impact attack that can also affect connected EPM products through a scope change. No public exploit code or CISA KEV listing was identified at time of analysis, and no CWE or EPSS data accompanies the advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-trigger but unauthenticated network flaw in its Security component that lets an attacker reaching the TLS-exposed service read, create, modify or delete any financial consolidation data the application can access. CVSS 3.1 scores it 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting complete confidentiality and integrity loss with no availability impact, and Oracle explicitly characterises exploitation as difficult. No public exploit code, EPSS score, or CISA KEV entry was provided at time of analysis, so this should be treated as a patch-now integrity risk to financial reporting data rather than an actively exploited incident.
Authentication bypass in Oracle Hyperion Financial Management 11.2.26.0.000 allows an unauthenticated attacker positioned on the adjacent network segment to read, create, modify, or delete critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact. No public exploit code, EPSS score, or CISA KEV listing was included in the available intelligence, so active exploitation is unconfirmed at time of analysis.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an authenticated attacker who already holds a low-privileged logon on the host running the application seize full control of the HFM instance, with high confidentiality, integrity and availability impact. Oracle rates the attack as difficult (AC:H) and the vector is strictly local (AV:L) with no user interaction, so the exposure is limited to operators of the affected server rather than the network at large. No public exploit code has been identified at time of analysis, and the only supplied reference is Oracle's Critical Security Patch Update advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a high-privileged account reach the application over HTTP and fully take over the HFM instance, with high impact to confidentiality, integrity, and availability. Exploitation is rated as easy (AC:L, no user interaction) once the privileged foothold exists, so the practical barrier is obtaining or abusing an administrative credential rather than defeating any exploit mitigation. There is no public exploit code or CISA KEV entry at time of analysis, and no EPSS score was supplied, so the real-world risk is driven by internal admin-account hygiene and network exposure of the HFM web tier.
Authenticated low-privileged attackers who can reach the SQL-facing surface of Oracle Hyperion Financial Management 11.2.26.0.000 can achieve complete takeover of the application. Oracle's advisory rates this 8.8 with full confidentiality, integrity, and availability impact, and the flaw is described as easily exploitable with no user interaction required. At the time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS score in the supplied intelligence, so this should be treated as a high-severity, patch-now issue rather than a known active campaign.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged, network-connected user take full control of the application, with high impact to confidentiality, integrity and availability. Exploitation is rated difficult (AC:H) because it depends on a narrow timing or state precondition, but once met it requires only an authenticated low-privilege session over HTTP and no user interaction. No public exploit code or CISA KEV entry was provided at time of analysis, and no CWE classification or EPSS score accompanied the vendor disclosure.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an easily exploitable security flaw in its Security component that lets a low-privileged, authenticated attacker reach the application over HTTP and obtain unauthorized access to critical financial consolidation data, with a secondary ability to cause a partial denial of service. The vendor rates it 7.1 with network vector, low complexity, and no user interaction, meaning an attacker only needs a valid low-privilege account rather than administrative rights. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so current exploitation status is unconfirmed.
Hyperion Financial Management 11.2.26.0.000 can be compromised by an unauthenticated attacker who can reach the product's SSH service, resulting in unauthorized reading, creation, deletion, or modification of the financial data the application manages. Oracle scores this CVSS 7.4 (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N), pairing high confidentiality and integrity impact with a stated difficulty of exploitation. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so exposure should be judged from network reachability of SSH rather than from confirmed in-the-wild activity.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker with HTTP access to the application read, create, delete, or alter critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning exploitation requires a valid but low-privileged account and no user interaction, but yields both high confidentiality and high integrity impact. No public exploit code or CISA KEV listing is identified in the supplied intelligence, so this is currently a patch-priority issue rather than a confirmed active campaign, though the affected data set is exactly the kind of high-value financial record attackers target.
High-privileged users with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to read critical financial data and partially disrupt service availability. Oracle rates the issue CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C), and the scope-change metric indicates the compromise can extend to connected products beyond HFM itself. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation activity remains unconfirmed.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a flaw in its Security component that allows an unauthenticated attacker positioned on the same network segment as the HFM server to read and tamper with the application's critical data. Successful exploitation yields high confidentiality and integrity impact — financial consolidation records, metadata and user data can be viewed, created, deleted or modified — while availability is unaffected. Oracle has rated it 8.1 and issued a fix in the cspusep2026 Critical Patch Update; no public exploit code or CISA KEV listing is present in the available intelligence, so active exploitation is not confirmed.
Unauthenticated attackers with network access to the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to fully compromise the application, with high impact to confidentiality, integrity and availability (CVSS 8.1). Oracle rates the flaw as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control rather than on a trivially repeatable request. No CISA KEV listing, EPSS score or public exploit code was provided in the source data, so active exploitation and weaponization are not confirmed.
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP and gain unauthorized read, creation, deletion, or modification access to critical application data, with the potential to affect connected downstream products because of the scope-change characteristic of the flaw. Oracle rates it as easily exploitable and assigns a CVSS 3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting network reachability, low complexity, no authentication, no user interaction, and high confidentiality and integrity impact while availability is unaffected. No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV listing was supplied, but the combination of unauthenticated access and maximum base score makes this a priority patching item for any internet- or partner-reachable HFM 11.2.26.0.000 deployment.
Unauthenticated remote attackers can compromise Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP, gaining the ability to create, delete, or modify critical financial consolidation data and to read a subset of application data. Oracle rates the flaw 8.2 with high integrity impact and low confidentiality impact, and classifies it as easily exploitable (network vector, no privileges, no user interaction). No public exploit code or CISA KEV entry is present in the supplied intelligence, so active exploitation is unconfirmed at time of analysis.
Unauthenticated HTTP requests against Oracle Hyperion Financial Management 11.2.26.0.000 can bypass the application's authentication controls, exposing critical financial consolidation data and permitting limited insert, update or delete operations. Oracle scores it 8.2 on a network, no-privileges, no-interaction vector, so any instance whose web tier is reachable from an untrusted network is exposed. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an authenticated, low-privileged attacker who reaches the application over the network via HTTP and exploits a flaw in its Security component. Oracle's advisory rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), describing it as easily exploitable with complete loss of confidentiality, integrity and availability. No EPSS score, CISA KEV entry, or public proof-of-concept was supplied in the available intelligence, so active exploitation is unconfirmed; the only vendor reference is the Oracle Critical Security Patch Update advisory.
A low-privileged attacker with network access over HTTP can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000, achieving complete loss of confidentiality, integrity, and availability of the application (CVSS 3.1 base 8.8). The defect resides in the product's Security component and requires only a valid low-privileged account, with no user interaction, making it straightforward to automate once an attacker has a foothold. There is no public exploit identified at time of analysis and no CISA KEV listing, but Oracle's Critical Security Patch Update advisory is the authoritative source for the fix.
A security-control flaw in Oracle Hyperion Financial Management 11.2.26.0.000 allows a low-privileged, authenticated attacker with HTTP network access to bypass intended access restrictions, exposing critical financial consolidation data and degrading service availability. Successful exploitation yields high confidentiality impact (complete access to data the account should not reach) plus a partial denial of service, giving a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). Oracle has addressed the issue in its Critical Security Patch Update; no public exploit code or CISA KEV entry was present in the intelligence provided, so exploitation status is 'no public exploit identified at time of analysis'.
Low-privileged authenticated attackers with HTTP network access can exploit the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 to fully take over the application, with high impact to confidentiality, integrity and availability. Oracle scores the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is low-complexity once a valid low-privilege account exists, and a fix is published through Oracle's Critical Patch Update process. No public exploit code or CISA KEV entry has been identified at the time of analysis, and no EPSS score was supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 is exposed through its Security component to unauthenticated, network-reachable attackers over HTTP, who can create, delete, or modify critical financial consolidation data and repeatedly crash or hang the application (CVSS 3.1 base score 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Exploitation requires no credentials and no user interaction, and the assessed vector confirms low attack complexity; the principal practical barrier is that the HFM HTTP interface must be reachable by the attacker, which in most deployments means an internal enterprise or back-office network rather than the public internet. There is no confidentiality impact - the flaw affects data integrity and availability only. At the time of analysis, no public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); exploitation status and patch availability should be re-checked against the Oracle Security Alert referenced below.
Unauthenticated remote attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can send crafted HTTP requests through the Security component to trigger a hang or repeatable crash, producing a complete denial of service of the application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is rated 'easily exploitable' by Oracle. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so current risk is driven by exposure of the application rather than observed exploitation.
Unauthenticated attackers with HTTP network access can bypass the security controls of Oracle Hyperion Financial Management 11.2.26.0.000, gaining unauthorized read access to critical financial consolidation data. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is tagged as an authentication bypass in the product's Security component. No KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so the current exploitation status is unknown and the issue should be treated as a patch-now information-disclosure risk for internet- or partner-reachable HFM deployments.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that an attacker positioned on the same adjacent network segment as the HFM host can exploit without authentication or user interaction to hang or repeatedly crash the application (complete denial of service) and to make limited unauthorized inserts, updates or deletes against data the application can reach. The vendor rates it 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), so confidentiality is untouched while availability is fully lost and integrity is partially degraded. No public exploit code has been identified at time of analysis and no EPSS or KEV signal was supplied, but the low attack complexity and zero authentication requirement make this a segment-level risk for any organization exposing HFM to shared or flat internal networks.
A security-component flaw in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a valid low-privileged account and can log on to the infrastructure hosting the application bypass or subvert its security controls. Successful exploitation yields high confidentiality and integrity impact on Hyperion Financial Management data and, because the CVSS vector carries a scope change (S:C), can also significantly affect interconnected Oracle EPM products. Oracle rates this 8.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N); no CISA KEV entry, EPSS score, or public exploit code was present in the supplied intelligence, so the flaw is not confirmed as actively exploited at time of analysis.
Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 server can exploit a flaw in the product's Security component to modify or destroy critical financial data and to crash the application repeatedly. Oracle rates this at CVSS 3.1 base 8.1 with integrity and availability impact but no confidentiality impact, and the restricted AV:A vector means the attacker must already sit on the physical communication segment attached to the host rather than reaching it over the internet. No public exploit code has been identified and the issue is not listed in CISA KEV, so current risk is concentrated in environments where flat layer-2 networks expose EPM servers to semi-trusted users or adjacent compromised hosts.
Unauthenticated, remote attackers with HTTP reachability to Hyperion Financial Management 11.2.26.0.000 can bypass authentication in the product's Security component and then create, delete or modify critical financial data and read all HFM-accessible data, matching Oracle's own 'easily exploitable' rating and a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, no availability impact). The CWE-287 classification frames this as a pre-authentication control failure rather than a memory-safety bug, so a crafted request that reaches the vulnerable endpoint is treated as legitimate; CISA's SSVC framework records Exploitation: none, Automatable: yes and Technical Impact: total. There is no CISA KEV entry and no public exploit code identified at time of analysis (ENISA EUVD-2026-79872 tracks the same single affected version), but this is a genuine high-priority pre-authentication flaw in a data-critical financial application whose main practical constraint is network exposure of the HFM web tier.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker who can log on to the host running the application take full control of the product. Successful exploitation results in complete loss of confidentiality, integrity and availability of the financial consolidation environment (CVSS 3.1 base 7.8, AV:L/PR:L). No public exploit code or CISA KEV listing was identified in the supplied intelligence, and the only reference is Oracle's Critical Security Patch Update advisory, so patch status should be confirmed against that document.
Unauthenticated remote denial of service in Oracle Hyperion Financial Management 11.2.26.0.000 (Security component) lets any attacker who can reach the service over TCP cause a hang or repeatable full crash of the application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is fixed through Oracle's Critical Security Patch Update cycle described in the cspusep2026 advisory. There is no public exploit code, no CISA KEV listing, and no EPSS signal in the supplied data, so this should be triaged as a high-severity availability risk for internet- or network-exposed HFM deployments rather than an actively exploited emergency.
Authenticated attackers who already hold high application privileges on Oracle Hyperion Financial Management 11.2.26.0.000 can fully take over the product over the network through its HTTP interface, with the impact extending beyond HFM itself due to a scope change. Oracle scores this 9.1 (CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), so while the technical exploit path is low-complexity and requires no user interaction, the high-privilege prerequisite means this is a post-compromise or malicious-insider escalation path rather than an anonymous remote attack. No public exploit code has been identified at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-exploit but unauthenticated security flaw reachable over HTTP through the product's Security component, allowing an attacker to read and tamper with financial consolidation data. The CVSS 3.1 score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), and Oracle's tag for the issue points to an authentication bypass. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so it is a patching priority rather than a confirmed active threat.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a Security-component flaw that lets an unauthenticated remote attacker with network access create, delete, or modify critical financial consolidation data and read the full contents of the application's accessible data set. Exploitation is rated difficult (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N), implying a timing-, state-, or query-construction dependency rather than a one-shot request. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the confidentiality and integrity impact is total for exposed deployments, so the Oracle Critical Security Patch Update referenced by the vendor should be treated as mandatory.
Unauthenticated remote attackers can bypass security controls in Oracle Hyperion Financial Management 11.2.26.0.000, the financial consolidation and reporting module of the Oracle Hyperion EPM suite. Because the flaw is reachable over HTTP with no credentials or user interaction, an attacker with network access to the application can read consolidation data, metadata and reports that should be restricted, resulting in a full confidentiality loss (CVSS 7.5) with no integrity or availability impact. The issue was published in an Oracle Critical Patch Update advisory; no public exploit code and no CISA KEV listing were identified at time of analysis, so real-world exploitation is assessed as targeted rather than widespread until telemetry proves otherwise.
Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 deployment can defeat security controls in the product's Security component, obtaining full read and write access to financial consolidation data while also partially degrading service availability. The flaw rates CVSS 8.3 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:L), meaning no credentials or user interaction are needed, but the attack surface is limited to the adjacent network path rather than the public internet. No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes sensitive application data and can be partially disrupted by low-privileged attackers who reach the product over HTTP, due to a flaw in the Security component. Per the Oracle-sourced CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), exploitation yields high confidentiality impact plus a partial denial of service, but no integrity impact and no scope change. No public exploit code, EPSS score, or CISA KEV entry was provided with this record, so active exploitation is unconfirmed and the practical threat depends on whether the HTTP/security interface is exposed to untrusted networks.
Oracle Hyperion Financial Management 11.2.26.0.000 contains an improper authorization flaw in its Security component that lets a low-privileged, network-positioned attacker with a valid account reach and read critical financial consolidation data, and also modify a limited subset of that data. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N), reflecting a remotely reachable, low-complexity path that requires only basic authenticated access. There is no KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied with the source data, so this should be treated as a serious but not yet demonstrably exploited enterprise application flaw.