Oracle
Monthly
Unauthenticated remote attackers with HTTP reachability to the Oracle Forms Services listener can bypass authentication and take over Oracle Forms deployments in Oracle Fusion Middleware versions 12.2.1.19.0 and 14.1.2.0.0, specifically the Forms Services, C/S, and Charmode components. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), matching our independent assessment, meaning no credentials and no user interaction are required and the only practical precondition is network access to the Forms endpoint on default configurations. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patch candidate - particularly for any instance exposed to the internet or to untrusted internal segments - rather than a currently exploited threat.
Authentication bypass in Oracle Forms (Oracle Fusion Middleware) 12.2.1.19.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the Forms Services component - including its C/S and Charmode channels - over HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are stated prerequisites, and the impact is rated complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No CISA KEV entry or public exploit code was identified at time of analysis (EPSS was not provided in the available data); the practical limiting factor is exposure, since Forms Services is frequently shielded behind internal networks, reverse proxies, or VPNs rather than being internet-facing. Our assessment concurs with the vendor vector and classifies this as a genuine high-priority vulnerability.
Authentication bypass in Oracle Forms (component: Forms Services, C/S, Charmode) allows an unauthenticated remote attacker with HTTP access to reach data and functionality that should require a valid session, affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 8.6 with a scope-change flag, meaning a compromise of Oracle Forms can pivot to impact other products connected to or served by the Forms tier. Only high confidentiality impact is documented (no integrity or availability impact per the vector), and there is no public exploit code or CISA KEV listing at time of analysis.
Low-privileged attackers with network access to Oracle Field Service can read and modify critical data and cause a partial denial of service, exploiting a difficult-to-trigger flaw in the Internal Operations component of Oracle E-Business Suite. All supported Oracle Field Service releases from 12.2.3 through 12.2.15 are affected. No public exploit code was identified and there is no CISA KEV listing at time of analysis, but the CVSS 3.1 base score of 7.1 with high confidentiality and integrity impact makes this a candidate for prioritization once patch data is verified.
Oracle Field Service, a component of Oracle E-Business Suite (Internal Operations module), is affected by an easily exploitable flaw in versions 12.2.3 through 12.2.15 that lets a low-privileged attacker with HTTP network access read critical data, modify or delete records, and partially disrupt service availability. The vulnerability carries a CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L), indicating high confidentiality impact with limited integrity and availability effects, and it does not require user interaction. No public exploit code or CISA KEV entry was present in the supplied intelligence, and there is no confirmed evidence of active exploitation at time of analysis.
Oracle Spares Management, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by a low-privileged attacker who holds a valid account and can reach the application over HTTP. The Internal Operations component fails to properly restrict access, so a single crafted request yields high impact to confidentiality, integrity and availability of the module (CVSS 3.1 base 8.8). No public exploit code or CISA KEV entry has been identified at time of analysis, but because the flaw is trivially automatable and unauthenticated patching windows are absent, Oracle's Critical Security Patch Update should be applied without delay.
Oracle Alert, a component of Oracle E-Business Suite (12.2.3 through 12.2.15), exposes an authorization weakness in its Internal Operations component that lets a low-privileged, network-positioned attacker read and manipulate critical Alert data over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:N), reflecting high confidentiality and integrity impact with no user interaction required. No public exploit code has been identified at time of analysis, and the issue has not been confirmed as actively exploited (CISA KEV); remediation is available through Oracle's Critical Security Patch Update cycle, so patching should be prioritized for internet- or partner-facing EBS deployments.
A denial-of-service flaw in the RDBMS component of Oracle Database Server (versions 23.4.0 through 23.26.3) lets a low-privileged, authenticated user reach the database over Oracle Net and force a hang or repeatable crash of the instance. The CVSS 3.1 base score of 7.7 reflects network reachability, low attack complexity and a Scope Change because the outage can ripple into dependent applications layered on the database. No public exploit code or CISA KEV entry has been identified at time of analysis, so current risk is driven by the ease of the attack for anyone holding a valid database account rather than by observed exploitation.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 contain a flaw in the Siebel Cloud Manager component that lets a low-privileged, network-positioned user read and modify critical CRM data, with impact extending beyond the vulnerable component (scope change). The CVSS 3.1 base score is 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), reflecting high attack complexity and the need for a valid low-privileged account rather than anonymity. No public exploit code and no CISA KEV entry were identified at time of analysis, so exploitation is confirmed only as theoretically practical, not known to be active.
Low-privileged authenticated access to Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 is sufficient to fully compromise the platform through a flaw in the Siebel Cloud Manager component that is reachable over HTTP. Successful exploitation produces complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), effectively handing the attacker the application and the data it manages rather than merely leaking records. No public exploit code or CISA KEV listing is associated with CVE-2026-83086 at time of analysis, and no EPSS value was supplied, so prioritization rests on the severity of the flaw and the fact that the affected code sits in a cloud-management plane rather than an end-user feature.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 expose a flaw in the Siebel Cloud Manager component that lets an attacker already holding a low-privileged account on the platform, and positioned on the same physical/adjacent network segment as the hosting hardware, read essentially all CRM data, modify or delete some of it, and partially disrupt service. The CVSS 3.1 base score is 8.2 (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L), and the scope-change metric indicates the compromise can spill over into additional products beyond Siebel itself. No public exploit code has been identified and the issue is not listed in CISA KEV, but it should not be ignored: the confidentiality impact is total, Oracle rates exploitability as 'easily exploitable', and no EPSS score or CWE mapping was supplied to further refine the risk picture.
Oracle E-Business Suite's Marketing module (Audience component) in versions 12.2.3 through 12.2.15 exposes critical data to any attacker holding a low-privileged, authenticated account, who can reach the vulnerable component over HTTP and read information well beyond their intended authorization boundary. Oracle scores it 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — a scope-changing, confidentiality-only flaw with no integrity or availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the immediate driver is the breadth of affected enterprise deployments rather than confirmed in-the-wild activity.
Oracle Marketing, a module of Oracle E-Business Suite (Audience component), versions 12.2.3 through 12.2.15, exposes an easily exploitable flaw that lets a low-privileged, network-connected attacker read critical data and modify some records through the HTTP interface — with a scope change that can extend impact to other EBS products. Oracle rates it CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and released a fix in its Critical Security Patch Update (cspusep2026.html). No public exploit code or CISA KEV listing was present in the supplied intelligence, so exploitation is currently assessed as opportunistic rather than confirmed active.
Full takeover of the Oracle Marketing module inside Oracle E-Business Suite 12.2.3 through 12.2.15 is possible through its Audience component, but only for an attacker who already holds high (administrative) privileges in the application - an anonymous remote user cannot reach it. The flaw is network-reachable over HTTP with low attack complexity and no user interaction, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 7.2) reflects complete loss of confidentiality, integrity, and availability for the affected module. No public exploit code has been identified and there is no confirmed active exploitation (the CVE is not in CISA KEV) at time of analysis, so the realistic threat is a malicious privileged insider or an attacker who has already compromised a high-privilege EBS account.
Oracle Banking Corporate Lending versions 14.5.0.0.0 through 14.9.0.0.0 contain an unauthenticated, hard-to-trigger flaw in the Core component that lets an attacker positioned on an adjacent network segment read and modify critical lending data, with a scope change that can extend impact to connected Oracle Financial Services products. The CVSS 3.1 base score is 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact on a non-internet-exposed attack surface. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unconfirmed.
Oracle Banking Branch versions 14.5.0.0.0 through 14.9.0.0.0 can be taken over by a low-privileged attacker who already holds a valid account and can reach the application over HTTP, provided a second user is lured into interacting with crafted content in the Reports component. Oracle rates this 7.1 (AV:N/AC:H/PR:L/UI:R) with high confidentiality, integrity and availability impact, meaning full compromise of the branch platform rather than mere data leakage. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a high-severity but not yet actively exploited issue requiring patching on the Oracle Critical Security Patch Update cycle.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 contain a flaw in the Siebel Cloud Manager component that a high-privileged attacker with a logon to the underlying infrastructure can use to read and modify critical Siebel data and, through a scope change, impact additional products. The CVSS 3.1 base score is 7.9 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), so exploitation is rated easy once the attacker already holds elevated local access — this is an insider/privileged-tenant risk rather than a remotely reachable pre-auth bug. No public exploit code and no CISA KEV entry were present in the supplied intelligence, and no EPSS data was provided, so active exploitation is not confirmed.
Unauthenticated attackers who can reach the HTTP interface of Oracle Siebel CRM Cloud Applications, specifically the Siebel Cloud Manager component, can bypass authentication and gain full read access to critical CRM data plus limited ability to insert, update or delete records. The flaw affects supported releases 22.3 through 26.7 and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N), meaning it is remotely reachable, low complexity and requires no credentials or user interaction. No public exploit code or CISA KEV listing was present in the supplied intelligence, so exploitation status is unconfirmed at time of analysis.
Unauthenticated attackers with HTTP network access can read critical data from Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 by exploiting an authentication bypass in the Siebel Cloud Manager component. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact only - integrity and availability are unaffected - meaning a successful hit exposes all data reachable through the affected component. No public exploit code, EPSS score, or CISA KEV entry was supplied in the intelligence feed, so active exploitation is currently unconfirmed.
Unauthenticated attackers with network reachability to the SSH interface of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.7) can bypass authentication and gain unauthorized access to critical CRM data through the Siebel Cloud Manager component. Oracle scores the flaw 8.6 with a scope change, meaning a successful compromise can extend beyond the Siebel deployment to affect additional products. No public exploit code, EPSS score, or CISA KEV entry was provided at the time of analysis, although the low-complexity, no-credentials attack profile makes rapid weaponization plausible.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 expose the Siebel Cloud Manager component to unauthenticated attackers who can reach the host over an adjacent network segment, allowing full read and write access to critical CRM data. The flaw is rated CVSS 8.1 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:N) and is tagged as an authentication bypass, meaning no credentials or user interaction are required once an attacker is positioned on the same physical or logical communication segment as the affected service. There is no CISA KEV listing and no public exploit identified at time of analysis, but the low attack complexity and lack of authentication make the vulnerability highly automatable for anyone who already holds a foothold inside the hosting network or cloud subnet.
Authenticated low-privileged users of Oracle E-Business Suite 12.2.3 through 12.2.15 can abuse the Applications Framework 'Search Bean' component to read, create, delete, or modify critical data they should not be able to touch, giving an attacker with a basic application account broad confidentiality and integrity impact across the framework. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1), so any valid low-privilege credential is effectively a stepping stone to full data compromise. There is no public exploit code and no CISA KEV listing at time of analysis, but the Oracle quarterly patch referenced in the advisory is the only reliable fix.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (component: Machine Learning) allows a user who already holds a low-privileged operating-system account on the host running the BI system to escalate to full takeover of the BI EE platform, with complete loss of confidentiality, integrity and availability. Only versions 8.2.0.0.0 and 26.01.0.0.0 are listed as affected in Oracle's critical security patch update. Exploitation requires logon access to the infrastructure where BI EE executes, so the flaw is primarily a post-authentication, same-host escalation risk rather than an internet-facing one; no public exploit code or CISA KEV entry was identified in the supplied intelligence.
Oracle PeopleSoft Enterprise PRTL Interaction Hub 9.1 (Enterprise Portal component) permits a low-privileged user with HTTP access to the portal to read data well beyond their assigned role, exposing critical enterprise data and, because the flaw crosses a trust boundary, potentially data held in other PeopleSoft products reachable through the portal. Oracle scores it 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — confidentiality-only with a scope change — and fixed it in the 2026 Critical Patch Update. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data.
Oracle Fusion Middleware Control — the Enterprise Manager-style administration console bundled with Oracle Fusion Middleware — is vulnerable in the Framework component of versions 12.2.1.4.0 and 14.1.2.0.0, allowing a low-privileged user who can reach the console over HTTP to fully compromise it (CVSS 8.8, C:H/I:H/A:H), effectively achieving takeover of the management console itself. Because the console is the administrative nerve center for the middleware stack, a takeover grants a foothold with very broad downstream authority. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Missing authorization enforcement in the Core component of Oracle Enterprise Manager for Oracle Database 24.1 allows an authenticated, low-privileged attacker with HTTP access to read any data the management platform can reach, including data belonging to managed database targets, a confidentiality-only compromise that also changes scope (CVSS 3.1: 7.7). Oracle rates it easily exploitable because it needs only a valid low-privilege account and network reach to the console, and no public exploit identified at time of analysis. Oracle has published a fix in its Critical Security Patch Update advisory for the affected 24.1 release.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 expose the ADF Shared Components to low-privileged attackers who can reach the product over HTTP, allowing unauthorized creation, deletion, or modification of critical data and repeatable crashes that produce a complete denial of service. Rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N, integrity and availability high, confidentiality none), it is trivially automatable once any valid low-privileged account exists, but no public exploit code and no CISA KEV entry have been identified at time of analysis and no EPSS score was supplied with the source data. Because JDeveloper is a developer IDE rather than an internet-facing production service, real-world exposure is largely confined to development and build environments where the integrated ADF/WebLogic runtime is reachable on the network.
Unauthenticated remote attackers can achieve full takeover of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 by reaching the OID LDAP Server through its exposed T3 or IIOP remoting listeners, requiring no credentials and no user interaction (CVSS 3.1 base score 9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The root cause is an authentication-bypass condition (CWE-287) in the Fusion Middleware OID LDAP Server component, and successful exploitation yields complete loss of confidentiality, integrity and availability across the directory service. No CISA KEV entry and no public exploit code were identified at time of analysis, so this is not confirmed active exploitation; however, the pre-authentication, network-reachable attack path means internet-facing or broadly reachable OID/WebLogic deployments carry the highest risk, while instances confined to trusted management networks are substantially harder to reach because the only real gating factor is network access to the T3/IIOP listener.
Full takeover of Oracle WebCenter Portal 14.1.2.0.0 is achievable by an unauthenticated attacker who can reach the server from an adjacent network segment, though Oracle rates the flaw as difficult to exploit (AC:H) given its CVSS 3.1 score of 7.5 with high confidentiality, integrity and availability impact. The vulnerability sits in the Runtime Tools component of Oracle Fusion Middleware and requires the attacker to already have access to the physical communication segment attached to the host running WebCenter Portal, so internet-facing exposure alone is not sufficient. No public exploit code, EPSS score, or CISA KEV listing was provided in the source data, so active exploitation is currently unconfirmed; Oracle published the fix via its September 2026 Critical Patch Update advisory.
Takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is achievable by an attacker who already holds a high-privilege account on the portal, reaching the Runtime Tools component over HTTP. The flaw is easy to execute once that privileged foothold exists - network vector, low attack complexity, no user interaction required - and its scope-change metric means the fallout can extend into additional Oracle Fusion Middleware products beyond WebCenter Portal itself, with full confidentiality, integrity and availability impact on the portal. The CVSS 3.1 base score is 9.1, but the PR:H prerequisite is the dominant practical constraint: it excludes anonymous and unauthenticated attackers and makes insider abuse or the reuse of stolen administrator credentials the realistic exploitation path. No public exploit code and no confirmed active exploitation were identified at time of analysis, so priority rests on the high severity and low post-authentication effort rather than on observed attacks.
High-privileged attackers who already hold administrative-level LDAP credentials can fully take over the OID LDAP Server component of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 by sending crafted requests over the network. Oracle rates this 7.2 on the CVSS 3.1 scale (AV:N/AC:L/PR:H/UI:N, C/I/A all High), meaning a single low-complexity action against a reachable LDAP listener yields complete loss of confidentiality, integrity, and availability for the directory service. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the high privilege prerequisite (PR:H) substantially narrows the realistic attacker set to insiders, compromised directory administrators, or attackers who have already escalated elsewhere in the environment.
Authentication bypass in Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network access to the OID LDAP Server component to take over the directory service, with high confidentiality, integrity and availability impact (CVSS 3.1 base score 9.8). Exploitation requires no credentials, no user interaction and no non-default configuration per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); the principal practical constraint is reachability of the LDAP listener, since directory servers are normally deployed on internal or segmented networks rather than exposed to the internet. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but Oracle's 'easily exploitable' characterization and the complete compromise outcome make this a high-priority patch target for any organization running the affected versions.
Unauthenticated attackers with network access to the OID LDAP Server component can fully compromise Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0, achieving complete loss of confidentiality, integrity, and availability of the directory service (CVSS 3.1 base score 9.8). Because the flaw is an improper authentication weakness (CWE-287) reachable over LDAP with no credentials, no user interaction, and no special configuration - Oracle itself characterizes it as 'easily exploitable' - any directory deployment whose LDAP listener is exposed to an untrusted network is directly at risk of takeover. No public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing), so the practical risk is driven primarily by network exposure of the OID LDAP port.
Unauthenticated remote takeover of Oracle Internet Directory is achievable through its OID LDAP Server component in versions 12.2.1.4.0 and 14.1.2.1.0. The flaw is an improper-authentication weakness (CWE-287) rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning an attacker who can reach the LDAP listener needs no credentials, no user interaction, and no non-default configuration to gain full control of confidentiality, integrity, and availability of the directory service. Our assessment concurs with this vector and flags it as a genuine top-tier priority; no public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk hinges mainly on whether OID LDAP ports (default 389/636) are exposed beyond trusted internal or management networks.
Takeover of Oracle Internet Directory via its LDAP server component allows unauthenticated remote attackers to fully compromise the directory service. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is rated CVSS 10.0 with scope change; no public exploit or CISA KEV listing was identified in the provided data.
Takeover of Oracle Internet Directory (OID) is possible for a network-positioned attacker who holds only low-level authenticated privileges on the directory, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Exploitation requires a valid low-privilege LDAP bind credential (PR:L) but no user interaction; the scope change means a successful compromise can propagate to other Oracle Fusion Middleware products that depend on OID for identity. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 can be taken over by a low-privileged attacker with network access to the OID LDAP server, an easily exploitable condition that Oracle rates at CVSS 3.1 base 9.9. The vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates no user interaction is needed, only a low-privileged LDAP-reachable position, and that the scope change lets the impact extend beyond OID to dependent products, with full loss of confidentiality, integrity and availability on the directory itself. This is a genuine high-priority issue for organizations exposing OID LDAP services; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so the immediate driver is the large attack surface of directory services rather than confirmed active exploitation.
Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 can be fully taken over through the OID LDAP Server component by a low-privileged attacker who already holds valid directory credentials and can reach the LDAP service over the network. The flaw is trivial to trigger once access is obtained (AC:L, UI:N) and carries a scope change, meaning downstream Fusion Middleware products that depend on OID for identity and authentication services can also be impacted; CVSS 3.1 rates it 9.9 with high confidentiality, integrity and availability impact. There is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, but the authentication prerequisite is the main barrier - a low-privilege LDAP account, not an anonymous connection. Patch availability via the Oracle September 2026 Critical Patch Update makes this a high-priority, patching-window issue rather than an emergency zero-day response.
Low-privileged authenticated LDAP access to Oracle Internet Directory 12.2.1.4.0 or 14.1.2.1.0 can be escalated into full takeover of the directory service, with a scope change that lets a compromise propagate into other Oracle Fusion Middleware components and identity-dependent applications. Oracle rated this 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a remote attacker only needs a valid low-privilege directory credential or authenticated LDAP session - no user interaction - to fully compromise confidentiality, integrity, and availability of OID. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but because OID is typically a central identity store, the blast radius justifies treating this as an urgent patch item; the corresponding Oracle Critical Security Patch Update advisory is the authoritative source for affected fix versions.
Authentication bypass in the OID LDAP Server component of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker with network access to the LDAP listener to take full control of the directory service, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the flaw sits in the authentication path itself (CWE-287) and requires no credentials, no user interaction, and no special configuration, any instance whose LDAP port (typically 389, or 636 for LDAPS) is reachable from an untrusted network should be treated as exposed. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and no EPSS score was supplied, but the pre-authentication nature and the directory's role as a central identity store make this a genuine high-priority issue rather than a high-score/low-risk artifact.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain an easily exploitable flaw in the Runtime Tools component that lets any authenticated low-privileged user reach the portal over HTTP and take full control of the application (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity, and availability impact). An attacker only needs a valid low-privilege account and network reachability to the portal — no user interaction and no elevated privileges are required. Oracle has published a Critical Security Patch Update (cspusep2026) covering the issue; there is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is currently assessed as opportunistic rather than confirmed in the wild.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Runtime Tools component that allows an attacker who already controls a high-privileged account to reach past that account's authorization boundary over HTTP, gaining unauthorized read access to critical portal data and limited ability to modify it, with a documented scope change that can affect connected products. Oracle rates it CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) — network-reachable but gated behind strong privileges. No public exploit code and no CISA KEV listing were identified at time of analysis, so this reads as a post-compromise privilege escalation and data-exposure issue rather than a remotely exploitable pre-auth break.
Unauthenticated attackers with HTTP network access to Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 can read data they should not be able to reach, including critical application data, via a flaw in the Runtime Tools component. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), making it trivially automatable against any internet- or intranet-exposed instance that has not applied the referenced Oracle Critical Security Patch Update. There is no public exploit code identified at time of analysis and no CISA KEV listing, so exploitation appears opportunistic rather than confirmed in the wild.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Runtime Tools component that lets a low-privileged, network-positioned attacker read and partially modify portal data via HTTP. Oracle rates it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L), meaning exploitation is trivial once any valid low-privileged account is held, with full confidentiality impact against the portal's accessible data. No CISA KEV listing, public exploit code, or EPSS score was supplied with the source data, so active exploitation is unconfirmed at time of analysis.
Low-privileged attackers with HTTP network access can exploit the Security Framework component of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 to gain unauthorized read access to critical data and limited write/delete access, with the impact extending to additional connected products (CVSS scope change). At CVSS 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) the flaw is trivially automatable once any valid low-privileged account exists, but exploitation requires authentication, so it is not an unauthenticated internet-wide attack. Exploitation status: no public exploit identified at time of analysis; the CVE is not listed in CISA KEV and no EPSS score was supplied in the source data, so real-world activity is unconfirmed.
Authenticated but low-privileged users with HTTP access to Oracle WebCenter Portal can reach data well beyond their intended permissions through a flaw in the Runtime Tools component, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle scores it CVSS 7.7 with a scope change, meaning the portal's compromise can ripple into additional products reachable from it, with the impact limited to confidentiality. Neither CISA KEV listing nor public exploit code has been identified at time of analysis, and no EPSS probability was supplied, though the low attack complexity and absence of user interaction make weaponization plausible.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain an authentication-bypass flaw in the Runtime Tools component that can be triggered by an unauthenticated attacker over HTTP, giving access to critical portal data as well as the ability to modify or delete some of it. Oracle rates the issue CVSS 8.2 (C:H/I:L, no availability impact) with network vector, low complexity, and no privileges or user interaction required, making it trivially automatable against any internet- or intranet-reachable deployment that has not applied the referenced Critical Patch Update. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis, so exploitation is assessed as possible but not confirmed in the wild.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 ship a flaw in the Runtime Tools component that lets any authenticated low-privileged user read critical portal data and partially degrade portal availability over HTTP. Oracle rates it as easily exploitable (CVSS 7.1, AV:N/AC:L/PR:L/UI:N, C:H/A:L), so no user interaction and no administrative role is needed beyond a valid account. No public exploit code and no CISA KEV entry were identified at time of analysis, but the data-exposure impact on an enterprise portal makes it worth prompt patching.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain an easily exploited authorization flaw in the Runtime Tools component that lets a low-privileged, network-connected user reach and manipulate data well outside their intended scope, including data belonging to connected products (CVSS 8.5, scope change, high confidentiality and low integrity impact). Exploitation requires only a valid low-privilege portal account and standard HTTP access — no user interaction — making it attractive for lateral movement inside enterprise portal deployments. There is no public exploit identified at time of analysis, and no CISA KEV listing or EPSS score was supplied in the available intelligence.
Oracle XML Gateway, the E-Business Suite module that exchanges XML business documents with external trading partners, exposes critical data to any low-privileged user who can reach its HTTP endpoints in versions 12.2.3 through 12.2.15. A successful attack gives the intruder read access to data they should not see — described by Oracle as unauthorized access to critical data or complete access to all XML Gateway accessible data — and also allows a partial denial of service that degrades the module's availability. The flaw is trivially reachable (network vector, low complexity, no user interaction), and no public exploit code has been identified at the time of analysis.
Unauthenticated attackers who can reach the Composer component of Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 over HTTP can achieve complete takeover of the portal - full confidentiality, integrity and availability impact - provided they first persuade a legitimate user to perform some action, since the CVSS vector requires user interaction (UI:R). The scope-change flag (S:C) means a successful exploit can extend beyond the portal itself into integrated or dependent products, which is why the base score reaches 9.6 despite the interaction requirement. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the practical near-term risk is driven by the low attack complexity and the existence of a vendor patch through Oracle's Critical Security Patch Update process rather than by observed exploitation.
Authentication bypass in the OIM Legacy UI component of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated attacker who can reach the interface over HTTP take full control of the affected deployment, with complete loss of confidentiality, integrity, and availability (CVSS 3.1 base score 9.8). Exploitation requires no credentials or user interaction (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but it does depend on the Legacy UI being network-reachable; instances shielded by segmentation, VPN, or reverse-proxy access controls that block direct HTTP to that component are not exposed to external actors. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and affected versions are strictly limited to 12.2.1.4.0 and 14.1.2.1.0.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged, authenticated attacker with HTTP network access to read data they should not be able to reach through the Portlet Services component, scoring 7.7 on CVSS 3.1 with a scope change that can extend the impact to interconnected products. Exploitation requires only a valid low-privilege account and no user interaction, but with no CISA KEV listing, no EPSS score, and no public exploit code identified in the supplied intelligence, there is currently no public exploit identified at time of analysis. The practical priority is for organizations running the two affected WebCenter Portal releases facing untrusted or multi-tenant user populations.
Unauthenticated remote attackers can achieve full takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 via a SOAP-based attack, but exploitation requires a user to interact with a malicious element (UI:R). This critical-severity issue (CVSS 9.6) has a scope change that can impact additional products beyond WebCenter Portal. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
A low-privileged authenticated attacker with HTTP network access can fully compromise Oracle WebCenter Portal through its Composer component, achieving complete loss of confidentiality, integrity and availability plus a scope change that can extend impact to connected downstream products. Only versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and the attack requires no user interaction and has low complexity - the sole meaningful barrier is that an attacker must already hold valid credentials (PR:L), so this is not a pre-authentication flaw. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but the 9.9 CVSS score and the ease of exploitation once credentials are obtained make this a high-priority patch item.
An authenticated, low-privileged attacker with network access over HTTP can achieve full takeover of Oracle WebLogic Server through its TopLink Integration component in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Because attack complexity is low, no user interaction is required, and the scope is changed, a successful exploit can compromise the confidentiality, integrity and availability of the server and may significantly impact additional, dependent or co-located products. The reachability of the flaw is limited only by the requirement for a low-privileged authenticated foothold; no public exploit identified at time of analysis and the issue does not appear in CISA KEV, so risk is driven by the severity and broad enterprise exposure of WebLogic rather than by observed exploitation.
Unauthenticated remote attackers can achieve full takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 through an authentication bypass reachable over HTTP, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector that drives the 9.8 base score. No authentication, user interaction, or non-default configuration is required - the only practical prerequisite is network reachability of the WebCenter Sites HTTP interface, which means internet-exposed authoring or delivery instances carry the highest risk. The flaw is rated CWE-287 (Improper Authentication), and at time of analysis there was no public exploit code identified and no confirmed active exploitation (not listed in CISA KEV); Oracle has published a Critical Security Patch Update advisory covering the affected versions.
Authentication bypass in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 lets unauthenticated remote attackers reach and compromise the application purely over HTTP, with a successful exploit resulting in complete takeover of the WebCenter Sites instance (CVSS 3.1 base score 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Per the assessed vector there are no prerequisites beyond network reachability to the affected service: no credentials, no user interaction, and low attack complexity, which Oracle itself characterizes as 'easily exploitable.' No public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was supplied in the available intelligence, so the immediate driver for prioritization is the 9.8 severity combined with unauthenticated network exploitability rather than confirmed active exploitation.
An authentication bypass in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 enables unauthenticated remote attackers to take over the application via HTTP requests, rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity and availability impact. The vulnerability sits in the WebCenter Sites component of Oracle Fusion Middleware and requires no credentials, no user interaction and no non-default configuration - only network reachability of the HTTP service - making any internet-exposed instance an immediate target. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing), but the trivial attack prerequisites mean exposed deployments should be treated as urgent; instances confined to internal networks or sitting behind an authenticating reverse proxy or WAF have materially reduced reachable attack surface.
Unauthenticated attackers with HTTP network access to Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 can read data they should not be able to reach, including potentially all content and data the application can access. Oracle rates it 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), meaning no credentials, no user interaction and no special complexity are needed - only reachability to the web interface. There is no public exploit code and no CISA KEV listing at time of analysis, but the low attack requirements and high confidentiality impact make it a strong patch-now candidate for any internet-facing deployment.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw that lets a low-privileged, authenticated attacker reach the application over HTTP and gain complete control of the WebCenter Sites instance, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). Because the flaw is rated 'easily exploitable' and requires no user interaction, any organization exposing a WebCenter Sites deployment to a network where attackers can hold even a basic account should treat this as a high priority. There is no evidence of active exploitation (not in CISA KEV), and no public proof-of-concept has been identified at time of analysis; exploitation status is therefore unconfirmed, and Oracle's patch is delivered through the October-2026-cycle Critical Security Patch Update referenced by NVD.
A low-privileged authenticated attacker with HTTP network access can fully compromise Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0, resulting in complete takeover of the application with high confidentiality, integrity, and availability impact. Oracle rates this 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the attack requires no user interaction, making it remotely exploitable by anyone holding a basic account. No public exploit code, EPSS score, or CISA KEV listing was present in the provided intelligence, so active exploitation is not confirmed at time of analysis.
A low-privileged authenticated attacker with network access over HTTP can achieve complete takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0, with a CVSS 3.1 base score of 9.9 - the scope-change flag (S:C) indicates that a successful compromise can also significantly impact other co-located Fusion Middleware and WebLogic components, not just Sites itself. No user interaction is required, though valid low-privilege credentials (or a low-privilege session that can be obtained) are a prerequisite, so this is not pre-authentication. There is no public exploit identified at time of analysis and no confirmed active exploitation, but the low attack complexity and full confidentiality, integrity, and availability impact make this a high-priority item for any organization running the affected versions.
Oracle Managed File Transfer (MFT) versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the MFT Runtime Server that a low-privileged, network-positioned attacker can abuse over the WebLogic T3 or IIOP protocols to gain unauthorized integrity control over critical MFT data, read a subset of it, and repeatedly crash the runtime for a complete denial of service. Oracle rates the issue 8.3 with a C/L/I/H/A/H impact profile, meaning the biggest exposure is tampering with transfer configurations, payloads and schedules rather than wholesale data theft. No public exploit code or CISA KEV entry was identified in the supplied intelligence, but the low privilege bar (PR:L) and network attack vector make this a realistic target for any attacker who already holds a valid low-privileged domain or application account, and internal T3/IIOP listeners are the exposure path.
Oracle Managed File Transfer (MFT) Runtime Server, the file-transfer component of Oracle Fusion Middleware, allows an authenticated low-privileged attacker with network HTTP access to create, delete, modify, and read critical data handled by MFT, and the scope change (S:C) means a successful attack can escape the MFT trust boundary and impact additional Oracle products. The flaw is trivially reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, base 9.6), requiring no user interaction, but it is not pre-authentication: the attacker must already hold valid low-privileged credentials and be able to reach a MFT Runtime Server HTTP endpoint on versions 12.2.1.4.0 or 14.1.2.0.0. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (no CISA KEV listing); the 9.6 score reflects the confidentiality/integrity impact and cross-boundary scope change rather than observed exploitation, and the Oracle advisory provides no technical root-cause detail or CWE.
Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can be completely taken over by an unauthenticated attacker who has obtained a position on the same physical or adjacent network segment as the connector host. The defect lives in the Core component and is rated difficult to exploit (AC:H), yet a successful attack yields full confidentiality, integrity and availability loss with no credentials and no user interaction required. No public exploit code or CISA KEV entry has been identified at time of analysis, but the connector's role in identity provisioning and directory synchronization makes it a strategically attractive target.
Unauthenticated attackers on the same adjacent network segment can compromise the Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0), bypassing authentication to gain unauthorized read/write access to critical data, with scope change potentially affecting other Oracle products. This high-severity vulnerability (CVSS 9.3) requires local network adjacency but no credentials or user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated attackers who can reach the network segment adjacent to a host running the Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) can fully take over the connector, with confidentiality, integrity and availability all rated High and the impact explicitly extending to additional, connected products through a scope change. Exploitation is rated difficult (AC:H) and requires physical adjacency to the hardware hosting the connector, but needs no credentials and no user interaction. Oracle has published this as part of its Critical Patch Update; no public exploit code and no CISA KEV entry were identified at time of analysis.
Authentication bypass in the Core component of Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker who can reach the connector's TCP listener to read and modify the identity data it manages, with Oracle explicitly noting the attack may also significantly impact connected downstream products (scope change). Oracle scores it 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) while describing it as difficult to exploit, so the flaw is reachable without credentials but is not trivially automatable. The supplied intelligence contains no EPSS score, no CISA KEV entry, and no evidence of public exploit code at time of analysis.
Local privilege abuse in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 lets an attacker who already holds a low-privileged logon on the host running the connector seize full control of the connector, with high confidentiality, integrity and availability impact (CVSS 7.8). The flaw sits in the Core component of the Fusion Middleware connector and requires local logon, not
Unauthenticated remote attackers can read critical data from the Oracle Identity Manager Connector (Core component) in versions 12.2.1.4.0 and 14.1.2.1.0 by sending crafted HTTP requests, with no authentication or user interaction required. Oracle scores the flaw CVSS 8.6 (AV:N/AC:L/PR:N/UI:N) and classifies it as an authentication bypass with high confidentiality impact only; the scope-change metric means a successful attack can also expose downstream products that the connector reaches. No public exploit code or active exploitation is identified at time of analysis, and EPSS data was not provided, so real-world aggressiveness cannot be quantified.
Adjacent-network attackers can fully compromise Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 through a flaw in the product's Client Bundle component, achieving high confidentiality, integrity and availability impact plus a scope change onto connected products. The attack is unauthenticated but difficult to pull off, requiring high attack complexity and a separate user's interaction, which means it is only reachable from the physical/L2 communication segment attached to the hardware running the capture service. No public exploit code and no CISA KEV listing were identified at time of analysis, so the practical risk is bounded by the constrained attack vector rather than by the severity score alone.
Unauthenticated remote attackers can achieve full takeover of Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 by exploiting an authentication bypass in the Web Container component reachable over HTTP. The vulnerability carries a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), meaning no credentials, user interaction, or special preconditions are required beyond network reachability to the WebLogic HTTP listener; the Scope:Changed rating indicates successful exploitation can also compromise additional products beyond WebLogic itself. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), but the trivial attack preconditions and maximum severity rating make this a top-priority patch target for any internet-exposed deployment.
Unauthenticated remote attackers can achieve full takeover of Oracle Platform Security for Java (OPSS) versions 12.2.1.4.0 and 14.1.2.0.0, an authentication-bypass flaw (CWE-287) in the Centralized Thirdparty Jars component of Oracle Fusion Middleware that carries a maximum CVSS 3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Because the scope is marked as changed (S:C), Oracle warns that a successful compromise of OPSS - the shared security services layer that other Fusion Middleware components depend on - may significantly propagate impact to additional products, which is what elevates this above the otherwise near-identical 9.8-rated issue. No public exploit code has been identified and there is no CISA KEV listing at time of analysis, but Oracle characterises the flaw as 'easily exploitable' with no privileges or user interaction required, so the practical limiting factor is whether the affected middleware's HTTP surface is network-reachable - internet-exposed deployments are at the highest risk.
Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 expose an exploitable flaw in the SQR component that lets a low-privileged, authenticated user reach the service over HTTP and read data well beyond their intended authorization while also crashing or repeatedly hanging the application. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) the attacker needs a valid account but no elevated role and no victim interaction, and the confidentiality impact is rated total for data accessible through PeopleTools, with a matching high availability impact from the resulting denial of service. Oracle rates this 8.1 and released it in its Critical Security Patch Update cycle; no EPSS score, CISA KEV listing, or public exploit code was supplied with the source data at time of analysis.
Local, low-privileged compromise of the SQR component in Oracle PeopleSoft Enterprise PeopleTools 8.61–8.63 lets an attacker who already holds a logon to the host where PeopleTools runs take full control of the PeopleTools instance, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8). The flaw is rated easily exploitable once host access exists (AC:L, PR:L, UI:N), but the AV:L vector means it is not remotely reachable from the network without some foothold on the target infrastructure. The provided intelligence contains no EPSS score, no CISA KEV listing and no public exploit reference, so no public exploit was identified at time of analysis, though the code-execution outcome makes this a high-value post-compromise escalation path.
Low-privileged attackers with network access to the HTTP interface of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Report Distribution component to achieve full takeover of the PeopleTools application, with high impact to confidentiality, integrity, and availability. Oracle rates the issue 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), characterizing it as easily exploitable because it needs only a basic authenticated account and no user interaction. No public proof-of-concept or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can be fully taken over through a flaw in its SQR component, but only by an attacker who already holds a high-privileged logon on the host where PeopleTools runs and who can persuade another user to perform an interaction. Oracle rates it 7.2 because a successful attack is difficult to execute yet delivers complete loss of confidentiality, integrity and availability, and because the compromise can spill over into connected products (scope change). No public exploit code is identified and there is no CISA KEV entry, so the issue is a defensive hardening priority rather than an observed campaign.
Local takeover of Oracle PeopleSoft Enterprise PeopleTools (Cube Manager component) is possible for a low-privileged user who can log on to the infrastructure hosting the product, affecting versions 8.61 through 8.63. Oracle scores this 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a difficult-to-exploit but fully compromising flaw that yields high confidentiality, integrity and availability impact on the PeopleTools instance itself. No public exploit code or CISA KEV listing was identified at time of analysis, so the immediate threat is limited to actors who already hold a valid low-privileged account and interactive access to the PeopleSoft application tier.
A low-privileged, authenticated attacker with HTTP network access can exploit the Cube Manager component in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 to modify or delete critical data and to repeatedly crash or hang the application, producing a complete denial of service. Oracle rates the flaw 8.1 on the CVSS 3.1 scale with high integrity and availability impact but no confidentiality impact, and the vulnerability requires an existing valid account rather than being exploitable pre-authentication. No public proof-of-concept code or evidence of active exploitation was present in the supplied intelligence at the time of analysis.
Low-privileged network attackers can fully take over Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 by exploiting a flaw in the Client Bundle component of Oracle Fusion Middleware, with high confidentiality, integrity, and availability impact. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction, but requires an authenticated low-privileged account (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N). No CISA KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so active exploitation is not confirmed and the practical threat is currently tied to the likelihood of an attacker obtaining a valid low-privilege account.
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privilege authenticated user with HTTP access to the Client Bundle component to read all data accessible to the Capture application, and - because the vulnerable component crosses a security scope boundary - potentially reach data in adjacent Oracle Fusion Middleware products. The flaw is rated CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and is confidentiality-only, with no integrity or availability impact; exploitation requires an existing low-privilege account, so despite being tagged 'Authentication Bypass' in threat-intelligence feeds, this is not reachable by a fully unauthenticated actor. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and lack of user interaction make it attractive for post-authentication data theft against internet-exposed Capture deployments.
Unauthenticated remote attackers with HTTP access to Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware can achieve full takeover of the service by exploiting a flaw in the bundled Centralized Thirdparty Jars component. Only versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected by Oracle's advisory. The flaw carries a CVSS 3.1 base score of 8.1 with a High attack complexity rating, and no public exploit code or CISA KEV entry has been identified at time of analysis, so real-world exploitation appears opportunistic rather than widespread.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware, Client Bundle component) can be abused by a high-privileged, network-positioned attacker who convinces a second user to interact with a crafted HTTP request, yielding read, creation, modification, and deletion access to critical capture data. Because the CVSS vector carries a scope change (S:C), the impact is not confined to Enterprise Capture itself and can extend to other Fusion Middleware components reachable from the affected deployment. There is no indication of public exploit code or confirmed active exploitation, and no EPSS score was supplied with the source data, so the practical urgency rests mainly on the 8.1 severity, the scope change, and the sensitivity of captured document data.
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Client Bundle component that a low-privileged, network-positioned attacker can leverage to take over the affected application, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8). Exploitation requires only a low-privileged account and HTTP access to the product — no user interaction and no elevated privileges — making it a serious risk for internet- or broadly reachable deployments. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis, and no EPSS score was provided, so active exploitation is unconfirmed.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by an attacker who holds only a low-privileged account but can reach the product's T3 and IIOP network listeners, as described in Oracle's Critical Patch Update advisory. Because the flaw is rated AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8), a single authenticated foothold is enough to gain control of the capture application rather than just read data from it. At the time of analysis there is no CISA KEV listing and no public exploit code identified; EPSS data was not supplied, so exploitation likelihood cannot be quantified.
Low-privileged authenticated users with network access can exploit a flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 to read critical data and modify records, with the impact extending beyond the vulnerable product itself (scope change). Oracle rates the issue CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), driven by high confidentiality impact and cross-component scope change rather than by availability or integrity loss. No public exploit code and no evidence of active exploitation were identified at time of analysis, and no EPSS or CISA KEV data was supplied with the source material.
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by a low-privileged attacker who can reach the product over HTTP, with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw sits in the Client Bundle component of the Oracle Fusion Middleware product and is described by Oracle as easily exploitable, meaning no unusual conditions or user interaction are needed beyond a valid low-privilege account. No public exploit code, EPSS score or CISA KEV listing was present in the provided intelligence, so active exploitation is unconfirmed at time of analysis.
A difficult-to-exploit flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture (12.2.1.4.0 and 14.1.2.0.0) lets an attacker who already holds a low-privileged logon on the host compromise the application, reading and altering critical capture data and potentially affecting interconnected downstream products through a scope change. Exploitation is not trivial: it requires local access, a low-privileged account, high attack complexity, and a second user to perform an interaction. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; Oracle's Critical Security Patch Update advisory is the authoritative source.
Unauthenticated remote attackers with HTTP reachability to the Oracle Forms Services listener can bypass authentication and take over Oracle Forms deployments in Oracle Fusion Middleware versions 12.2.1.19.0 and 14.1.2.0.0, specifically the Forms Services, C/S, and Charmode components. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), matching our independent assessment, meaning no credentials and no user interaction are required and the only practical precondition is network access to the Forms endpoint on default configurations. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patch candidate - particularly for any instance exposed to the internet or to untrusted internal segments - rather than a currently exploited threat.
Authentication bypass in Oracle Forms (Oracle Fusion Middleware) 12.2.1.19.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the Forms Services component - including its C/S and Charmode channels - over HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are stated prerequisites, and the impact is rated complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No CISA KEV entry or public exploit code was identified at time of analysis (EPSS was not provided in the available data); the practical limiting factor is exposure, since Forms Services is frequently shielded behind internal networks, reverse proxies, or VPNs rather than being internet-facing. Our assessment concurs with the vendor vector and classifies this as a genuine high-priority vulnerability.
Authentication bypass in Oracle Forms (component: Forms Services, C/S, Charmode) allows an unauthenticated remote attacker with HTTP access to reach data and functionality that should require a valid session, affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 8.6 with a scope-change flag, meaning a compromise of Oracle Forms can pivot to impact other products connected to or served by the Forms tier. Only high confidentiality impact is documented (no integrity or availability impact per the vector), and there is no public exploit code or CISA KEV listing at time of analysis.
Low-privileged attackers with network access to Oracle Field Service can read and modify critical data and cause a partial denial of service, exploiting a difficult-to-trigger flaw in the Internal Operations component of Oracle E-Business Suite. All supported Oracle Field Service releases from 12.2.3 through 12.2.15 are affected. No public exploit code was identified and there is no CISA KEV listing at time of analysis, but the CVSS 3.1 base score of 7.1 with high confidentiality and integrity impact makes this a candidate for prioritization once patch data is verified.
Oracle Field Service, a component of Oracle E-Business Suite (Internal Operations module), is affected by an easily exploitable flaw in versions 12.2.3 through 12.2.15 that lets a low-privileged attacker with HTTP network access read critical data, modify or delete records, and partially disrupt service availability. The vulnerability carries a CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L), indicating high confidentiality impact with limited integrity and availability effects, and it does not require user interaction. No public exploit code or CISA KEV entry was present in the supplied intelligence, and there is no confirmed evidence of active exploitation at time of analysis.
Oracle Spares Management, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by a low-privileged attacker who holds a valid account and can reach the application over HTTP. The Internal Operations component fails to properly restrict access, so a single crafted request yields high impact to confidentiality, integrity and availability of the module (CVSS 3.1 base 8.8). No public exploit code or CISA KEV entry has been identified at time of analysis, but because the flaw is trivially automatable and unauthenticated patching windows are absent, Oracle's Critical Security Patch Update should be applied without delay.
Oracle Alert, a component of Oracle E-Business Suite (12.2.3 through 12.2.15), exposes an authorization weakness in its Internal Operations component that lets a low-privileged, network-positioned attacker read and manipulate critical Alert data over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:N), reflecting high confidentiality and integrity impact with no user interaction required. No public exploit code has been identified at time of analysis, and the issue has not been confirmed as actively exploited (CISA KEV); remediation is available through Oracle's Critical Security Patch Update cycle, so patching should be prioritized for internet- or partner-facing EBS deployments.
A denial-of-service flaw in the RDBMS component of Oracle Database Server (versions 23.4.0 through 23.26.3) lets a low-privileged, authenticated user reach the database over Oracle Net and force a hang or repeatable crash of the instance. The CVSS 3.1 base score of 7.7 reflects network reachability, low attack complexity and a Scope Change because the outage can ripple into dependent applications layered on the database. No public exploit code or CISA KEV entry has been identified at time of analysis, so current risk is driven by the ease of the attack for anyone holding a valid database account rather than by observed exploitation.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 contain a flaw in the Siebel Cloud Manager component that lets a low-privileged, network-positioned user read and modify critical CRM data, with impact extending beyond the vulnerable component (scope change). The CVSS 3.1 base score is 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), reflecting high attack complexity and the need for a valid low-privileged account rather than anonymity. No public exploit code and no CISA KEV entry were identified at time of analysis, so exploitation is confirmed only as theoretically practical, not known to be active.
Low-privileged authenticated access to Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 is sufficient to fully compromise the platform through a flaw in the Siebel Cloud Manager component that is reachable over HTTP. Successful exploitation produces complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), effectively handing the attacker the application and the data it manages rather than merely leaking records. No public exploit code or CISA KEV listing is associated with CVE-2026-83086 at time of analysis, and no EPSS value was supplied, so prioritization rests on the severity of the flaw and the fact that the affected code sits in a cloud-management plane rather than an end-user feature.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 expose a flaw in the Siebel Cloud Manager component that lets an attacker already holding a low-privileged account on the platform, and positioned on the same physical/adjacent network segment as the hosting hardware, read essentially all CRM data, modify or delete some of it, and partially disrupt service. The CVSS 3.1 base score is 8.2 (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L), and the scope-change metric indicates the compromise can spill over into additional products beyond Siebel itself. No public exploit code has been identified and the issue is not listed in CISA KEV, but it should not be ignored: the confidentiality impact is total, Oracle rates exploitability as 'easily exploitable', and no EPSS score or CWE mapping was supplied to further refine the risk picture.
Oracle E-Business Suite's Marketing module (Audience component) in versions 12.2.3 through 12.2.15 exposes critical data to any attacker holding a low-privileged, authenticated account, who can reach the vulnerable component over HTTP and read information well beyond their intended authorization boundary. Oracle scores it 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — a scope-changing, confidentiality-only flaw with no integrity or availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the immediate driver is the breadth of affected enterprise deployments rather than confirmed in-the-wild activity.
Oracle Marketing, a module of Oracle E-Business Suite (Audience component), versions 12.2.3 through 12.2.15, exposes an easily exploitable flaw that lets a low-privileged, network-connected attacker read critical data and modify some records through the HTTP interface — with a scope change that can extend impact to other EBS products. Oracle rates it CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and released a fix in its Critical Security Patch Update (cspusep2026.html). No public exploit code or CISA KEV listing was present in the supplied intelligence, so exploitation is currently assessed as opportunistic rather than confirmed active.
Full takeover of the Oracle Marketing module inside Oracle E-Business Suite 12.2.3 through 12.2.15 is possible through its Audience component, but only for an attacker who already holds high (administrative) privileges in the application - an anonymous remote user cannot reach it. The flaw is network-reachable over HTTP with low attack complexity and no user interaction, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 7.2) reflects complete loss of confidentiality, integrity, and availability for the affected module. No public exploit code has been identified and there is no confirmed active exploitation (the CVE is not in CISA KEV) at time of analysis, so the realistic threat is a malicious privileged insider or an attacker who has already compromised a high-privilege EBS account.
Oracle Banking Corporate Lending versions 14.5.0.0.0 through 14.9.0.0.0 contain an unauthenticated, hard-to-trigger flaw in the Core component that lets an attacker positioned on an adjacent network segment read and modify critical lending data, with a scope change that can extend impact to connected Oracle Financial Services products. The CVSS 3.1 base score is 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact on a non-internet-exposed attack surface. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unconfirmed.
Oracle Banking Branch versions 14.5.0.0.0 through 14.9.0.0.0 can be taken over by a low-privileged attacker who already holds a valid account and can reach the application over HTTP, provided a second user is lured into interacting with crafted content in the Reports component. Oracle rates this 7.1 (AV:N/AC:H/PR:L/UI:R) with high confidentiality, integrity and availability impact, meaning full compromise of the branch platform rather than mere data leakage. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a high-severity but not yet actively exploited issue requiring patching on the Oracle Critical Security Patch Update cycle.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 contain a flaw in the Siebel Cloud Manager component that a high-privileged attacker with a logon to the underlying infrastructure can use to read and modify critical Siebel data and, through a scope change, impact additional products. The CVSS 3.1 base score is 7.9 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), so exploitation is rated easy once the attacker already holds elevated local access — this is an insider/privileged-tenant risk rather than a remotely reachable pre-auth bug. No public exploit code and no CISA KEV entry were present in the supplied intelligence, and no EPSS data was provided, so active exploitation is not confirmed.
Unauthenticated attackers who can reach the HTTP interface of Oracle Siebel CRM Cloud Applications, specifically the Siebel Cloud Manager component, can bypass authentication and gain full read access to critical CRM data plus limited ability to insert, update or delete records. The flaw affects supported releases 22.3 through 26.7 and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N), meaning it is remotely reachable, low complexity and requires no credentials or user interaction. No public exploit code or CISA KEV listing was present in the supplied intelligence, so exploitation status is unconfirmed at time of analysis.
Unauthenticated attackers with HTTP network access can read critical data from Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 by exploiting an authentication bypass in the Siebel Cloud Manager component. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact only - integrity and availability are unaffected - meaning a successful hit exposes all data reachable through the affected component. No public exploit code, EPSS score, or CISA KEV entry was supplied in the intelligence feed, so active exploitation is currently unconfirmed.
Unauthenticated attackers with network reachability to the SSH interface of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.7) can bypass authentication and gain unauthorized access to critical CRM data through the Siebel Cloud Manager component. Oracle scores the flaw 8.6 with a scope change, meaning a successful compromise can extend beyond the Siebel deployment to affect additional products. No public exploit code, EPSS score, or CISA KEV entry was provided at the time of analysis, although the low-complexity, no-credentials attack profile makes rapid weaponization plausible.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 expose the Siebel Cloud Manager component to unauthenticated attackers who can reach the host over an adjacent network segment, allowing full read and write access to critical CRM data. The flaw is rated CVSS 8.1 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:N) and is tagged as an authentication bypass, meaning no credentials or user interaction are required once an attacker is positioned on the same physical or logical communication segment as the affected service. There is no CISA KEV listing and no public exploit identified at time of analysis, but the low attack complexity and lack of authentication make the vulnerability highly automatable for anyone who already holds a foothold inside the hosting network or cloud subnet.
Authenticated low-privileged users of Oracle E-Business Suite 12.2.3 through 12.2.15 can abuse the Applications Framework 'Search Bean' component to read, create, delete, or modify critical data they should not be able to touch, giving an attacker with a basic application account broad confidentiality and integrity impact across the framework. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1), so any valid low-privilege credential is effectively a stepping stone to full data compromise. There is no public exploit code and no CISA KEV listing at time of analysis, but the Oracle quarterly patch referenced in the advisory is the only reliable fix.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (component: Machine Learning) allows a user who already holds a low-privileged operating-system account on the host running the BI system to escalate to full takeover of the BI EE platform, with complete loss of confidentiality, integrity and availability. Only versions 8.2.0.0.0 and 26.01.0.0.0 are listed as affected in Oracle's critical security patch update. Exploitation requires logon access to the infrastructure where BI EE executes, so the flaw is primarily a post-authentication, same-host escalation risk rather than an internet-facing one; no public exploit code or CISA KEV entry was identified in the supplied intelligence.
Oracle PeopleSoft Enterprise PRTL Interaction Hub 9.1 (Enterprise Portal component) permits a low-privileged user with HTTP access to the portal to read data well beyond their assigned role, exposing critical enterprise data and, because the flaw crosses a trust boundary, potentially data held in other PeopleSoft products reachable through the portal. Oracle scores it 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — confidentiality-only with a scope change — and fixed it in the 2026 Critical Patch Update. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data.
Oracle Fusion Middleware Control — the Enterprise Manager-style administration console bundled with Oracle Fusion Middleware — is vulnerable in the Framework component of versions 12.2.1.4.0 and 14.1.2.0.0, allowing a low-privileged user who can reach the console over HTTP to fully compromise it (CVSS 8.8, C:H/I:H/A:H), effectively achieving takeover of the management console itself. Because the console is the administrative nerve center for the middleware stack, a takeover grants a foothold with very broad downstream authority. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Missing authorization enforcement in the Core component of Oracle Enterprise Manager for Oracle Database 24.1 allows an authenticated, low-privileged attacker with HTTP access to read any data the management platform can reach, including data belonging to managed database targets, a confidentiality-only compromise that also changes scope (CVSS 3.1: 7.7). Oracle rates it easily exploitable because it needs only a valid low-privilege account and network reach to the console, and no public exploit identified at time of analysis. Oracle has published a fix in its Critical Security Patch Update advisory for the affected 24.1 release.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 expose the ADF Shared Components to low-privileged attackers who can reach the product over HTTP, allowing unauthorized creation, deletion, or modification of critical data and repeatable crashes that produce a complete denial of service. Rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N, integrity and availability high, confidentiality none), it is trivially automatable once any valid low-privileged account exists, but no public exploit code and no CISA KEV entry have been identified at time of analysis and no EPSS score was supplied with the source data. Because JDeveloper is a developer IDE rather than an internet-facing production service, real-world exposure is largely confined to development and build environments where the integrated ADF/WebLogic runtime is reachable on the network.
Unauthenticated remote attackers can achieve full takeover of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 by reaching the OID LDAP Server through its exposed T3 or IIOP remoting listeners, requiring no credentials and no user interaction (CVSS 3.1 base score 9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The root cause is an authentication-bypass condition (CWE-287) in the Fusion Middleware OID LDAP Server component, and successful exploitation yields complete loss of confidentiality, integrity and availability across the directory service. No CISA KEV entry and no public exploit code were identified at time of analysis, so this is not confirmed active exploitation; however, the pre-authentication, network-reachable attack path means internet-facing or broadly reachable OID/WebLogic deployments carry the highest risk, while instances confined to trusted management networks are substantially harder to reach because the only real gating factor is network access to the T3/IIOP listener.
Full takeover of Oracle WebCenter Portal 14.1.2.0.0 is achievable by an unauthenticated attacker who can reach the server from an adjacent network segment, though Oracle rates the flaw as difficult to exploit (AC:H) given its CVSS 3.1 score of 7.5 with high confidentiality, integrity and availability impact. The vulnerability sits in the Runtime Tools component of Oracle Fusion Middleware and requires the attacker to already have access to the physical communication segment attached to the host running WebCenter Portal, so internet-facing exposure alone is not sufficient. No public exploit code, EPSS score, or CISA KEV listing was provided in the source data, so active exploitation is currently unconfirmed; Oracle published the fix via its September 2026 Critical Patch Update advisory.
Takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is achievable by an attacker who already holds a high-privilege account on the portal, reaching the Runtime Tools component over HTTP. The flaw is easy to execute once that privileged foothold exists - network vector, low attack complexity, no user interaction required - and its scope-change metric means the fallout can extend into additional Oracle Fusion Middleware products beyond WebCenter Portal itself, with full confidentiality, integrity and availability impact on the portal. The CVSS 3.1 base score is 9.1, but the PR:H prerequisite is the dominant practical constraint: it excludes anonymous and unauthenticated attackers and makes insider abuse or the reuse of stolen administrator credentials the realistic exploitation path. No public exploit code and no confirmed active exploitation were identified at time of analysis, so priority rests on the high severity and low post-authentication effort rather than on observed attacks.
High-privileged attackers who already hold administrative-level LDAP credentials can fully take over the OID LDAP Server component of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 by sending crafted requests over the network. Oracle rates this 7.2 on the CVSS 3.1 scale (AV:N/AC:L/PR:H/UI:N, C/I/A all High), meaning a single low-complexity action against a reachable LDAP listener yields complete loss of confidentiality, integrity, and availability for the directory service. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the high privilege prerequisite (PR:H) substantially narrows the realistic attacker set to insiders, compromised directory administrators, or attackers who have already escalated elsewhere in the environment.
Authentication bypass in Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network access to the OID LDAP Server component to take over the directory service, with high confidentiality, integrity and availability impact (CVSS 3.1 base score 9.8). Exploitation requires no credentials, no user interaction and no non-default configuration per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); the principal practical constraint is reachability of the LDAP listener, since directory servers are normally deployed on internal or segmented networks rather than exposed to the internet. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but Oracle's 'easily exploitable' characterization and the complete compromise outcome make this a high-priority patch target for any organization running the affected versions.
Unauthenticated attackers with network access to the OID LDAP Server component can fully compromise Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0, achieving complete loss of confidentiality, integrity, and availability of the directory service (CVSS 3.1 base score 9.8). Because the flaw is an improper authentication weakness (CWE-287) reachable over LDAP with no credentials, no user interaction, and no special configuration - Oracle itself characterizes it as 'easily exploitable' - any directory deployment whose LDAP listener is exposed to an untrusted network is directly at risk of takeover. No public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing), so the practical risk is driven primarily by network exposure of the OID LDAP port.
Unauthenticated remote takeover of Oracle Internet Directory is achievable through its OID LDAP Server component in versions 12.2.1.4.0 and 14.1.2.1.0. The flaw is an improper-authentication weakness (CWE-287) rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning an attacker who can reach the LDAP listener needs no credentials, no user interaction, and no non-default configuration to gain full control of confidentiality, integrity, and availability of the directory service. Our assessment concurs with this vector and flags it as a genuine top-tier priority; no public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk hinges mainly on whether OID LDAP ports (default 389/636) are exposed beyond trusted internal or management networks.
Takeover of Oracle Internet Directory via its LDAP server component allows unauthenticated remote attackers to fully compromise the directory service. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is rated CVSS 10.0 with scope change; no public exploit or CISA KEV listing was identified in the provided data.
Takeover of Oracle Internet Directory (OID) is possible for a network-positioned attacker who holds only low-level authenticated privileges on the directory, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Exploitation requires a valid low-privilege LDAP bind credential (PR:L) but no user interaction; the scope change means a successful compromise can propagate to other Oracle Fusion Middleware products that depend on OID for identity. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 can be taken over by a low-privileged attacker with network access to the OID LDAP server, an easily exploitable condition that Oracle rates at CVSS 3.1 base 9.9. The vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates no user interaction is needed, only a low-privileged LDAP-reachable position, and that the scope change lets the impact extend beyond OID to dependent products, with full loss of confidentiality, integrity and availability on the directory itself. This is a genuine high-priority issue for organizations exposing OID LDAP services; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so the immediate driver is the large attack surface of directory services rather than confirmed active exploitation.
Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 can be fully taken over through the OID LDAP Server component by a low-privileged attacker who already holds valid directory credentials and can reach the LDAP service over the network. The flaw is trivial to trigger once access is obtained (AC:L, UI:N) and carries a scope change, meaning downstream Fusion Middleware products that depend on OID for identity and authentication services can also be impacted; CVSS 3.1 rates it 9.9 with high confidentiality, integrity and availability impact. There is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, but the authentication prerequisite is the main barrier - a low-privilege LDAP account, not an anonymous connection. Patch availability via the Oracle September 2026 Critical Patch Update makes this a high-priority, patching-window issue rather than an emergency zero-day response.
Low-privileged authenticated LDAP access to Oracle Internet Directory 12.2.1.4.0 or 14.1.2.1.0 can be escalated into full takeover of the directory service, with a scope change that lets a compromise propagate into other Oracle Fusion Middleware components and identity-dependent applications. Oracle rated this 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a remote attacker only needs a valid low-privilege directory credential or authenticated LDAP session - no user interaction - to fully compromise confidentiality, integrity, and availability of OID. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but because OID is typically a central identity store, the blast radius justifies treating this as an urgent patch item; the corresponding Oracle Critical Security Patch Update advisory is the authoritative source for affected fix versions.
Authentication bypass in the OID LDAP Server component of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker with network access to the LDAP listener to take full control of the directory service, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the flaw sits in the authentication path itself (CWE-287) and requires no credentials, no user interaction, and no special configuration, any instance whose LDAP port (typically 389, or 636 for LDAPS) is reachable from an untrusted network should be treated as exposed. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and no EPSS score was supplied, but the pre-authentication nature and the directory's role as a central identity store make this a genuine high-priority issue rather than a high-score/low-risk artifact.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain an easily exploitable flaw in the Runtime Tools component that lets any authenticated low-privileged user reach the portal over HTTP and take full control of the application (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity, and availability impact). An attacker only needs a valid low-privilege account and network reachability to the portal — no user interaction and no elevated privileges are required. Oracle has published a Critical Security Patch Update (cspusep2026) covering the issue; there is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is currently assessed as opportunistic rather than confirmed in the wild.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Runtime Tools component that allows an attacker who already controls a high-privileged account to reach past that account's authorization boundary over HTTP, gaining unauthorized read access to critical portal data and limited ability to modify it, with a documented scope change that can affect connected products. Oracle rates it CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) — network-reachable but gated behind strong privileges. No public exploit code and no CISA KEV listing were identified at time of analysis, so this reads as a post-compromise privilege escalation and data-exposure issue rather than a remotely exploitable pre-auth break.
Unauthenticated attackers with HTTP network access to Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 can read data they should not be able to reach, including critical application data, via a flaw in the Runtime Tools component. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), making it trivially automatable against any internet- or intranet-exposed instance that has not applied the referenced Oracle Critical Security Patch Update. There is no public exploit code identified at time of analysis and no CISA KEV listing, so exploitation appears opportunistic rather than confirmed in the wild.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Runtime Tools component that lets a low-privileged, network-positioned attacker read and partially modify portal data via HTTP. Oracle rates it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L), meaning exploitation is trivial once any valid low-privileged account is held, with full confidentiality impact against the portal's accessible data. No CISA KEV listing, public exploit code, or EPSS score was supplied with the source data, so active exploitation is unconfirmed at time of analysis.
Low-privileged attackers with HTTP network access can exploit the Security Framework component of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 to gain unauthorized read access to critical data and limited write/delete access, with the impact extending to additional connected products (CVSS scope change). At CVSS 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) the flaw is trivially automatable once any valid low-privileged account exists, but exploitation requires authentication, so it is not an unauthenticated internet-wide attack. Exploitation status: no public exploit identified at time of analysis; the CVE is not listed in CISA KEV and no EPSS score was supplied in the source data, so real-world activity is unconfirmed.
Authenticated but low-privileged users with HTTP access to Oracle WebCenter Portal can reach data well beyond their intended permissions through a flaw in the Runtime Tools component, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle scores it CVSS 7.7 with a scope change, meaning the portal's compromise can ripple into additional products reachable from it, with the impact limited to confidentiality. Neither CISA KEV listing nor public exploit code has been identified at time of analysis, and no EPSS probability was supplied, though the low attack complexity and absence of user interaction make weaponization plausible.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain an authentication-bypass flaw in the Runtime Tools component that can be triggered by an unauthenticated attacker over HTTP, giving access to critical portal data as well as the ability to modify or delete some of it. Oracle rates the issue CVSS 8.2 (C:H/I:L, no availability impact) with network vector, low complexity, and no privileges or user interaction required, making it trivially automatable against any internet- or intranet-reachable deployment that has not applied the referenced Critical Patch Update. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis, so exploitation is assessed as possible but not confirmed in the wild.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 ship a flaw in the Runtime Tools component that lets any authenticated low-privileged user read critical portal data and partially degrade portal availability over HTTP. Oracle rates it as easily exploitable (CVSS 7.1, AV:N/AC:L/PR:L/UI:N, C:H/A:L), so no user interaction and no administrative role is needed beyond a valid account. No public exploit code and no CISA KEV entry were identified at time of analysis, but the data-exposure impact on an enterprise portal makes it worth prompt patching.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain an easily exploited authorization flaw in the Runtime Tools component that lets a low-privileged, network-connected user reach and manipulate data well outside their intended scope, including data belonging to connected products (CVSS 8.5, scope change, high confidentiality and low integrity impact). Exploitation requires only a valid low-privilege portal account and standard HTTP access — no user interaction — making it attractive for lateral movement inside enterprise portal deployments. There is no public exploit identified at time of analysis, and no CISA KEV listing or EPSS score was supplied in the available intelligence.
Oracle XML Gateway, the E-Business Suite module that exchanges XML business documents with external trading partners, exposes critical data to any low-privileged user who can reach its HTTP endpoints in versions 12.2.3 through 12.2.15. A successful attack gives the intruder read access to data they should not see — described by Oracle as unauthorized access to critical data or complete access to all XML Gateway accessible data — and also allows a partial denial of service that degrades the module's availability. The flaw is trivially reachable (network vector, low complexity, no user interaction), and no public exploit code has been identified at the time of analysis.
Unauthenticated attackers who can reach the Composer component of Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 over HTTP can achieve complete takeover of the portal - full confidentiality, integrity and availability impact - provided they first persuade a legitimate user to perform some action, since the CVSS vector requires user interaction (UI:R). The scope-change flag (S:C) means a successful exploit can extend beyond the portal itself into integrated or dependent products, which is why the base score reaches 9.6 despite the interaction requirement. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the practical near-term risk is driven by the low attack complexity and the existence of a vendor patch through Oracle's Critical Security Patch Update process rather than by observed exploitation.
Authentication bypass in the OIM Legacy UI component of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated attacker who can reach the interface over HTTP take full control of the affected deployment, with complete loss of confidentiality, integrity, and availability (CVSS 3.1 base score 9.8). Exploitation requires no credentials or user interaction (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but it does depend on the Legacy UI being network-reachable; instances shielded by segmentation, VPN, or reverse-proxy access controls that block direct HTTP to that component are not exposed to external actors. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and affected versions are strictly limited to 12.2.1.4.0 and 14.1.2.1.0.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged, authenticated attacker with HTTP network access to read data they should not be able to reach through the Portlet Services component, scoring 7.7 on CVSS 3.1 with a scope change that can extend the impact to interconnected products. Exploitation requires only a valid low-privilege account and no user interaction, but with no CISA KEV listing, no EPSS score, and no public exploit code identified in the supplied intelligence, there is currently no public exploit identified at time of analysis. The practical priority is for organizations running the two affected WebCenter Portal releases facing untrusted or multi-tenant user populations.
Unauthenticated remote attackers can achieve full takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 via a SOAP-based attack, but exploitation requires a user to interact with a malicious element (UI:R). This critical-severity issue (CVSS 9.6) has a scope change that can impact additional products beyond WebCenter Portal. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
A low-privileged authenticated attacker with HTTP network access can fully compromise Oracle WebCenter Portal through its Composer component, achieving complete loss of confidentiality, integrity and availability plus a scope change that can extend impact to connected downstream products. Only versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and the attack requires no user interaction and has low complexity - the sole meaningful barrier is that an attacker must already hold valid credentials (PR:L), so this is not a pre-authentication flaw. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but the 9.9 CVSS score and the ease of exploitation once credentials are obtained make this a high-priority patch item.
An authenticated, low-privileged attacker with network access over HTTP can achieve full takeover of Oracle WebLogic Server through its TopLink Integration component in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Because attack complexity is low, no user interaction is required, and the scope is changed, a successful exploit can compromise the confidentiality, integrity and availability of the server and may significantly impact additional, dependent or co-located products. The reachability of the flaw is limited only by the requirement for a low-privileged authenticated foothold; no public exploit identified at time of analysis and the issue does not appear in CISA KEV, so risk is driven by the severity and broad enterprise exposure of WebLogic rather than by observed exploitation.
Unauthenticated remote attackers can achieve full takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 through an authentication bypass reachable over HTTP, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector that drives the 9.8 base score. No authentication, user interaction, or non-default configuration is required - the only practical prerequisite is network reachability of the WebCenter Sites HTTP interface, which means internet-exposed authoring or delivery instances carry the highest risk. The flaw is rated CWE-287 (Improper Authentication), and at time of analysis there was no public exploit code identified and no confirmed active exploitation (not listed in CISA KEV); Oracle has published a Critical Security Patch Update advisory covering the affected versions.
Authentication bypass in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 lets unauthenticated remote attackers reach and compromise the application purely over HTTP, with a successful exploit resulting in complete takeover of the WebCenter Sites instance (CVSS 3.1 base score 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Per the assessed vector there are no prerequisites beyond network reachability to the affected service: no credentials, no user interaction, and low attack complexity, which Oracle itself characterizes as 'easily exploitable.' No public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was supplied in the available intelligence, so the immediate driver for prioritization is the 9.8 severity combined with unauthenticated network exploitability rather than confirmed active exploitation.
An authentication bypass in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 enables unauthenticated remote attackers to take over the application via HTTP requests, rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity and availability impact. The vulnerability sits in the WebCenter Sites component of Oracle Fusion Middleware and requires no credentials, no user interaction and no non-default configuration - only network reachability of the HTTP service - making any internet-exposed instance an immediate target. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing), but the trivial attack prerequisites mean exposed deployments should be treated as urgent; instances confined to internal networks or sitting behind an authenticating reverse proxy or WAF have materially reduced reachable attack surface.
Unauthenticated attackers with HTTP network access to Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 can read data they should not be able to reach, including potentially all content and data the application can access. Oracle rates it 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), meaning no credentials, no user interaction and no special complexity are needed - only reachability to the web interface. There is no public exploit code and no CISA KEV listing at time of analysis, but the low attack requirements and high confidentiality impact make it a strong patch-now candidate for any internet-facing deployment.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw that lets a low-privileged, authenticated attacker reach the application over HTTP and gain complete control of the WebCenter Sites instance, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). Because the flaw is rated 'easily exploitable' and requires no user interaction, any organization exposing a WebCenter Sites deployment to a network where attackers can hold even a basic account should treat this as a high priority. There is no evidence of active exploitation (not in CISA KEV), and no public proof-of-concept has been identified at time of analysis; exploitation status is therefore unconfirmed, and Oracle's patch is delivered through the October-2026-cycle Critical Security Patch Update referenced by NVD.
A low-privileged authenticated attacker with HTTP network access can fully compromise Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0, resulting in complete takeover of the application with high confidentiality, integrity, and availability impact. Oracle rates this 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the attack requires no user interaction, making it remotely exploitable by anyone holding a basic account. No public exploit code, EPSS score, or CISA KEV listing was present in the provided intelligence, so active exploitation is not confirmed at time of analysis.
A low-privileged authenticated attacker with network access over HTTP can achieve complete takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0, with a CVSS 3.1 base score of 9.9 - the scope-change flag (S:C) indicates that a successful compromise can also significantly impact other co-located Fusion Middleware and WebLogic components, not just Sites itself. No user interaction is required, though valid low-privilege credentials (or a low-privilege session that can be obtained) are a prerequisite, so this is not pre-authentication. There is no public exploit identified at time of analysis and no confirmed active exploitation, but the low attack complexity and full confidentiality, integrity, and availability impact make this a high-priority item for any organization running the affected versions.
Oracle Managed File Transfer (MFT) versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the MFT Runtime Server that a low-privileged, network-positioned attacker can abuse over the WebLogic T3 or IIOP protocols to gain unauthorized integrity control over critical MFT data, read a subset of it, and repeatedly crash the runtime for a complete denial of service. Oracle rates the issue 8.3 with a C/L/I/H/A/H impact profile, meaning the biggest exposure is tampering with transfer configurations, payloads and schedules rather than wholesale data theft. No public exploit code or CISA KEV entry was identified in the supplied intelligence, but the low privilege bar (PR:L) and network attack vector make this a realistic target for any attacker who already holds a valid low-privileged domain or application account, and internal T3/IIOP listeners are the exposure path.
Oracle Managed File Transfer (MFT) Runtime Server, the file-transfer component of Oracle Fusion Middleware, allows an authenticated low-privileged attacker with network HTTP access to create, delete, modify, and read critical data handled by MFT, and the scope change (S:C) means a successful attack can escape the MFT trust boundary and impact additional Oracle products. The flaw is trivially reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, base 9.6), requiring no user interaction, but it is not pre-authentication: the attacker must already hold valid low-privileged credentials and be able to reach a MFT Runtime Server HTTP endpoint on versions 12.2.1.4.0 or 14.1.2.0.0. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (no CISA KEV listing); the 9.6 score reflects the confidentiality/integrity impact and cross-boundary scope change rather than observed exploitation, and the Oracle advisory provides no technical root-cause detail or CWE.
Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can be completely taken over by an unauthenticated attacker who has obtained a position on the same physical or adjacent network segment as the connector host. The defect lives in the Core component and is rated difficult to exploit (AC:H), yet a successful attack yields full confidentiality, integrity and availability loss with no credentials and no user interaction required. No public exploit code or CISA KEV entry has been identified at time of analysis, but the connector's role in identity provisioning and directory synchronization makes it a strategically attractive target.
Unauthenticated attackers on the same adjacent network segment can compromise the Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0), bypassing authentication to gain unauthorized read/write access to critical data, with scope change potentially affecting other Oracle products. This high-severity vulnerability (CVSS 9.3) requires local network adjacency but no credentials or user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated attackers who can reach the network segment adjacent to a host running the Oracle Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) can fully take over the connector, with confidentiality, integrity and availability all rated High and the impact explicitly extending to additional, connected products through a scope change. Exploitation is rated difficult (AC:H) and requires physical adjacency to the hardware hosting the connector, but needs no credentials and no user interaction. Oracle has published this as part of its Critical Patch Update; no public exploit code and no CISA KEV entry were identified at time of analysis.
Authentication bypass in the Core component of Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker who can reach the connector's TCP listener to read and modify the identity data it manages, with Oracle explicitly noting the attack may also significantly impact connected downstream products (scope change). Oracle scores it 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) while describing it as difficult to exploit, so the flaw is reachable without credentials but is not trivially automatable. The supplied intelligence contains no EPSS score, no CISA KEV entry, and no evidence of public exploit code at time of analysis.
Local privilege abuse in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 lets an attacker who already holds a low-privileged logon on the host running the connector seize full control of the connector, with high confidentiality, integrity and availability impact (CVSS 7.8). The flaw sits in the Core component of the Fusion Middleware connector and requires local logon, not
Unauthenticated remote attackers can read critical data from the Oracle Identity Manager Connector (Core component) in versions 12.2.1.4.0 and 14.1.2.1.0 by sending crafted HTTP requests, with no authentication or user interaction required. Oracle scores the flaw CVSS 8.6 (AV:N/AC:L/PR:N/UI:N) and classifies it as an authentication bypass with high confidentiality impact only; the scope-change metric means a successful attack can also expose downstream products that the connector reaches. No public exploit code or active exploitation is identified at time of analysis, and EPSS data was not provided, so real-world aggressiveness cannot be quantified.
Adjacent-network attackers can fully compromise Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 through a flaw in the product's Client Bundle component, achieving high confidentiality, integrity and availability impact plus a scope change onto connected products. The attack is unauthenticated but difficult to pull off, requiring high attack complexity and a separate user's interaction, which means it is only reachable from the physical/L2 communication segment attached to the hardware running the capture service. No public exploit code and no CISA KEV listing were identified at time of analysis, so the practical risk is bounded by the constrained attack vector rather than by the severity score alone.
Unauthenticated remote attackers can achieve full takeover of Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 by exploiting an authentication bypass in the Web Container component reachable over HTTP. The vulnerability carries a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), meaning no credentials, user interaction, or special preconditions are required beyond network reachability to the WebLogic HTTP listener; the Scope:Changed rating indicates successful exploitation can also compromise additional products beyond WebLogic itself. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), but the trivial attack preconditions and maximum severity rating make this a top-priority patch target for any internet-exposed deployment.
Unauthenticated remote attackers can achieve full takeover of Oracle Platform Security for Java (OPSS) versions 12.2.1.4.0 and 14.1.2.0.0, an authentication-bypass flaw (CWE-287) in the Centralized Thirdparty Jars component of Oracle Fusion Middleware that carries a maximum CVSS 3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Because the scope is marked as changed (S:C), Oracle warns that a successful compromise of OPSS - the shared security services layer that other Fusion Middleware components depend on - may significantly propagate impact to additional products, which is what elevates this above the otherwise near-identical 9.8-rated issue. No public exploit code has been identified and there is no CISA KEV listing at time of analysis, but Oracle characterises the flaw as 'easily exploitable' with no privileges or user interaction required, so the practical limiting factor is whether the affected middleware's HTTP surface is network-reachable - internet-exposed deployments are at the highest risk.
Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 expose an exploitable flaw in the SQR component that lets a low-privileged, authenticated user reach the service over HTTP and read data well beyond their intended authorization while also crashing or repeatedly hanging the application. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) the attacker needs a valid account but no elevated role and no victim interaction, and the confidentiality impact is rated total for data accessible through PeopleTools, with a matching high availability impact from the resulting denial of service. Oracle rates this 8.1 and released it in its Critical Security Patch Update cycle; no EPSS score, CISA KEV listing, or public exploit code was supplied with the source data at time of analysis.
Local, low-privileged compromise of the SQR component in Oracle PeopleSoft Enterprise PeopleTools 8.61–8.63 lets an attacker who already holds a logon to the host where PeopleTools runs take full control of the PeopleTools instance, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8). The flaw is rated easily exploitable once host access exists (AC:L, PR:L, UI:N), but the AV:L vector means it is not remotely reachable from the network without some foothold on the target infrastructure. The provided intelligence contains no EPSS score, no CISA KEV listing and no public exploit reference, so no public exploit was identified at time of analysis, though the code-execution outcome makes this a high-value post-compromise escalation path.
Low-privileged attackers with network access to the HTTP interface of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Report Distribution component to achieve full takeover of the PeopleTools application, with high impact to confidentiality, integrity, and availability. Oracle rates the issue 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), characterizing it as easily exploitable because it needs only a basic authenticated account and no user interaction. No public proof-of-concept or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can be fully taken over through a flaw in its SQR component, but only by an attacker who already holds a high-privileged logon on the host where PeopleTools runs and who can persuade another user to perform an interaction. Oracle rates it 7.2 because a successful attack is difficult to execute yet delivers complete loss of confidentiality, integrity and availability, and because the compromise can spill over into connected products (scope change). No public exploit code is identified and there is no CISA KEV entry, so the issue is a defensive hardening priority rather than an observed campaign.
Local takeover of Oracle PeopleSoft Enterprise PeopleTools (Cube Manager component) is possible for a low-privileged user who can log on to the infrastructure hosting the product, affecting versions 8.61 through 8.63. Oracle scores this 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a difficult-to-exploit but fully compromising flaw that yields high confidentiality, integrity and availability impact on the PeopleTools instance itself. No public exploit code or CISA KEV listing was identified at time of analysis, so the immediate threat is limited to actors who already hold a valid low-privileged account and interactive access to the PeopleSoft application tier.
A low-privileged, authenticated attacker with HTTP network access can exploit the Cube Manager component in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 to modify or delete critical data and to repeatedly crash or hang the application, producing a complete denial of service. Oracle rates the flaw 8.1 on the CVSS 3.1 scale with high integrity and availability impact but no confidentiality impact, and the vulnerability requires an existing valid account rather than being exploitable pre-authentication. No public proof-of-concept code or evidence of active exploitation was present in the supplied intelligence at the time of analysis.
Low-privileged network attackers can fully take over Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 by exploiting a flaw in the Client Bundle component of Oracle Fusion Middleware, with high confidentiality, integrity, and availability impact. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction, but requires an authenticated low-privileged account (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N). No CISA KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so active exploitation is not confirmed and the practical threat is currently tied to the likelihood of an attacker obtaining a valid low-privilege account.
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privilege authenticated user with HTTP access to the Client Bundle component to read all data accessible to the Capture application, and - because the vulnerable component crosses a security scope boundary - potentially reach data in adjacent Oracle Fusion Middleware products. The flaw is rated CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and is confidentiality-only, with no integrity or availability impact; exploitation requires an existing low-privilege account, so despite being tagged 'Authentication Bypass' in threat-intelligence feeds, this is not reachable by a fully unauthenticated actor. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and lack of user interaction make it attractive for post-authentication data theft against internet-exposed Capture deployments.
Unauthenticated remote attackers with HTTP access to Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware can achieve full takeover of the service by exploiting a flaw in the bundled Centralized Thirdparty Jars component. Only versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected by Oracle's advisory. The flaw carries a CVSS 3.1 base score of 8.1 with a High attack complexity rating, and no public exploit code or CISA KEV entry has been identified at time of analysis, so real-world exploitation appears opportunistic rather than widespread.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware, Client Bundle component) can be abused by a high-privileged, network-positioned attacker who convinces a second user to interact with a crafted HTTP request, yielding read, creation, modification, and deletion access to critical capture data. Because the CVSS vector carries a scope change (S:C), the impact is not confined to Enterprise Capture itself and can extend to other Fusion Middleware components reachable from the affected deployment. There is no indication of public exploit code or confirmed active exploitation, and no EPSS score was supplied with the source data, so the practical urgency rests mainly on the 8.1 severity, the scope change, and the sensitivity of captured document data.
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Client Bundle component that a low-privileged, network-positioned attacker can leverage to take over the affected application, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8). Exploitation requires only a low-privileged account and HTTP access to the product — no user interaction and no elevated privileges — making it a serious risk for internet- or broadly reachable deployments. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis, and no EPSS score was provided, so active exploitation is unconfirmed.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by an attacker who holds only a low-privileged account but can reach the product's T3 and IIOP network listeners, as described in Oracle's Critical Patch Update advisory. Because the flaw is rated AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8), a single authenticated foothold is enough to gain control of the capture application rather than just read data from it. At the time of analysis there is no CISA KEV listing and no public exploit code identified; EPSS data was not supplied, so exploitation likelihood cannot be quantified.
Low-privileged authenticated users with network access can exploit a flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 to read critical data and modify records, with the impact extending beyond the vulnerable product itself (scope change). Oracle rates the issue CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), driven by high confidentiality impact and cross-component scope change rather than by availability or integrity loss. No public exploit code and no evidence of active exploitation were identified at time of analysis, and no EPSS or CISA KEV data was supplied with the source material.
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by a low-privileged attacker who can reach the product over HTTP, with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw sits in the Client Bundle component of the Oracle Fusion Middleware product and is described by Oracle as easily exploitable, meaning no unusual conditions or user interaction are needed beyond a valid low-privilege account. No public exploit code, EPSS score or CISA KEV listing was present in the provided intelligence, so active exploitation is unconfirmed at time of analysis.
A difficult-to-exploit flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture (12.2.1.4.0 and 14.1.2.0.0) lets an attacker who already holds a low-privileged logon on the host compromise the application, reading and altering critical capture data and potentially affecting interconnected downstream products through a scope change. Exploitation is not trivial: it requires local access, a low-privileged account, high attack complexity, and a second user to perform an interaction. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; Oracle's Critical Security Patch Update advisory is the authoritative source.