Oracle
Monthly
Improper authorization on the SOAP-facing Client Bundle interface of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-positioned attacker read all data the application can reach and modify a subset of it. Oracle scores it 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and the Changed scope metric indicates the blast radius can extend beyond Capture into other Fusion Middleware components. No public exploit code or CISA KEV entry was identified at time of analysis; the Oracle Critical Security Patch Update advisory (cspusep2026) is the authoritative source.
Full takeover of Oracle Access Manager is achievable by a low-privileged, network-positioned attacker who can reach the product's HTTP Authentication Engine, affecting supported versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware. The flaw requires valid low-privilege credentials (PR:L) and is rated hard to exploit (AC:H), but its scope-change rating means a successful attack against OAM can cascade into the downstream applications that rely on it for single sign-on. As of analysis, no public exploit code and no CISA KEV listing were identified, and the input contained no EPSS score, so real-world exploitation pressure is unquantified despite the 8.5 base score.
Full takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is achievable by an authenticated, high-privileged attacker who can reach the Authentication Engine over HTTP, with a CVSS 3.1 base score of 9.1 due to low attack complexity, no user interaction, and scope change that can affect integrated identity/SSO products. The PR:H prerequisite means this is realistically an insider or post-compromise privilege-abuse path rather than a remote unauthenticated break-in. No public exploit code was identified at time of analysis and no CISA KEV listing is present in the provided intelligence.
Improper authentication in the Messaging Enabler component of Oracle Fusion Middleware Service Delivery Platform allows unauthenticated remote attackers to bypass authentication and fully take over the product, compromising confidentiality, integrity, and availability. Affected releases are Oracle SDP 12.2.1.4.0 and 14.1.2.0.0, and per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires only network reachability to the Messaging Enabler HTTP interface - no credentials, privileges, or user interaction are needed. There is no public exploit code identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the main real-world limiting factor is exposure, since SDP is niche carrier/telecom middleware typically deployed inside operator networks rather than on the public internet.
Authenticated, low-privileged attackers with network HTTP access to the Messaging Enabler component of Oracle Service Delivery Platform (Fusion Middleware) can achieve full takeover of the platform, and because the CVSS profile carries a scope change (S:C) the compromise can extend to additional connected products beyond SDP itself. Oracle rates the issue CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), affecting SDP 12.2.1.4.0 and 14.1.2.0.0; exploitation needs valid low-privilege credentials but no user interaction, at low attack complexity, and no public exploit code has been identified at time of analysis. The realistic limiting factors are the credential prerequisite, the narrow deployment base of this specialized telecom service-delivery platform rather than general-purpose middleware, and the fact that the vector is well-calibrated rather than inflated.
Takeover of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler component) is achievable by a low-privileged, network-positioned attacker, carrying a CVSS 3.1 base score of 9.9 with a scope change (S:C) that lets a successful compromise spill over into other products. The affected releases are 12.2.1.4.0 and 14.1.2.0.0, and the attack path is the T3 and IIOP listeners; per the assessed vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) the attacker must already hold a valid low-privileged account on the platform, but no user interaction is required and confidentiality, integrity and availability impacts are all High. There is no public exploit code identified at time of analysis and the vulnerability is not listed in CISA KEV, so urgency rests on the near-maximum score and the exposure of internal T3/IIOP ports rather than on observed exploitation; the residual risk drops sharply where those proprietary protocols are firewalled or the platform is segmented away from untrusted users.
Authenticated remote attackers who can reach the WebLogic T3 or IIOP remoting interfaces of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler) can take over the product entirely, with the compromise extending to connected Oracle components because of the scope change. The flaw affects Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - no user interaction is required, but a valid low-privileged account is a prerequisite, so it is exploitable (not unauthenticated). No public exploit code and no confirmed active exploitation were identified at time of analysis; practical exposure is further narrowed because T3/IIOP ports are commonly firewalled or not internet-facing in hardened WebLogic deployments.
Oracle Platform Security for Java (component: Centralized Thirdparty Jars) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with logon access to the host to fully compromise the component, resulting in high confidentiality, integrity, and availability impact. The flaw is locally exploitable (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and requires only a valid low-privileged account on the infrastructure where the component executes. No public exploit code or CISA KEV listing is identified at time of analysis, and the vendor advisory is available via Oracle's Critical Patch Update.
Authentication bypass in Oracle Platform Security for Java (OPSS) 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to reach the affected SOAP interface and achieve full takeover of the OPSS instance, with high confidentiality, integrity, and availability impact (CVSS 9.8). The flaw is classified as CWE-287 improper authentication and is tagged as an authentication bypass; per the Oracle-supplied CVSS vector, no credentials or user interaction are required. No public exploit identified at time of analysis, but any reachable vulnerable OPSS service should be treated as high risk because the practical limiting factor is network exposure of the SOAP endpoint rather than a configuration prerequisite.
Unauthenticated remote attackers who can reach an exposed LDAP authentication path in Oracle Platform Security for Java (OPSS) can achieve complete takeover of the OPSS security framework in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, with full confidentiality, integrity and availability impact (CWE-287 improper authentication, CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the Centralized Thirdparty Jars component and requires no credentials and no user interaction, but exploitability in practice depends on network reachability: OPSS is an embedded security framework consumed by Fusion Middleware applications rather than a standalone internet-facing service, so internal-only or firewalled OPSS/LDAP endpoints substantially reduce exposure. No public exploit code and no CISA KEV entry were identified at time of analysis, and no real-world exploitation telemetry is available, so the 9.8 severity reflects assessed potential rather than observed attack activity.
Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 contain a flaw in the Business Interlink component that lets a low-privileged, network-reachable user read or fully compromise PeopleTools-accessible data and modify or delete some of it, with impact extending to other connected products (scope change). Oracle rates it CVSS 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and notes it is 'easily exploitable' by a low-privileged attacker over HTTP. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Local privilege escalation in the Installation component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets any low-privileged user who can log on to the host running Siebel CRM Deployment to fully compromise that deployment. Because the flaw is reachable through the local attack surface with no user interaction and yields complete loss of confidentiality, integrity and availability, an attacker with an otherwise ordinary account can effectively take over the CRM environment. No public exploit code or in-the-wild exploitation is identified in the available intelligence at time of analysis, and the vendor advisory from Oracle is the sole reference for affected versions and fixes.
In Oracle Siebel CRM's Marketing module (Siebel Apps - Marketing), supported versions 17.0 through 26.7 expose a network-reachable HTTP flaw that a high-privileged user can leverage to seize full control of the Marketing application, impacting confidentiality, integrity and availability alike (CVSS 3.1 base 7.2). The issue is rated easily exploitable (AC:L) but is gated behind privileged credentials (PR:H), and no user interaction is needed once such access exists. No CISA KEV entry, public exploit code, or EPSS score was supplied with the source data, so active exploitation is unconfirmed at time of analysis.
Unauthenticated remote attackers who can reach the Portlet Services component of Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 over HTTP can bypass authentication and achieve full takeover of the application, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 9.8; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is an improper-authentication defect (CWE-287) and, per the assessed vector, needs no credentials, no user interaction and no non-default configuration, so any instance with Portlet Services reachable is directly at risk. No public exploit code has been identified at time of analysis, and the principal real-world limiter is exposure, since WebCenter Portal is typically deployed behind an enterprise perimeter rather than openly on the internet; this is nevertheless a high-priority issue on every available static signal, with thin real-world exploitation evidence.
Authenticated attackers holding a low-privileged account can exploit the Authentication Engine in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 over HTTPS to read, create, delete, or modify all data reachable through the service, with CVSS 3.1 base score 9.6 reflecting high confidentiality and integrity impact and a scope change. The flaw is remotely reachable with low attack complexity and no user interaction, but it is not pre-authentication: a valid low-tier credential on the OAM instance is required, which is the main limiting factor on exploitation. No public exploit identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); Oracle's Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source.
Unauthenticated takeover of Oracle JDeveloper is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0 through the ADF Faces component, which is exposed over HTTP; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms remote, unauthenticated, low-complexity exploitation requiring no user interaction, with full confidentiality, integrity, and availability impact. The root cause is an authentication bypass (CWE-287) rather than a memory-safety or injection flaw, meaning an attacker who can reach the ADF Faces web tier may be able to act with privileges they were never granted. No public exploit code has been identified at time of analysis and the vulnerability is not listed as confirmed actively exploited (CISA KEV); the main real-world constraint is network exposure, since JDeveloper is primarily a Java development IDE and its ADF Faces web tier is not normally published to untrusted networks.
Unauthenticated denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a remote attacker to hang or repeatedly crash the application server through crafted HTTP traffic, with no confidentiality or integrity impact. The vulnerability sits in the Ren (Real-time Event Notification) Server component, is rated CVSS 7.5 with an all-network, no-privileges, no-user-interaction vector, and is fixed in Oracle's Critical Security Patch Update (cspusep2026). No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged authenticated attacker with HTTP network access to fully compromise the Portal through the Composer component, resulting in complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8). Exploitation requires only a valid low-privilege account and a reachable HTTP interface - no user interaction and no elevated privileges - making the barrier to abuse relatively low for anyone with any Portal login. There is no public exploit identified, no CISA KEV listing and no EPSS score provided at time of analysis, so this is currently a patch-now vulnerability rather than a confirmed actively exploited one.
Unauthenticated network attackers can achieve full takeover of Oracle Access Manager via a difficult-to-trigger flaw in the Authentication Engine component of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this CVSS 3.1 8.1 with High confidentiality, integrity, and availability impact from a network vector requiring no privileges or user interaction, meaning the identity service itself — and the applications it protects — can be fully compromised. No public exploit code and no CISA KEV entry were identified at time of analysis; the AC:H rating indicates the attack requires precise timing or a specific non-default state rather than a trivial repeatable request.
Unauthenticated network attackers can obtain complete confidentiality and integrity compromise of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 through the Portlet Services component, but only after a legitimate portal user is induced to interact with attacker-influenced content - exploitation is gated by the UI:R prerequisite, which requires human interaction from a person other than the attacker. With a CVSS 3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), the flaw allows unauthorized creation, deletion or modification of, and complete read access to, data accessible through the portal, and because scope changes (S:C) the impact can extend to additional integrated products. There is no KEV listing and no public exploit identified at time of analysis, so this is a high-severity issue whose real-world risk is bounded by the need to socially engineer a valid portal user and by the narrow set of affected releases.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can be taken over by an unauthenticated remote attacker who reaches the Composer component over HTTP, because the component fails to properly enforce authentication (CWE-287). Oracle scores this 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or non-default configuration are required - only network reachability of the WebCenter Portal HTTP interface, with the stated outcome being full takeover of the portal. At time of analysis there is no public exploit identified and the issue is not listed as confirmed actively exploited (CISA KEV), so the practical risk is driven by exposure: internet-facing instances are directly at risk, while deployments confined to internal networks or sitting behind an authenticating reverse proxy or WAF are materially harder to reach. This is assessed as well-calibrated maximum severity rather than an inflated score, since an unauthenticated authentication bypass leading to product takeover justifies the C:H/I:H/A:H impact set.
Improper handling of chart content in the Charting component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a low-privileged, authenticated attacker read and modify critical application data after inducing another user to interact with a crafted HTTP request. Successful exploitation yields high confidentiality and integrity impact across all data the victim's session can reach, though availability is unaffected. No public exploit code has been identified at time of analysis, no CISA KEV listing is present in the supplied data, and no EPSS score was provided.
Unauthenticated attackers with HTTP network access to Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can achieve full takeover of the application via the Business Interlink component, as reflected in a CVSS 3.1 base score of 8.1 with high confidentiality, integrity, and availability impact. The flaw is rated high attack complexity (AC:H) and Oracle describes it as 'difficult to exploit,' meaning a successful attack depends on conditions outside the attacker's direct control - such as a specific Business Interlink configuration, integration state, or timing - which keeps this a serious but not top-tier-urgent issue. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; internet-facing PeopleSoft portals exposing the Business Interlink feature are the highest-risk deployments.
Authentication bypass in the Portlet Services component of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 lets unauthenticated remote attackers reach protected functionality over HTTP and, on success, take over the application (CVSS 3.1 base score 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw maps to CWE-287 (Improper Authentication), meaning the portal's Portlet Services layer fails to properly validate that a request originates from an authenticated session. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; the main exposure driver is network reachability of the WebCenter Portal HTTP interface, so internet-facing or broadly reachable instances behind no WAF or proxy carry the highest risk. Oracle addresses it in the September 2026 Critical Patch Update.
Improper authentication in the Portlet Services component of Oracle WebCenter Portal allows unauthenticated attackers with HTTP network access to the portal to bypass authentication and gain read and write access to all portal-accessible data, including the ability to create, delete, or modify critical content. Only versions 12.2.1.4.0 and 14.1.2.0.0 of this Oracle Fusion Middleware product are affected, and the flaw is rated high severity (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) with no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exploitation risk is driven primarily by internet or broad-network exposure of an unpatched portal.
Unauthenticated attackers with network access to the HTTP interface of Oracle WebCenter Portal's Portlet Services component can exploit a hard-to-trigger flaw to fully compromise the application, per Oracle's Critical Security Patch Update (cspusep2026). Impact spans confidentiality, integrity and availability (CVSS 8.1), with the stated outcome being complete takeover of WebCenter Portal. Only supported versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected; no public exploit code or CISA KEV entry was present in the supplied intelligence, and the high attack-complexity metric (AC:H) suggests exploitation requires specific, non-trivial conditions rather than a simple one-shot request.
Authentication bypass in the Oracle Access Manager (Fusion Middleware) Authentication Engine lets unauthenticated remote attackers with HTTP network access compromise OAM instances running 12.2.1.4.0 or 14.1.2.1.0, resulting in complete takeover of the affected service with high confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation of the CWE-287 flaw effectively grants the attacker the identity and authorization context the Authentication Engine is supposed to enforce, so any downstream application trusting OAM for single sign-on or access decisions is exposed to the same session. At the time of analysis there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified; the practical exposure is driven almost entirely by the network reachability of the OAM Authentication Engine endpoint, with internet-facing gateways the highest priority to patch.
Authenticated low-privileged users can fully take over Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 by sending crafted HTTP requests to the Portlet Services component. Oracle's Critical Security Patch Update rates this 8.8 with complete loss of confidentiality, integrity and availability of the portal, meaning an attacker with any valid low-privilege account can seize control of the application. No public exploit code or CISA KEV listing is known at time of analysis, so exploitation is currently limited to attackers who already hold credentials, though the low attack complexity makes weaponization plausible once a proof of concept surfaces.
Low-privileged, authenticated attackers with network access over HTTP to the Composer component of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can fully take over the affected deployment, with the scope change (S:C) meaning impact can extend into other connected Oracle Fusion Middleware products. Oracle rates the flaw as 'easily exploitable' with low attack complexity, no user interaction, and complete loss of confidentiality, integrity, and availability (CVSS 3.1 base score 9.9, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The practical bar is a valid low-privilege account, which makes this a genuine high-priority issue for internet- or broadly reachable WebCenter Portal instances rather than a theoretical high-score artifact; no public proof-of-concept and no CISA KEV entry were identified at time of analysis, so there is no public exploit identified at time of analysis.
Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the affected Access Manager instance, rated CVSS 3.1 9.8 (CWE-287, Improper Authentication) with high confidentiality, integrity, and availability impact. The vulnerable component is the Authentication Engine itself, and the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms no credentials, privileges, or user interaction are required, so any HTTP-reachable OAM deployment of those two versions is a candidate entry point. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); however, Oracle characterizes it as easily exploitable, so internet-exposed OAM instances should be treated as urgent.
Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 contain a flaw in the Authentication Engine component that lets a high-privileged attacker with HTTP network access fully compromise the product, taking over the authentication service itself (CVSS 3.1 base 9.1, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Because the score includes a scope change (S:C), a successful attack can spill over and significantly impact other products and applications that rely on OAM for authentication, turning a single privileged compromise into a broader identity-layer incident. The critical caveat is the PR:H prerequisite: this is a post-authentication, privileged-abuse issue rather than an unauthenticated remote takeover, so realistic exposure centers on malicious insiders, stolen or misused administrative credentials, or chained privilege-escalation paths. No public exploit code or confirmed exploitation was identified at time of analysis, and the weaknesses make it a priority for patch cycles rather than emergency internet-facing response.
Full takeover of Oracle Access Manager (OAM) is achievable by a low-privileged, authenticated attacker who can reach the Authentication Engine component over HTTP, with no user interaction and low attack complexity, yielding a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Only OAM 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware are listed as affected, but the scope-change rating (S:C) means a successful compromise of the Authentication Engine is not contained to OAM and can significantly impact other products that trust OAM for authentication and federation. No CISA KEV listing and no public exploit code were identified at time of analysis; the practical gate is the requirement for a valid low-privileged account rather than exploit sophistication, which makes this a genuine high-priority issue for any internet-reachable or partner-federated OAM deployment.
Unauthenticated remote attackers can bypass authentication in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0, gaining full read and write access to all data managed by the affected component. This easily exploitable vulnerability (CVSS 9.1) requires only network access to the OAM authentication engine over HTTP and no credentials or user interaction. No public exploit code or active exploitation has been observed at the time of analysis, but the lack of authentication and high impact make it a critical risk for exposed instances.
Improper access control in the OIM Legacy UI component of Oracle Identity Manager (12.2.1.4.0 and 14.1.2.1.0) lets a network-positioned attacker who already holds a highly privileged account read and alter identity and provisioning data, with a scope change that can cascade into other connected Oracle products. Oracle rates it 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N), so exploitation is trivial once administrative access is obtained but is gated by that high-privilege requirement. No CISA KEV listing, public exploit code, or EPSS score was supplied with this record, so active exploitation is not confirmed (no public exploit identified at time of analysis).
Low-privileged attackers with network access can achieve full takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 through a flaw in the OIM Legacy UI component of Oracle Fusion Middleware. Successful exploitation compromises confidentiality, integrity, and availability of the identity platform itself, which typically means control over the accounts, roles, and provisioning workflows it governs. The vulnerability is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N), requires only an authenticated low-privilege session, and no public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Unauthenticated attackers with network access to Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 can compromise the Authentication Engine component over HTTP, obtaining unauthorized read access to critical data or all data accessible through the product. Oracle rates this CVSS 3.1 8.6 with a scope change (S:C), meaning affected deployments can be leveraged to significantly impact downstream/connected applications that trust OAM identities. At time of analysis there is no public exploit code identified and no CISA KEV listing, but the attack is trivially automatable (AV:N/AC:L/PR:N/UI:N), so internet-exposed OAM consoles and SSO endpoints should be treated as high priority.
Unauthenticated network attackers who can reach the T3 or IIOP listener fronting Oracle Access Manager's Authentication Engine on versions 12.2.1.4.0 or 14.1.2.1.0 can bypass authentication and take full control of the component, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No credentials or user interaction are required; the only meaningful precondition is that the T3/IIOP protocols are reachable from the attacker's position, so deployments that restrict those protocols to trusted internal networks are not externally exploitable. This vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis, but the combination of a perfect-exploitability CVSS vector, an authentication-bypass root cause, and default-exposed WebLogic remoting protocols makes it a high-priority patch target.
Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a flaw in the Authentication Engine component that lets a high-privileged, network-positioned attacker read, create, delete, or modify data managed by the OAM deployment — and because the flaw crosses a security scope boundary, downstream applications that trust OAM for identity can be affected as well. The CVSS 3.1 base score is 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting an easily triggered but credentialed attack with high confidentiality and integrity impact and no availability impact. No public exploit code, EPSS score, or CISA KEV listing is present in the supplied intelligence, so it is treated as not yet publicly exploited at time of analysis; Oracle ships fixes through its Critical Patch Update / Security Alert program referenced in the advisory link.
Authentication weaknesses in the Oracle Access Manager Authentication Engine expose deployments running 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware: an attacker with network access over HTTP and only a low-privileged foothold can bypass or subvert authentication to create, delete, or modify critical data and read data across the OAM-accessible estate, while also degrading service availability. Because the CVSS vector carries a scope change (S:C), a compromise of OAM can propagate to other products that rely on it as their single sign-on and identity provider, which is what pushes the base score to 9.9 rather than the more typical 8.x for an authenticated-only flaw. No user interaction is required and attack complexity is low, though the PR:L rating means the attacker must already hold at least minimal valid access or be able to reach an authenticated interface - this is not a fully unauthenticated pre-auth bypass. There is no CISA KEV listing and no public exploit code identified in the available intelligence, so exploitation is not confirmed actively exploited (CISA KEV) and no public exploit identified at time of analysis.
Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated remote attacker with HTTP network access compromise the product's Authentication Engine and take over the affected instance. Rated CVSS 3.1 base 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), the scope-change flag means a successful compromise propagates to downstream applications that trust OAM for authentication, widening impact well beyond the OAM host itself. No public exploit has been identified at time of analysis, but the pre-auth, network-reachable attack path makes this a top-tier priority for any organization running the two named versions.
Full takeover of Oracle Identity Manager is achievable by any low-privileged authenticated user who can reach the application's HTTP interface in versions 12.2.1.4.0 and 14.1.2.1.0 (Oracle Fusion Middleware, Core component). The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), meaning a single authenticated request chain can hand an attacker administrative control over the identity governance platform. No CISA KEV listing, EPSS score, or public proof-of-concept was supplied in the source data, so exploitation status is currently unconfirmed and no public exploit has been identified at time of analysis.
Oracle Identity Manager (OIM), the identity-governance component of Oracle Fusion Middleware, is exposed to a takeover-level flaw in its Core component affecting versions 12.2.1.4.0 and 14.1.2.1.0. An attacker who holds a low-privileged account and can reach the T3 or IIOP listener over the network can exploit the defect to fully compromise the OIM deployment, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). No public exploit code or CISA KEV entry was present in the supplied intelligence, and the accompanying 'Information Disclosure' tag understates the reported impact — the vector's C/I/A metrics are all High.
Unauthenticated, network-positioned attackers can fully take over Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 by bypassing authentication in the Core component (CVE-2026-70913), which carries a CVSS 3.1 base score of 9.8 using the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Oracle characterizes the flaw as easily exploitable over HTTP, meaning no credentials, no user interaction, and no non-default configuration are required - only HTTP reachability to an affected instance - and successful exploitation gives complete loss of confidentiality, integrity, and availability on the identity platform. No public exploit code or confirmed active exploitation was identified at time of analysis, but the zero-prerequisite exploitation profile makes any internet- or broadly reachable OIM deployment a top-priority exposure.
Unauthenticated remote takeover of Oracle WebLogic Server is achievable through its T3 and IIOP protocol listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Classified as CWE-287 (Improper Authentication) and scored CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw allows any network-reachable attacker - no credentials, no user interaction - to gain full confidentiality, integrity, and availability impact over the affected server, which Oracle itself rates 'easily exploitable'. Exploitation hinges on reachability of the T3/IIOP listeners, which are enabled by default on the WebLogic administration and managed-server listen ports, meaning most standard deployments are exposed unless those protocols are filtered, disabled, or network-segmented; no public exploit code or confirmed in-the-wild activity was identified at time of analysis, so exposure should be treated as high-impact and high-priority but not yet observed as actively exploited.
Authentication bypass in Oracle WebLogic Server (Core component) allows unauthenticated, network-positioned attackers to gain full takeover of the server, earning the maximum CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with complete confidentiality, integrity, and availability impact. All four supported branches are affected: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Exploitation requires reachability of the T3 or IIOP protocol listener (commonly port 7001) with no authentication and no user interaction, and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV, so exposure is primarily governed by whether T3/IIOP is reachable from untrusted networks.
Unauthenticated remote takeover of Oracle WebLogic Server is achievable via the T3 and IIOP listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, where an improper-authentication defect (CWE-287) in the Core component of Oracle Fusion Middleware lets a network attacker bypass login and obtain full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The only real precondition is reachability of the T3/IIOP listener, which is enabled by default and usually shares the WebLogic HTTP port (7001); no credentials and no user interaction are required, so environments that firewall, disable, or connection-filter T3/IIOP materially reduce exposure. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but this is a genuine high-priority vulnerability rather than a CVSS-inflated one.
Password hash extraction from any Dolibarr 24.0.0 user account, including administrators, is possible for authenticated low-privileged users via a case-sensitivity mismatch in the sqlfilters API parameter denylist. The PHP guard in dolForgeSQLCriteriaCallback() performs case-sensitive string matching against forbidden field names, while the underlying database resolves column names case-insensitively, allowing bypasses using uppercase variants such as PASSWORD instead of password. By submitting prefix-matching predicates as boolean oracle queries, an attacker can extract full credential hashes character-by-character without elevated privileges. No public exploit code has been identified at time of analysis; a patch commit is available upstream.
Cross-tenant SQL injection in OpenPanel's analytics filter builder allows authenticated attackers with project-scoped read credentials to exfiltrate other organizations' analytics data and profile PII. Unvalidated `profile.*` filter column identifiers are interpolated directly into ClickHouse WHERE clauses, enabling blind boolean oracle attacks that bypass project isolation boundaries. No public exploit code has been identified at time of analysis, but the low authentication bar and confirmed cross-tenant scope change make this a genuine priority for any multi-tenant OpenPanel deployment.
Argument injection in GitPython 3.1.59's high-level diff API allows low-privileged remote attackers to read arbitrary filesystem paths by passing the unsanitized `--no-index` flag to the underlying git diff command. By chaining `--no-index` with the `-I`/`--ignore-matching-lines` regex filter, an attacker can construct a content-dependent Boolean oracle - issuing repeated queries that distinguish between regex match and mismatch responses to recover single-line secrets from local files. No active exploitation has been confirmed (not in CISA KEV), but the technique is deterministic and requires only authenticated API access. Patch-upgraded version 3.1.60 is available.
Unauthenticated account takeover in WWBN AVideo (through commit e01e41ecc) stems from get_api_preauthorize in plugin/API/API.php, a second, undocumented login path that performs the same credential check as get_api_signIn but omits the 10-attempts-per-5-minutes throttle enforced by checkRateLimit(). This lets remote attackers brute-force any account - including admin - without rate limiting, and the endpoint doubles as a credential oracle whose users_id field (1 vs 0) discloses password validity even though the message always reads 'Invalid credentials'. No public exploit identified at time of analysis, and no vendor-released patch is available.
Sensitive field disclosure in ash_lua (versions 0.1.0 through 0.2.0) allows any actor who can submit a Lua script to read Ash resource attributes that are deliberately excluded from the manifest's exposed-field allow-list - including sensitive?: true columns such as hashed passwords. The operation aggregate path in AshLua.Runtime resolved field names directly via String.to_existing_atom and Ash.Query.Aggregate.new! without invoking the same AshLua.Fields.for_action/4 allow-list check enforced by the normal field-read path, creating an alternate route to private data. Vendor patch 0.2.1 is confirmed available; no CISA KEV listing or independent exploit beyond the PoC embedded in the security advisory has been identified.
Unauthenticated arbitrary file read in the surya 0.22.1 screenshot server allows any network-reachable attacker to exfiltrate image and PDF files from the host filesystem by supplying attacker-controlled paths to three unprotected HTTP routes. The /info, /page, and /process endpoints pass raw file_path parameters directly to Pillow's Image.open and pypdfium2.PdfDocument, returning rendered file contents as base64-encoded HTTP responses. The /info route additionally acts as a file-existence oracle, enabling systematic enumeration of host paths before targeted exfiltration; no public exploit has been identified at time of analysis.
Unauthenticated SQL injection in WWBN AVideo's channels API endpoint allows remote attackers to extract password hashes and account recovery tokens without any credentials. The `sort` column parameter in `get.json.php?APIName=channels` is injected directly into a SQL ORDER BY clause unsanitized, enabling an ordering oracle attack to infer sensitive column values character-by-character and triggering verbose SQL errors that disclose the full query and database schema. No public exploit has been identified at time of analysis, though VulnCheck has independently reported this vulnerability with a GitHub Security Advisory published by the vendor.
Administrator account takeover in the Support Genix WordPress helpdesk plugin (all versions up to and including 1.4.52) is achievable by any subscriber-level user who can obtain a single guest ticket token, exploiting a catastrophically weak encryption key derivation that yields only ~19.5 bits of effective entropy. The `guest_ticket_login()` function at the publicly reachable `/sgnix/?p=<token>` endpoint lacks capability checks, nonce validation, and session controls, allowing an attacker to exhaustively recover the site-wide AES-256-CBC key offline across ~729,000 candidates and forge an admin-authentication token. No public exploit has been identified at time of analysis, but the attack is technically straightforward given the tiny keyspace, deterministic IV construction, and unauthenticated endpoint exposure.
Unauthenticated stream credential disclosure in AVideo (WWBN, commit e01e41ecc and earlier) lets remote attackers retrieve any user's restream stream_key and stream_url for external platforms like YouTube, Facebook, and Twitch. The getLiveKey.json.php endpoint accepts a 'token' parameter that bypasses both the Live::canRestream() access gate and the restream ownership check, and the token is merely AES-256-CBC encryptString() of an integer id with no user binding, expiry, or authentication tag. Because a public encryption oracle (view/url2Embed.json.php) lets anyone encrypt arbitrary values, valid tokens can be forged with no authentication; no public exploit is identified at time of analysis but the technique is fully described.
Blind SQL injection in WsgiDAV's MySQLBrowserProvider sample module (versions <= 4.3.4) allows unauthenticated network attackers to read arbitrary data from the backing MySQL database via URL path manipulation. The record key segment of the URL is concatenated directly into a WHERE clause without escaping, enabling a boolean status-code oracle that supports full character-by-character data extraction. A secondary typo in the numeric-type check (`INTT` instead of `INT`) ensures all primary key types take the vulnerable quoted branch, and a working PoC with complete extraction script has been publicly confirmed. No public exploit identified as confirmed actively exploited (CISA KEV), but the PoC lowers the exploitation bar significantly.
Unauthenticated content exfiltration in Trilium up to 0.103.0 is possible through the public share-search endpoint, which applies authorization only to the ancestor note supplied in the request rather than to each result it returns. Any visitor with HTTP access to the instance can query `/share/api/notes` to enumerate titles, tree paths, and share identifiers of notes protected by `shareCredentials` passwords or hidden via `shareHiddenFromTree`, and can use the endpoint as a boolean substring oracle to iteratively reconstruct the full plaintext of password-gated notes. No public exploit has been identified at time of analysis, and the issue is patched in version 0.104.0.
CPU-exhaustion denial of service in netty-incubator-codec-ohttp's BinaryHttpParser permanently pins Netty event-loop threads at 100% CPU via an infinite loop in field-section decoding, reachable by any unauthenticated remote attacker. Because OHTTP gateways publish their HPKE public key by design, an attacker can encrypt a crafted ~17-byte Binary HTTP payload as a cryptographically valid OHTTP request, which passes decryption and reaches the vulnerable parser without any authentication barrier. A handful of such requests exhausts the entire fixed-size Netty event-loop thread pool, rendering the gateway or client fully offline until the process is restarted; no public exploit identified at time of analysis, though an empirically-reproduced proof-of-concept is documented in the advisory.
Remote privilege escalation in Ceph RADOS Gateway (RGW) allows any holder of a valid STS session token - regardless of privilege level - to forge administrative credentials by exploiting unauthenticated AES-128-CBC encryption. By applying a deterministic CBC bit-flip to the acct_type, perm_type, and is_admin fields of their own token, an attacker can trigger a global authorization override that bypasses all RGW capability checks, yielding full administrative control over all objects and buckets in the cluster. No public exploit has been identified at time of analysis; however, the attack is self-contained, requires no encryption oracle, and is reachable over the standard RGW S3 endpoint, making it highly accessible to any user with STS access. Fixed versions 19.2.6 and 20.2.4 are confirmed released.
Unauthenticated remote exploitation of Oracle Helidon 3.2.20's Imperative Web Server component enables attackers to perform unauthorized creation, deletion, or modification of critical data via HTTP with no prerequisites. The vulnerability carries a scope change (S:C in CVSS), meaning successful exploitation can cascade to impact additional products or systems beyond Helidon itself. Tagged as an authentication bypass, this is classified by Oracle as easily exploitable with no public exploit identified at time of analysis.
Unauthorized data access in Oracle Helidon 4.5.0 exposes all data reachable through the Imperative Web Server component to unauthenticated remote attackers over HTTP. Tagged as an authentication bypass, the flaw allows complete confidentiality compromise - an attacker can read critical or all accessible application data without supplying credentials. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is trivially executable from any network position.
Remote denial-of-service and partial data exposure in Oracle Helidon 4.5.0 allows unauthenticated network attackers via HTTP/2 to cause a complete hang or crash of the Helidon Imperative Web Server, alongside unauthorized read access to a subset of accessible data. The vulnerability is classified as easily exploitable with no authentication, user interaction, or special configuration required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a realistic denial-of-service threat against any exposed Helidon 4.5.0 deployment.
Remote denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated network attackers to hang or repeatedly crash the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, zero-prerequisite exploitation against any reachable instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this a credible threat to internet-facing deployments.
Denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated remote attackers to crash or indefinitely hang the service via crafted HTTP/2 traffic. Disclosed as part of Oracle's Critical Security Patch Update (CPU) for August 2026, the vulnerability is rated CVSS 7.5 with low attack complexity and no privileges required, making automated exploitation straightforward against any exposed instance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service in Oracle Helidon 3.2.19's Imperative Web Server allows unauthenticated network attackers to hang or crash the server entirely via HTTP/2 traffic. The CVSS 3.1 score of 7.5 reflects the low attack complexity and complete availability impact, with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers with HTTP network access to perform unauthorized read, write, and partial denial-of-service operations against data accessible to the service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is easily exploitable with no prerequisites, though impacts are bounded to partial CIA effects within the unchanged scope of the Helidon instance. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows network attackers over HTTP to achieve partial confidentiality disclosure, data manipulation, and denial of service - with a confirmed scope change indicating the impact can extend to components beyond Helidon's own security boundary. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) places this among the most easily reachable vulnerability classes: no credentials, no user interaction, and no elevated complexity required. Disclosed in Oracle's August 2026 Critical Security Patch Update, no public exploit code or CISA KEV listing has been identified at time of analysis.
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attacker send HTTP requests that grant high-integrity write access to Helidon-accessible data, partial read disclosure, and a partial denial of service - with impact that can extend beyond Helidon into adjacent products. Rated CVSS 3.1 9.9 due to the scope change combined with easy, no-privilege network exploitation. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated network exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows remote attackers to partially compromise confidentiality, integrity, and availability of the affected system, with a confirmed scope change meaning attacks can extend impact to additional co-located products or services. The vulnerability is rated 8.3 (High) under CVSS 3.1, elevated by the scope change despite individually low CIA impact ratings. No public exploit code has been identified at time of analysis, and Oracle disclosed this through its August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers to bypass authentication controls via HTTP, resulting in unauthorized read access to a subset of application data and the ability to insert, update, or delete accessible records. The CVSS scope change (S:C) indicates successful exploitation can affect additional systems beyond the Helidon instance itself - a compounding factor in microservices topologies where Helidon acts as a gateway or intermediary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated, low-complexity attack path makes this credible against any internet-exposed deployment.
Denial-of-service in Oracle Helidon 3.2.20 (Imperative Web Server component) allows unauthenticated remote attackers to repeatedly crash or indefinitely hang the server via crafted HTTP requests. The vulnerability is rated CVSS 7.5 with no authentication, no user interaction, and low attack complexity, making it trivially exploitable at scale against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ease of exploitation and complete availability impact warrant prompt patching.
Unauthenticated remote exploitation of Oracle Helidon 1.4.19's Imperative Web Server component via HTTP allows attackers to perform unauthorized creation, deletion, and modification of critical application data, with partial read access to Helidon-accessible data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero barriers to exploitation - no credentials, no user interaction, and low attack complexity over standard HTTP. Reported via Oracle's Critical Patch Update for August 2026 and tagged as an Authentication Bypass, with no public exploit code or CISA KEV listing identified at time of analysis.
Authentication bypass in Oracle Helidon 1.4.19 (Imperative Web Server component of Oracle Fusion Middleware) lets a remote, unauthenticated attacker reach and manipulate protected data over HTTP, yielding full read and write access to all data the Helidon instance can reach. Oracle rates it CVSS 9.1 with High confidentiality and integrity impact and no availability impact, and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Helidon 1.4.19 (Imperative Web Server component) lets a remote attacker send crafted HTTP requests to read, create, modify, or delete all Helidon-accessible data. Oracle rates it CVSS 3.1 9.1 (high confidentiality and integrity impact, no availability impact) and classifies it as an authentication-bypass-class flaw. No public exploit identified at time of analysis, but the low attack complexity and no-authentication requirement make it a high-priority patch item once Oracle's fix is applied.
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthenticated attacker with network access over HTTP to fully compromise the affected instance. The flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity and availability, and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is not yet confirmed in the wild.
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach critical data and disrupt service over plain HTTP with no credentials and no user interaction. Oracle rates it CVSS 3.1 9.4, reflecting high confidentiality and integrity impact plus partial denial of service, and it was disclosed in the Oracle Critical Patch Update of August 2026. No public exploit identified at time of analysis, but the trivial exploitability and unauthenticated network reach make it a top-tier patch priority.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows network-adjacent attackers to partially compromise confidentiality, integrity, and availability via standard HTTP. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms zero authentication or user interaction is required, and attack complexity is low - meaning successful exploitation demands minimal attacker skill or infrastructure. Disclosed through Oracle's Critical Patch Update for August 2026, no public exploit code has been identified at time of analysis, though the low-barrier network vector warrants prompt remediation for any internet-exposed Helidon deployment.
Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the Helidon application via a flaw in the Imperative Web Server component. Oracle rates it CVSS 9.1 (high confidentiality and integrity impact, no availability impact), and the vendor tag 'Authentication Bypass' indicates protected routes/resources can be reached without credentials. No public exploit identified at time of analysis; addressed in the Oracle Critical Patch Update of August 2026.
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) allows a network attacker to read, create, modify, or delete all data accessible to the framework over HTTP. Tagged by Oracle as an authentication bypass, it carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact and no availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but Oracle rates it as easily exploitable, warranting prompt patching.
Remote denial-of-service in Oracle Helidon 4.5.0 Imperative Web Server allows unauthenticated network attackers to cause a persistent hang or repeated crash of the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with no authentication or user interaction required, making this reliably triggerable against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity means operational risk for teams running Helidon 4.5.0 in production microservice environments is meaningful.
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server component over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw yields full compromise of confidentiality, integrity, and availability (CVSS 9.8) without credentials or user interaction. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing profile makes it a high-priority patch.
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated, network-adjacent attackers to read critical application data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial exploitability with no authentication or user interaction required. Classified under the Authentication Bypass tag by Oracle, this vulnerability is covered in the Oracle Critical Patch Update for August 2026, with no public exploit code or CISA KEV listing identified at time of analysis.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to access critical or all Helidon-accessible data via HTTP. The vulnerability is tagged as an authentication bypass, consistent with the CVSS vector showing no privileges or user interaction required (PR:N/UI:N) and a high confidentiality impact. Disclosed as part of Oracle's Critical Patch Update for August 2026, no public exploit or CISA KEV listing has been identified at time of analysis.
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imperative Web Server component, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects easy exploitation with no privileges or user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in Oracle Helidon 4.5.1 (Imperative Web Server component) exposes applications to unauthenticated remote attackers who can create, modify, or delete critical data accessible to the service via standard HTTP requests. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 7.5, reflecting a network-accessible, zero-complexity attack requiring no credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Patch Update.
Unauthenticated remote denial-of-service in Oracle Helidon 3.2.19 allows a network attacker to hang or crash the Imperative Web Server component via crafted HTTP requests, causing complete loss of service availability. The vulnerability requires no privileges, no user interaction, and is reachable over standard HTTP, making it trivially exploitable against any exposed Helidon 3.2.19 instance. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to perform unauthorized read access to a subset of data, unauthorized data modification, and partial denial of service - all without credentials or user interaction. Oracle classifies this as 'easily exploitable' in its August 2026 Critical Patch Update advisory. No public exploit identified at time of analysis, but the low attack complexity and network accessibility make this a straightforward target for opportunistic attackers.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to read a subset of accessible data, perform unauthorized write/modify operations, and cause a partial denial of service. The CVSS vector confirms network accessibility with no authentication, no user interaction, and low attack complexity, making this easily exploitable against exposed deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial exploitation conditions warrant prompt patching.
Remote denial-of-service in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network attackers to crash or indefinitely hang the server by sending crafted HTTP/2 traffic. The vulnerability carries a CVSS 7.5 rating with low attack complexity and no credential or interaction requirement, making it trivially scriptable from any network-accessible position. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Unauthenticated remote access to sensitive data affects Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2, allowing an attacker with network access to read critical or all data accessible to the Helidon application. The vulnerability is tagged as an authentication bypass, consistent with the CVSS vector showing no privileges or user interaction required. No public exploit identified at time of analysis, and the flaw is disclosed through Oracle's Critical Patch Update for August 2026.
Improper authorization on the SOAP-facing Client Bundle interface of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-positioned attacker read all data the application can reach and modify a subset of it. Oracle scores it 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and the Changed scope metric indicates the blast radius can extend beyond Capture into other Fusion Middleware components. No public exploit code or CISA KEV entry was identified at time of analysis; the Oracle Critical Security Patch Update advisory (cspusep2026) is the authoritative source.
Full takeover of Oracle Access Manager is achievable by a low-privileged, network-positioned attacker who can reach the product's HTTP Authentication Engine, affecting supported versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware. The flaw requires valid low-privilege credentials (PR:L) and is rated hard to exploit (AC:H), but its scope-change rating means a successful attack against OAM can cascade into the downstream applications that rely on it for single sign-on. As of analysis, no public exploit code and no CISA KEV listing were identified, and the input contained no EPSS score, so real-world exploitation pressure is unquantified despite the 8.5 base score.
Full takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is achievable by an authenticated, high-privileged attacker who can reach the Authentication Engine over HTTP, with a CVSS 3.1 base score of 9.1 due to low attack complexity, no user interaction, and scope change that can affect integrated identity/SSO products. The PR:H prerequisite means this is realistically an insider or post-compromise privilege-abuse path rather than a remote unauthenticated break-in. No public exploit code was identified at time of analysis and no CISA KEV listing is present in the provided intelligence.
Improper authentication in the Messaging Enabler component of Oracle Fusion Middleware Service Delivery Platform allows unauthenticated remote attackers to bypass authentication and fully take over the product, compromising confidentiality, integrity, and availability. Affected releases are Oracle SDP 12.2.1.4.0 and 14.1.2.0.0, and per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires only network reachability to the Messaging Enabler HTTP interface - no credentials, privileges, or user interaction are needed. There is no public exploit code identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the main real-world limiting factor is exposure, since SDP is niche carrier/telecom middleware typically deployed inside operator networks rather than on the public internet.
Authenticated, low-privileged attackers with network HTTP access to the Messaging Enabler component of Oracle Service Delivery Platform (Fusion Middleware) can achieve full takeover of the platform, and because the CVSS profile carries a scope change (S:C) the compromise can extend to additional connected products beyond SDP itself. Oracle rates the issue CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), affecting SDP 12.2.1.4.0 and 14.1.2.0.0; exploitation needs valid low-privilege credentials but no user interaction, at low attack complexity, and no public exploit code has been identified at time of analysis. The realistic limiting factors are the credential prerequisite, the narrow deployment base of this specialized telecom service-delivery platform rather than general-purpose middleware, and the fact that the vector is well-calibrated rather than inflated.
Takeover of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler component) is achievable by a low-privileged, network-positioned attacker, carrying a CVSS 3.1 base score of 9.9 with a scope change (S:C) that lets a successful compromise spill over into other products. The affected releases are 12.2.1.4.0 and 14.1.2.0.0, and the attack path is the T3 and IIOP listeners; per the assessed vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) the attacker must already hold a valid low-privileged account on the platform, but no user interaction is required and confidentiality, integrity and availability impacts are all High. There is no public exploit code identified at time of analysis and the vulnerability is not listed in CISA KEV, so urgency rests on the near-maximum score and the exposure of internal T3/IIOP ports rather than on observed exploitation; the residual risk drops sharply where those proprietary protocols are firewalled or the platform is segmented away from untrusted users.
Authenticated remote attackers who can reach the WebLogic T3 or IIOP remoting interfaces of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler) can take over the product entirely, with the compromise extending to connected Oracle components because of the scope change. The flaw affects Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - no user interaction is required, but a valid low-privileged account is a prerequisite, so it is exploitable (not unauthenticated). No public exploit code and no confirmed active exploitation were identified at time of analysis; practical exposure is further narrowed because T3/IIOP ports are commonly firewalled or not internet-facing in hardened WebLogic deployments.
Oracle Platform Security for Java (component: Centralized Thirdparty Jars) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with logon access to the host to fully compromise the component, resulting in high confidentiality, integrity, and availability impact. The flaw is locally exploitable (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and requires only a valid low-privileged account on the infrastructure where the component executes. No public exploit code or CISA KEV listing is identified at time of analysis, and the vendor advisory is available via Oracle's Critical Patch Update.
Authentication bypass in Oracle Platform Security for Java (OPSS) 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to reach the affected SOAP interface and achieve full takeover of the OPSS instance, with high confidentiality, integrity, and availability impact (CVSS 9.8). The flaw is classified as CWE-287 improper authentication and is tagged as an authentication bypass; per the Oracle-supplied CVSS vector, no credentials or user interaction are required. No public exploit identified at time of analysis, but any reachable vulnerable OPSS service should be treated as high risk because the practical limiting factor is network exposure of the SOAP endpoint rather than a configuration prerequisite.
Unauthenticated remote attackers who can reach an exposed LDAP authentication path in Oracle Platform Security for Java (OPSS) can achieve complete takeover of the OPSS security framework in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, with full confidentiality, integrity and availability impact (CWE-287 improper authentication, CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the Centralized Thirdparty Jars component and requires no credentials and no user interaction, but exploitability in practice depends on network reachability: OPSS is an embedded security framework consumed by Fusion Middleware applications rather than a standalone internet-facing service, so internal-only or firewalled OPSS/LDAP endpoints substantially reduce exposure. No public exploit code and no CISA KEV entry were identified at time of analysis, and no real-world exploitation telemetry is available, so the 9.8 severity reflects assessed potential rather than observed attack activity.
Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 contain a flaw in the Business Interlink component that lets a low-privileged, network-reachable user read or fully compromise PeopleTools-accessible data and modify or delete some of it, with impact extending to other connected products (scope change). Oracle rates it CVSS 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and notes it is 'easily exploitable' by a low-privileged attacker over HTTP. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Local privilege escalation in the Installation component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets any low-privileged user who can log on to the host running Siebel CRM Deployment to fully compromise that deployment. Because the flaw is reachable through the local attack surface with no user interaction and yields complete loss of confidentiality, integrity and availability, an attacker with an otherwise ordinary account can effectively take over the CRM environment. No public exploit code or in-the-wild exploitation is identified in the available intelligence at time of analysis, and the vendor advisory from Oracle is the sole reference for affected versions and fixes.
In Oracle Siebel CRM's Marketing module (Siebel Apps - Marketing), supported versions 17.0 through 26.7 expose a network-reachable HTTP flaw that a high-privileged user can leverage to seize full control of the Marketing application, impacting confidentiality, integrity and availability alike (CVSS 3.1 base 7.2). The issue is rated easily exploitable (AC:L) but is gated behind privileged credentials (PR:H), and no user interaction is needed once such access exists. No CISA KEV entry, public exploit code, or EPSS score was supplied with the source data, so active exploitation is unconfirmed at time of analysis.
Unauthenticated remote attackers who can reach the Portlet Services component of Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 over HTTP can bypass authentication and achieve full takeover of the application, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 9.8; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is an improper-authentication defect (CWE-287) and, per the assessed vector, needs no credentials, no user interaction and no non-default configuration, so any instance with Portlet Services reachable is directly at risk. No public exploit code has been identified at time of analysis, and the principal real-world limiter is exposure, since WebCenter Portal is typically deployed behind an enterprise perimeter rather than openly on the internet; this is nevertheless a high-priority issue on every available static signal, with thin real-world exploitation evidence.
Authenticated attackers holding a low-privileged account can exploit the Authentication Engine in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 over HTTPS to read, create, delete, or modify all data reachable through the service, with CVSS 3.1 base score 9.6 reflecting high confidentiality and integrity impact and a scope change. The flaw is remotely reachable with low attack complexity and no user interaction, but it is not pre-authentication: a valid low-tier credential on the OAM instance is required, which is the main limiting factor on exploitation. No public exploit identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); Oracle's Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source.
Unauthenticated takeover of Oracle JDeveloper is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0 through the ADF Faces component, which is exposed over HTTP; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms remote, unauthenticated, low-complexity exploitation requiring no user interaction, with full confidentiality, integrity, and availability impact. The root cause is an authentication bypass (CWE-287) rather than a memory-safety or injection flaw, meaning an attacker who can reach the ADF Faces web tier may be able to act with privileges they were never granted. No public exploit code has been identified at time of analysis and the vulnerability is not listed as confirmed actively exploited (CISA KEV); the main real-world constraint is network exposure, since JDeveloper is primarily a Java development IDE and its ADF Faces web tier is not normally published to untrusted networks.
Unauthenticated denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a remote attacker to hang or repeatedly crash the application server through crafted HTTP traffic, with no confidentiality or integrity impact. The vulnerability sits in the Ren (Real-time Event Notification) Server component, is rated CVSS 7.5 with an all-network, no-privileges, no-user-interaction vector, and is fixed in Oracle's Critical Security Patch Update (cspusep2026). No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged authenticated attacker with HTTP network access to fully compromise the Portal through the Composer component, resulting in complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8). Exploitation requires only a valid low-privilege account and a reachable HTTP interface - no user interaction and no elevated privileges - making the barrier to abuse relatively low for anyone with any Portal login. There is no public exploit identified, no CISA KEV listing and no EPSS score provided at time of analysis, so this is currently a patch-now vulnerability rather than a confirmed actively exploited one.
Unauthenticated network attackers can achieve full takeover of Oracle Access Manager via a difficult-to-trigger flaw in the Authentication Engine component of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this CVSS 3.1 8.1 with High confidentiality, integrity, and availability impact from a network vector requiring no privileges or user interaction, meaning the identity service itself — and the applications it protects — can be fully compromised. No public exploit code and no CISA KEV entry were identified at time of analysis; the AC:H rating indicates the attack requires precise timing or a specific non-default state rather than a trivial repeatable request.
Unauthenticated network attackers can obtain complete confidentiality and integrity compromise of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 through the Portlet Services component, but only after a legitimate portal user is induced to interact with attacker-influenced content - exploitation is gated by the UI:R prerequisite, which requires human interaction from a person other than the attacker. With a CVSS 3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), the flaw allows unauthorized creation, deletion or modification of, and complete read access to, data accessible through the portal, and because scope changes (S:C) the impact can extend to additional integrated products. There is no KEV listing and no public exploit identified at time of analysis, so this is a high-severity issue whose real-world risk is bounded by the need to socially engineer a valid portal user and by the narrow set of affected releases.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can be taken over by an unauthenticated remote attacker who reaches the Composer component over HTTP, because the component fails to properly enforce authentication (CWE-287). Oracle scores this 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or non-default configuration are required - only network reachability of the WebCenter Portal HTTP interface, with the stated outcome being full takeover of the portal. At time of analysis there is no public exploit identified and the issue is not listed as confirmed actively exploited (CISA KEV), so the practical risk is driven by exposure: internet-facing instances are directly at risk, while deployments confined to internal networks or sitting behind an authenticating reverse proxy or WAF are materially harder to reach. This is assessed as well-calibrated maximum severity rather than an inflated score, since an unauthenticated authentication bypass leading to product takeover justifies the C:H/I:H/A:H impact set.
Improper handling of chart content in the Charting component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a low-privileged, authenticated attacker read and modify critical application data after inducing another user to interact with a crafted HTTP request. Successful exploitation yields high confidentiality and integrity impact across all data the victim's session can reach, though availability is unaffected. No public exploit code has been identified at time of analysis, no CISA KEV listing is present in the supplied data, and no EPSS score was provided.
Unauthenticated attackers with HTTP network access to Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can achieve full takeover of the application via the Business Interlink component, as reflected in a CVSS 3.1 base score of 8.1 with high confidentiality, integrity, and availability impact. The flaw is rated high attack complexity (AC:H) and Oracle describes it as 'difficult to exploit,' meaning a successful attack depends on conditions outside the attacker's direct control - such as a specific Business Interlink configuration, integration state, or timing - which keeps this a serious but not top-tier-urgent issue. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; internet-facing PeopleSoft portals exposing the Business Interlink feature are the highest-risk deployments.
Authentication bypass in the Portlet Services component of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 lets unauthenticated remote attackers reach protected functionality over HTTP and, on success, take over the application (CVSS 3.1 base score 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw maps to CWE-287 (Improper Authentication), meaning the portal's Portlet Services layer fails to properly validate that a request originates from an authenticated session. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; the main exposure driver is network reachability of the WebCenter Portal HTTP interface, so internet-facing or broadly reachable instances behind no WAF or proxy carry the highest risk. Oracle addresses it in the September 2026 Critical Patch Update.
Improper authentication in the Portlet Services component of Oracle WebCenter Portal allows unauthenticated attackers with HTTP network access to the portal to bypass authentication and gain read and write access to all portal-accessible data, including the ability to create, delete, or modify critical content. Only versions 12.2.1.4.0 and 14.1.2.0.0 of this Oracle Fusion Middleware product are affected, and the flaw is rated high severity (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) with no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exploitation risk is driven primarily by internet or broad-network exposure of an unpatched portal.
Unauthenticated attackers with network access to the HTTP interface of Oracle WebCenter Portal's Portlet Services component can exploit a hard-to-trigger flaw to fully compromise the application, per Oracle's Critical Security Patch Update (cspusep2026). Impact spans confidentiality, integrity and availability (CVSS 8.1), with the stated outcome being complete takeover of WebCenter Portal. Only supported versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected; no public exploit code or CISA KEV entry was present in the supplied intelligence, and the high attack-complexity metric (AC:H) suggests exploitation requires specific, non-trivial conditions rather than a simple one-shot request.
Authentication bypass in the Oracle Access Manager (Fusion Middleware) Authentication Engine lets unauthenticated remote attackers with HTTP network access compromise OAM instances running 12.2.1.4.0 or 14.1.2.1.0, resulting in complete takeover of the affected service with high confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation of the CWE-287 flaw effectively grants the attacker the identity and authorization context the Authentication Engine is supposed to enforce, so any downstream application trusting OAM for single sign-on or access decisions is exposed to the same session. At the time of analysis there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified; the practical exposure is driven almost entirely by the network reachability of the OAM Authentication Engine endpoint, with internet-facing gateways the highest priority to patch.
Authenticated low-privileged users can fully take over Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 by sending crafted HTTP requests to the Portlet Services component. Oracle's Critical Security Patch Update rates this 8.8 with complete loss of confidentiality, integrity and availability of the portal, meaning an attacker with any valid low-privilege account can seize control of the application. No public exploit code or CISA KEV listing is known at time of analysis, so exploitation is currently limited to attackers who already hold credentials, though the low attack complexity makes weaponization plausible once a proof of concept surfaces.
Low-privileged, authenticated attackers with network access over HTTP to the Composer component of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can fully take over the affected deployment, with the scope change (S:C) meaning impact can extend into other connected Oracle Fusion Middleware products. Oracle rates the flaw as 'easily exploitable' with low attack complexity, no user interaction, and complete loss of confidentiality, integrity, and availability (CVSS 3.1 base score 9.9, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The practical bar is a valid low-privilege account, which makes this a genuine high-priority issue for internet- or broadly reachable WebCenter Portal instances rather than a theoretical high-score artifact; no public proof-of-concept and no CISA KEV entry were identified at time of analysis, so there is no public exploit identified at time of analysis.
Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the affected Access Manager instance, rated CVSS 3.1 9.8 (CWE-287, Improper Authentication) with high confidentiality, integrity, and availability impact. The vulnerable component is the Authentication Engine itself, and the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms no credentials, privileges, or user interaction are required, so any HTTP-reachable OAM deployment of those two versions is a candidate entry point. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); however, Oracle characterizes it as easily exploitable, so internet-exposed OAM instances should be treated as urgent.
Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 contain a flaw in the Authentication Engine component that lets a high-privileged attacker with HTTP network access fully compromise the product, taking over the authentication service itself (CVSS 3.1 base 9.1, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Because the score includes a scope change (S:C), a successful attack can spill over and significantly impact other products and applications that rely on OAM for authentication, turning a single privileged compromise into a broader identity-layer incident. The critical caveat is the PR:H prerequisite: this is a post-authentication, privileged-abuse issue rather than an unauthenticated remote takeover, so realistic exposure centers on malicious insiders, stolen or misused administrative credentials, or chained privilege-escalation paths. No public exploit code or confirmed exploitation was identified at time of analysis, and the weaknesses make it a priority for patch cycles rather than emergency internet-facing response.
Full takeover of Oracle Access Manager (OAM) is achievable by a low-privileged, authenticated attacker who can reach the Authentication Engine component over HTTP, with no user interaction and low attack complexity, yielding a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Only OAM 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware are listed as affected, but the scope-change rating (S:C) means a successful compromise of the Authentication Engine is not contained to OAM and can significantly impact other products that trust OAM for authentication and federation. No CISA KEV listing and no public exploit code were identified at time of analysis; the practical gate is the requirement for a valid low-privileged account rather than exploit sophistication, which makes this a genuine high-priority issue for any internet-reachable or partner-federated OAM deployment.
Unauthenticated remote attackers can bypass authentication in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0, gaining full read and write access to all data managed by the affected component. This easily exploitable vulnerability (CVSS 9.1) requires only network access to the OAM authentication engine over HTTP and no credentials or user interaction. No public exploit code or active exploitation has been observed at the time of analysis, but the lack of authentication and high impact make it a critical risk for exposed instances.
Improper access control in the OIM Legacy UI component of Oracle Identity Manager (12.2.1.4.0 and 14.1.2.1.0) lets a network-positioned attacker who already holds a highly privileged account read and alter identity and provisioning data, with a scope change that can cascade into other connected Oracle products. Oracle rates it 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N), so exploitation is trivial once administrative access is obtained but is gated by that high-privilege requirement. No CISA KEV listing, public exploit code, or EPSS score was supplied with this record, so active exploitation is not confirmed (no public exploit identified at time of analysis).
Low-privileged attackers with network access can achieve full takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 through a flaw in the OIM Legacy UI component of Oracle Fusion Middleware. Successful exploitation compromises confidentiality, integrity, and availability of the identity platform itself, which typically means control over the accounts, roles, and provisioning workflows it governs. The vulnerability is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N), requires only an authenticated low-privilege session, and no public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Unauthenticated attackers with network access to Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 can compromise the Authentication Engine component over HTTP, obtaining unauthorized read access to critical data or all data accessible through the product. Oracle rates this CVSS 3.1 8.6 with a scope change (S:C), meaning affected deployments can be leveraged to significantly impact downstream/connected applications that trust OAM identities. At time of analysis there is no public exploit code identified and no CISA KEV listing, but the attack is trivially automatable (AV:N/AC:L/PR:N/UI:N), so internet-exposed OAM consoles and SSO endpoints should be treated as high priority.
Unauthenticated network attackers who can reach the T3 or IIOP listener fronting Oracle Access Manager's Authentication Engine on versions 12.2.1.4.0 or 14.1.2.1.0 can bypass authentication and take full control of the component, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No credentials or user interaction are required; the only meaningful precondition is that the T3/IIOP protocols are reachable from the attacker's position, so deployments that restrict those protocols to trusted internal networks are not externally exploitable. This vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis, but the combination of a perfect-exploitability CVSS vector, an authentication-bypass root cause, and default-exposed WebLogic remoting protocols makes it a high-priority patch target.
Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a flaw in the Authentication Engine component that lets a high-privileged, network-positioned attacker read, create, delete, or modify data managed by the OAM deployment — and because the flaw crosses a security scope boundary, downstream applications that trust OAM for identity can be affected as well. The CVSS 3.1 base score is 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting an easily triggered but credentialed attack with high confidentiality and integrity impact and no availability impact. No public exploit code, EPSS score, or CISA KEV listing is present in the supplied intelligence, so it is treated as not yet publicly exploited at time of analysis; Oracle ships fixes through its Critical Patch Update / Security Alert program referenced in the advisory link.
Authentication weaknesses in the Oracle Access Manager Authentication Engine expose deployments running 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware: an attacker with network access over HTTP and only a low-privileged foothold can bypass or subvert authentication to create, delete, or modify critical data and read data across the OAM-accessible estate, while also degrading service availability. Because the CVSS vector carries a scope change (S:C), a compromise of OAM can propagate to other products that rely on it as their single sign-on and identity provider, which is what pushes the base score to 9.9 rather than the more typical 8.x for an authenticated-only flaw. No user interaction is required and attack complexity is low, though the PR:L rating means the attacker must already hold at least minimal valid access or be able to reach an authenticated interface - this is not a fully unauthenticated pre-auth bypass. There is no CISA KEV listing and no public exploit code identified in the available intelligence, so exploitation is not confirmed actively exploited (CISA KEV) and no public exploit identified at time of analysis.
Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated remote attacker with HTTP network access compromise the product's Authentication Engine and take over the affected instance. Rated CVSS 3.1 base 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), the scope-change flag means a successful compromise propagates to downstream applications that trust OAM for authentication, widening impact well beyond the OAM host itself. No public exploit has been identified at time of analysis, but the pre-auth, network-reachable attack path makes this a top-tier priority for any organization running the two named versions.
Full takeover of Oracle Identity Manager is achievable by any low-privileged authenticated user who can reach the application's HTTP interface in versions 12.2.1.4.0 and 14.1.2.1.0 (Oracle Fusion Middleware, Core component). The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), meaning a single authenticated request chain can hand an attacker administrative control over the identity governance platform. No CISA KEV listing, EPSS score, or public proof-of-concept was supplied in the source data, so exploitation status is currently unconfirmed and no public exploit has been identified at time of analysis.
Oracle Identity Manager (OIM), the identity-governance component of Oracle Fusion Middleware, is exposed to a takeover-level flaw in its Core component affecting versions 12.2.1.4.0 and 14.1.2.1.0. An attacker who holds a low-privileged account and can reach the T3 or IIOP listener over the network can exploit the defect to fully compromise the OIM deployment, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). No public exploit code or CISA KEV entry was present in the supplied intelligence, and the accompanying 'Information Disclosure' tag understates the reported impact — the vector's C/I/A metrics are all High.
Unauthenticated, network-positioned attackers can fully take over Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 by bypassing authentication in the Core component (CVE-2026-70913), which carries a CVSS 3.1 base score of 9.8 using the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Oracle characterizes the flaw as easily exploitable over HTTP, meaning no credentials, no user interaction, and no non-default configuration are required - only HTTP reachability to an affected instance - and successful exploitation gives complete loss of confidentiality, integrity, and availability on the identity platform. No public exploit code or confirmed active exploitation was identified at time of analysis, but the zero-prerequisite exploitation profile makes any internet- or broadly reachable OIM deployment a top-priority exposure.
Unauthenticated remote takeover of Oracle WebLogic Server is achievable through its T3 and IIOP protocol listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Classified as CWE-287 (Improper Authentication) and scored CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw allows any network-reachable attacker - no credentials, no user interaction - to gain full confidentiality, integrity, and availability impact over the affected server, which Oracle itself rates 'easily exploitable'. Exploitation hinges on reachability of the T3/IIOP listeners, which are enabled by default on the WebLogic administration and managed-server listen ports, meaning most standard deployments are exposed unless those protocols are filtered, disabled, or network-segmented; no public exploit code or confirmed in-the-wild activity was identified at time of analysis, so exposure should be treated as high-impact and high-priority but not yet observed as actively exploited.
Authentication bypass in Oracle WebLogic Server (Core component) allows unauthenticated, network-positioned attackers to gain full takeover of the server, earning the maximum CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with complete confidentiality, integrity, and availability impact. All four supported branches are affected: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Exploitation requires reachability of the T3 or IIOP protocol listener (commonly port 7001) with no authentication and no user interaction, and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV, so exposure is primarily governed by whether T3/IIOP is reachable from untrusted networks.
Unauthenticated remote takeover of Oracle WebLogic Server is achievable via the T3 and IIOP listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, where an improper-authentication defect (CWE-287) in the Core component of Oracle Fusion Middleware lets a network attacker bypass login and obtain full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The only real precondition is reachability of the T3/IIOP listener, which is enabled by default and usually shares the WebLogic HTTP port (7001); no credentials and no user interaction are required, so environments that firewall, disable, or connection-filter T3/IIOP materially reduce exposure. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but this is a genuine high-priority vulnerability rather than a CVSS-inflated one.
Password hash extraction from any Dolibarr 24.0.0 user account, including administrators, is possible for authenticated low-privileged users via a case-sensitivity mismatch in the sqlfilters API parameter denylist. The PHP guard in dolForgeSQLCriteriaCallback() performs case-sensitive string matching against forbidden field names, while the underlying database resolves column names case-insensitively, allowing bypasses using uppercase variants such as PASSWORD instead of password. By submitting prefix-matching predicates as boolean oracle queries, an attacker can extract full credential hashes character-by-character without elevated privileges. No public exploit code has been identified at time of analysis; a patch commit is available upstream.
Cross-tenant SQL injection in OpenPanel's analytics filter builder allows authenticated attackers with project-scoped read credentials to exfiltrate other organizations' analytics data and profile PII. Unvalidated `profile.*` filter column identifiers are interpolated directly into ClickHouse WHERE clauses, enabling blind boolean oracle attacks that bypass project isolation boundaries. No public exploit code has been identified at time of analysis, but the low authentication bar and confirmed cross-tenant scope change make this a genuine priority for any multi-tenant OpenPanel deployment.
Argument injection in GitPython 3.1.59's high-level diff API allows low-privileged remote attackers to read arbitrary filesystem paths by passing the unsanitized `--no-index` flag to the underlying git diff command. By chaining `--no-index` with the `-I`/`--ignore-matching-lines` regex filter, an attacker can construct a content-dependent Boolean oracle - issuing repeated queries that distinguish between regex match and mismatch responses to recover single-line secrets from local files. No active exploitation has been confirmed (not in CISA KEV), but the technique is deterministic and requires only authenticated API access. Patch-upgraded version 3.1.60 is available.
Unauthenticated account takeover in WWBN AVideo (through commit e01e41ecc) stems from get_api_preauthorize in plugin/API/API.php, a second, undocumented login path that performs the same credential check as get_api_signIn but omits the 10-attempts-per-5-minutes throttle enforced by checkRateLimit(). This lets remote attackers brute-force any account - including admin - without rate limiting, and the endpoint doubles as a credential oracle whose users_id field (1 vs 0) discloses password validity even though the message always reads 'Invalid credentials'. No public exploit identified at time of analysis, and no vendor-released patch is available.
Sensitive field disclosure in ash_lua (versions 0.1.0 through 0.2.0) allows any actor who can submit a Lua script to read Ash resource attributes that are deliberately excluded from the manifest's exposed-field allow-list - including sensitive?: true columns such as hashed passwords. The operation aggregate path in AshLua.Runtime resolved field names directly via String.to_existing_atom and Ash.Query.Aggregate.new! without invoking the same AshLua.Fields.for_action/4 allow-list check enforced by the normal field-read path, creating an alternate route to private data. Vendor patch 0.2.1 is confirmed available; no CISA KEV listing or independent exploit beyond the PoC embedded in the security advisory has been identified.
Unauthenticated arbitrary file read in the surya 0.22.1 screenshot server allows any network-reachable attacker to exfiltrate image and PDF files from the host filesystem by supplying attacker-controlled paths to three unprotected HTTP routes. The /info, /page, and /process endpoints pass raw file_path parameters directly to Pillow's Image.open and pypdfium2.PdfDocument, returning rendered file contents as base64-encoded HTTP responses. The /info route additionally acts as a file-existence oracle, enabling systematic enumeration of host paths before targeted exfiltration; no public exploit has been identified at time of analysis.
Unauthenticated SQL injection in WWBN AVideo's channels API endpoint allows remote attackers to extract password hashes and account recovery tokens without any credentials. The `sort` column parameter in `get.json.php?APIName=channels` is injected directly into a SQL ORDER BY clause unsanitized, enabling an ordering oracle attack to infer sensitive column values character-by-character and triggering verbose SQL errors that disclose the full query and database schema. No public exploit has been identified at time of analysis, though VulnCheck has independently reported this vulnerability with a GitHub Security Advisory published by the vendor.
Administrator account takeover in the Support Genix WordPress helpdesk plugin (all versions up to and including 1.4.52) is achievable by any subscriber-level user who can obtain a single guest ticket token, exploiting a catastrophically weak encryption key derivation that yields only ~19.5 bits of effective entropy. The `guest_ticket_login()` function at the publicly reachable `/sgnix/?p=<token>` endpoint lacks capability checks, nonce validation, and session controls, allowing an attacker to exhaustively recover the site-wide AES-256-CBC key offline across ~729,000 candidates and forge an admin-authentication token. No public exploit has been identified at time of analysis, but the attack is technically straightforward given the tiny keyspace, deterministic IV construction, and unauthenticated endpoint exposure.
Unauthenticated stream credential disclosure in AVideo (WWBN, commit e01e41ecc and earlier) lets remote attackers retrieve any user's restream stream_key and stream_url for external platforms like YouTube, Facebook, and Twitch. The getLiveKey.json.php endpoint accepts a 'token' parameter that bypasses both the Live::canRestream() access gate and the restream ownership check, and the token is merely AES-256-CBC encryptString() of an integer id with no user binding, expiry, or authentication tag. Because a public encryption oracle (view/url2Embed.json.php) lets anyone encrypt arbitrary values, valid tokens can be forged with no authentication; no public exploit is identified at time of analysis but the technique is fully described.
Blind SQL injection in WsgiDAV's MySQLBrowserProvider sample module (versions <= 4.3.4) allows unauthenticated network attackers to read arbitrary data from the backing MySQL database via URL path manipulation. The record key segment of the URL is concatenated directly into a WHERE clause without escaping, enabling a boolean status-code oracle that supports full character-by-character data extraction. A secondary typo in the numeric-type check (`INTT` instead of `INT`) ensures all primary key types take the vulnerable quoted branch, and a working PoC with complete extraction script has been publicly confirmed. No public exploit identified as confirmed actively exploited (CISA KEV), but the PoC lowers the exploitation bar significantly.
Unauthenticated content exfiltration in Trilium up to 0.103.0 is possible through the public share-search endpoint, which applies authorization only to the ancestor note supplied in the request rather than to each result it returns. Any visitor with HTTP access to the instance can query `/share/api/notes` to enumerate titles, tree paths, and share identifiers of notes protected by `shareCredentials` passwords or hidden via `shareHiddenFromTree`, and can use the endpoint as a boolean substring oracle to iteratively reconstruct the full plaintext of password-gated notes. No public exploit has been identified at time of analysis, and the issue is patched in version 0.104.0.
CPU-exhaustion denial of service in netty-incubator-codec-ohttp's BinaryHttpParser permanently pins Netty event-loop threads at 100% CPU via an infinite loop in field-section decoding, reachable by any unauthenticated remote attacker. Because OHTTP gateways publish their HPKE public key by design, an attacker can encrypt a crafted ~17-byte Binary HTTP payload as a cryptographically valid OHTTP request, which passes decryption and reaches the vulnerable parser without any authentication barrier. A handful of such requests exhausts the entire fixed-size Netty event-loop thread pool, rendering the gateway or client fully offline until the process is restarted; no public exploit identified at time of analysis, though an empirically-reproduced proof-of-concept is documented in the advisory.
Remote privilege escalation in Ceph RADOS Gateway (RGW) allows any holder of a valid STS session token - regardless of privilege level - to forge administrative credentials by exploiting unauthenticated AES-128-CBC encryption. By applying a deterministic CBC bit-flip to the acct_type, perm_type, and is_admin fields of their own token, an attacker can trigger a global authorization override that bypasses all RGW capability checks, yielding full administrative control over all objects and buckets in the cluster. No public exploit has been identified at time of analysis; however, the attack is self-contained, requires no encryption oracle, and is reachable over the standard RGW S3 endpoint, making it highly accessible to any user with STS access. Fixed versions 19.2.6 and 20.2.4 are confirmed released.
Unauthenticated remote exploitation of Oracle Helidon 3.2.20's Imperative Web Server component enables attackers to perform unauthorized creation, deletion, or modification of critical data via HTTP with no prerequisites. The vulnerability carries a scope change (S:C in CVSS), meaning successful exploitation can cascade to impact additional products or systems beyond Helidon itself. Tagged as an authentication bypass, this is classified by Oracle as easily exploitable with no public exploit identified at time of analysis.
Unauthorized data access in Oracle Helidon 4.5.0 exposes all data reachable through the Imperative Web Server component to unauthenticated remote attackers over HTTP. Tagged as an authentication bypass, the flaw allows complete confidentiality compromise - an attacker can read critical or all accessible application data without supplying credentials. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is trivially executable from any network position.
Remote denial-of-service and partial data exposure in Oracle Helidon 4.5.0 allows unauthenticated network attackers via HTTP/2 to cause a complete hang or crash of the Helidon Imperative Web Server, alongside unauthorized read access to a subset of accessible data. The vulnerability is classified as easily exploitable with no authentication, user interaction, or special configuration required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a realistic denial-of-service threat against any exposed Helidon 4.5.0 deployment.
Remote denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated network attackers to hang or repeatedly crash the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, zero-prerequisite exploitation against any reachable instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this a credible threat to internet-facing deployments.
Denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated remote attackers to crash or indefinitely hang the service via crafted HTTP/2 traffic. Disclosed as part of Oracle's Critical Security Patch Update (CPU) for August 2026, the vulnerability is rated CVSS 7.5 with low attack complexity and no privileges required, making automated exploitation straightforward against any exposed instance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service in Oracle Helidon 3.2.19's Imperative Web Server allows unauthenticated network attackers to hang or crash the server entirely via HTTP/2 traffic. The CVSS 3.1 score of 7.5 reflects the low attack complexity and complete availability impact, with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers with HTTP network access to perform unauthorized read, write, and partial denial-of-service operations against data accessible to the service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is easily exploitable with no prerequisites, though impacts are bounded to partial CIA effects within the unchanged scope of the Helidon instance. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows network attackers over HTTP to achieve partial confidentiality disclosure, data manipulation, and denial of service - with a confirmed scope change indicating the impact can extend to components beyond Helidon's own security boundary. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) places this among the most easily reachable vulnerability classes: no credentials, no user interaction, and no elevated complexity required. Disclosed in Oracle's August 2026 Critical Security Patch Update, no public exploit code or CISA KEV listing has been identified at time of analysis.
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attacker send HTTP requests that grant high-integrity write access to Helidon-accessible data, partial read disclosure, and a partial denial of service - with impact that can extend beyond Helidon into adjacent products. Rated CVSS 3.1 9.9 due to the scope change combined with easy, no-privilege network exploitation. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated network exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows remote attackers to partially compromise confidentiality, integrity, and availability of the affected system, with a confirmed scope change meaning attacks can extend impact to additional co-located products or services. The vulnerability is rated 8.3 (High) under CVSS 3.1, elevated by the scope change despite individually low CIA impact ratings. No public exploit code has been identified at time of analysis, and Oracle disclosed this through its August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers to bypass authentication controls via HTTP, resulting in unauthorized read access to a subset of application data and the ability to insert, update, or delete accessible records. The CVSS scope change (S:C) indicates successful exploitation can affect additional systems beyond the Helidon instance itself - a compounding factor in microservices topologies where Helidon acts as a gateway or intermediary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated, low-complexity attack path makes this credible against any internet-exposed deployment.
Denial-of-service in Oracle Helidon 3.2.20 (Imperative Web Server component) allows unauthenticated remote attackers to repeatedly crash or indefinitely hang the server via crafted HTTP requests. The vulnerability is rated CVSS 7.5 with no authentication, no user interaction, and low attack complexity, making it trivially exploitable at scale against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ease of exploitation and complete availability impact warrant prompt patching.
Unauthenticated remote exploitation of Oracle Helidon 1.4.19's Imperative Web Server component via HTTP allows attackers to perform unauthorized creation, deletion, and modification of critical application data, with partial read access to Helidon-accessible data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero barriers to exploitation - no credentials, no user interaction, and low attack complexity over standard HTTP. Reported via Oracle's Critical Patch Update for August 2026 and tagged as an Authentication Bypass, with no public exploit code or CISA KEV listing identified at time of analysis.
Authentication bypass in Oracle Helidon 1.4.19 (Imperative Web Server component of Oracle Fusion Middleware) lets a remote, unauthenticated attacker reach and manipulate protected data over HTTP, yielding full read and write access to all data the Helidon instance can reach. Oracle rates it CVSS 9.1 with High confidentiality and integrity impact and no availability impact, and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Helidon 1.4.19 (Imperative Web Server component) lets a remote attacker send crafted HTTP requests to read, create, modify, or delete all Helidon-accessible data. Oracle rates it CVSS 3.1 9.1 (high confidentiality and integrity impact, no availability impact) and classifies it as an authentication-bypass-class flaw. No public exploit identified at time of analysis, but the low attack complexity and no-authentication requirement make it a high-priority patch item once Oracle's fix is applied.
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthenticated attacker with network access over HTTP to fully compromise the affected instance. The flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity and availability, and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is not yet confirmed in the wild.
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach critical data and disrupt service over plain HTTP with no credentials and no user interaction. Oracle rates it CVSS 3.1 9.4, reflecting high confidentiality and integrity impact plus partial denial of service, and it was disclosed in the Oracle Critical Patch Update of August 2026. No public exploit identified at time of analysis, but the trivial exploitability and unauthenticated network reach make it a top-tier patch priority.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows network-adjacent attackers to partially compromise confidentiality, integrity, and availability via standard HTTP. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms zero authentication or user interaction is required, and attack complexity is low - meaning successful exploitation demands minimal attacker skill or infrastructure. Disclosed through Oracle's Critical Patch Update for August 2026, no public exploit code has been identified at time of analysis, though the low-barrier network vector warrants prompt remediation for any internet-exposed Helidon deployment.
Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the Helidon application via a flaw in the Imperative Web Server component. Oracle rates it CVSS 9.1 (high confidentiality and integrity impact, no availability impact), and the vendor tag 'Authentication Bypass' indicates protected routes/resources can be reached without credentials. No public exploit identified at time of analysis; addressed in the Oracle Critical Patch Update of August 2026.
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) allows a network attacker to read, create, modify, or delete all data accessible to the framework over HTTP. Tagged by Oracle as an authentication bypass, it carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact and no availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but Oracle rates it as easily exploitable, warranting prompt patching.
Remote denial-of-service in Oracle Helidon 4.5.0 Imperative Web Server allows unauthenticated network attackers to cause a persistent hang or repeated crash of the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with no authentication or user interaction required, making this reliably triggerable against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity means operational risk for teams running Helidon 4.5.0 in production microservice environments is meaningful.
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server component over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw yields full compromise of confidentiality, integrity, and availability (CVSS 9.8) without credentials or user interaction. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing profile makes it a high-priority patch.
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated, network-adjacent attackers to read critical application data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial exploitability with no authentication or user interaction required. Classified under the Authentication Bypass tag by Oracle, this vulnerability is covered in the Oracle Critical Patch Update for August 2026, with no public exploit code or CISA KEV listing identified at time of analysis.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to access critical or all Helidon-accessible data via HTTP. The vulnerability is tagged as an authentication bypass, consistent with the CVSS vector showing no privileges or user interaction required (PR:N/UI:N) and a high confidentiality impact. Disclosed as part of Oracle's Critical Patch Update for August 2026, no public exploit or CISA KEV listing has been identified at time of analysis.
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imperative Web Server component, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects easy exploitation with no privileges or user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in Oracle Helidon 4.5.1 (Imperative Web Server component) exposes applications to unauthenticated remote attackers who can create, modify, or delete critical data accessible to the service via standard HTTP requests. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 7.5, reflecting a network-accessible, zero-complexity attack requiring no credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Patch Update.
Unauthenticated remote denial-of-service in Oracle Helidon 3.2.19 allows a network attacker to hang or crash the Imperative Web Server component via crafted HTTP requests, causing complete loss of service availability. The vulnerability requires no privileges, no user interaction, and is reachable over standard HTTP, making it trivially exploitable against any exposed Helidon 3.2.19 instance. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to perform unauthorized read access to a subset of data, unauthorized data modification, and partial denial of service - all without credentials or user interaction. Oracle classifies this as 'easily exploitable' in its August 2026 Critical Patch Update advisory. No public exploit identified at time of analysis, but the low attack complexity and network accessibility make this a straightforward target for opportunistic attackers.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to read a subset of accessible data, perform unauthorized write/modify operations, and cause a partial denial of service. The CVSS vector confirms network accessibility with no authentication, no user interaction, and low attack complexity, making this easily exploitable against exposed deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial exploitation conditions warrant prompt patching.
Remote denial-of-service in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network attackers to crash or indefinitely hang the server by sending crafted HTTP/2 traffic. The vulnerability carries a CVSS 7.5 rating with low attack complexity and no credential or interaction requirement, making it trivially scriptable from any network-accessible position. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Unauthenticated remote access to sensitive data affects Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2, allowing an attacker with network access to read critical or all data accessible to the Helidon application. The vulnerability is tagged as an authentication bypass, consistent with the CVSS vector showing no privileges or user interaction required. No public exploit identified at time of analysis, and the flaw is disclosed through Oracle's Critical Patch Update for August 2026.