Oracle
Monthly
A high-privileged attacker with network access to the Oracle Contracts module of Oracle E-Business Suite 12.2.14 or 12.2.15 can fully compromise that module, affecting confidentiality, integrity, and availability. The flaw sits in the Internal Operations component and requires an already-elevated application account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 7.2) - it is not reachable by unauthenticated or low-privileged users, and no user interaction is needed once the prerequisite access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical risk is therefore concentrated in environments where many users or service accounts already hold broad Contracts privileges.
Oracle Contracts, a module within Oracle E-Business Suite, can be fully taken over by a high-privileged attacker who can reach the application over HTTP in versions 12.2.14 and 12.2.15. Oracle's own advisory rates this 7.2 with complete confidentiality, integrity, and availability impact, and notes it is 'easily exploitable' once the attacker holds elevated privileges. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-priority issue rather than an observed campaign.
Oracle Contracts, a module within Oracle E-Business Suite 12.2.14-12.2.15, allows a low-privileged authenticated attacker with HTTP network access to take over the Contracts component, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw requires any valid low-privilege account but no user interaction or elevated rights, and it works against default configurations of the affected versions, so the primary limiting factor is obtaining an authenticated foothold on the EBS instance. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the combination of low privileges, network reach, and full component takeover places it in a high-priority tier rather than the pre-authentication maximum tier.
Oracle Work in Process, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes a flaw in its Workbenches component that lets an unauthenticated attacker on an adjacent network segment read and modify critical data without any credentials or user interaction. Per the vendor's advisory the issue is 'easily exploitable,' so anyone with a presence on the same physical communication segment as the Oracle WIP application server can tamper with or extract manufacturing/Work-in-Process records. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so confirmed active exploitation cannot be asserted at this time.
Unauthenticated denial of service combined with unauthorized data modification in the Oracle Mobile Application Server (MWA Terminal Server) component of Oracle E-Business Suite 12.2.3 through 12.2.15. A remote attacker with HTTP access can send crafted requests that hang or repeatedly crash the MWA service while also inserting, updating, or deleting some MWA-accessible data, but the attack requires a victim — not the attacker — to perform some interaction (UI:R), and Oracle's scope-change rating indicates effects can spill over to related products. Oracle rates this 8.2 High; no public exploit code and no CISA KEV listing were identified in the supplied intelligence, and no EPSS score was provided.
Unauthenticated attackers with network reach to the Mobile Application Server of Oracle E-Business Suite can fully take over the MWA Terminal Server component in supported 12.2.3 through 12.2.15 releases, gaining high impact across confidentiality, integrity and availability. Exploitation is rated high-complexity (AC:H) but requires no credentials and no user interaction, and Oracle scores it 8.1. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so the current real-world exploitation picture is unconfirmed.
Oracle E-Business Suite's Mobile Application Server (MWA Terminal Server component) in versions 12.2.3 through 12.2.15 can be fully taken over by an unauthenticated attacker who can reach the host over an adjacent network segment. The flaw is rated 7.5 with a CVSS vector of AV:A/AC:H/PR:N/UI:N and high confidentiality, integrity and availability impact, meaning an attacker positioned on the same physical communication segment as the Mobile Application Server hardware can compromise the service without credentials, though exploitation is complicated by conditions beyond the attacker's control (AC:H). Oracle has published the fix through its Critical Security Patch Update advisory; at the time of analysis there is no CISA KEV listing, no confirmed public exploit code and no EPSS score provided.
Unauthenticated remote takeover of the Oracle Mobile Application Server component (MWA Terminal Server) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by any attacker who can reach the service over TCP; the flaw is rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials or user interaction are required and confidentiality, integrity, and availability are all fully impacted. CISA's SSVC assessment rates the issue as automatable with total technical impact while indicating no observed exploitation, and no public exploit code or proof of concept has been identified at time of analysis, so the practical risk is dominated by network exposure of what is normally an internal warehouse/handheld-terminal service rather than by active attack campaigns. Prioritize hosts where the MWA Terminal Server TCP listener is reachable from untrusted networks.
Unauthenticated TCP network access to the Oracle Mobile Application Server component (MWA Terminal Server) in Oracle E-Business Suite 12.2.3 through 12.2.15 lets an attacker bypass authentication details and gain unrestricted read access to data reachable by that service while also degrading its availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:L, base 8.2) confirms no credentials or victim interaction are needed, making exploitation trivially automatable once the middle-tier service is reachable. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Oracle E-Business Suite's Demand Signal Repository component (versions 12.2.3 through 12.2.15) contains an access-control weakness that lets a low-privileged, network-positioned user reach Internal Operations functionality over HTTP and perform unauthorized creation, deletion, or modification of critical DSR data while also triggering a hang or repeated crashes for a complete denial of service. Rated CVSS 3.1 base 8.1 (AV:N/AC:L/PR:L/UI:N, Integrity and Availability High), the flaw requires a valid low-privileged account but no user interaction. There is no public exploit code identified and the issue is not listed in CISA KEV; no EPSS score was supplied with the intelligence feed.
Component takeover in Oracle E-Business Suite's Demand Signal Repository (supported releases 12.2.3 through 12.2.15) lets an authenticated, low-privileged attacker reachable over HTTP (PR:L, network vector) seize control of the affected module, with full confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). The flaw sits in the Internal Operations component of the Demand Signal Repository and requires no user interaction, making it straightforward to trigger once a valid low-privilege session or role is obtained. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the Oracle Critical Security Patch Update advisory is the only authoritative reference and no EPSS score was supplied, so real-world exploitation likelihood is unquantified. Oracle E-Business Suite operators running the affected module should treat the corresponding Critical Patch Update as the remediation path.
Oracle Demand Signal Repository, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, contains a flaw in its Internal Operations component that lets a low-privileged, authenticated user reach network-exposed HTTP functionality and read or alter data well beyond their intended authorization level. Successful exploitation yields high confidentiality and integrity impact - unauthorized creation, deletion, modification of, and full read access to, critical Demand Signal Repository data. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the low privileges required and network attack vector make it attractive for insider or compromised-account abuse.
Application takeover of the Document Management and Collaboration module in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by any authenticated low-privileged user with HTTP access, with high confidentiality, integrity and availability impact. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) because the attack is simple, needs no user interaction, and defeats the authorization boundary around the module's internal operations. No public exploit code or CISA KEV entry is identified at time of analysis, but the low privilege bar combined with broad enterprise EBS deployment makes this a patch-now item.
Oracle Document Management and Collaboration, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP. Successful exploitation grants complete control over the module's confidentiality, integrity, and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker can read, alter, or destroy managed documents and related business data. There is no CISA KEV listing, no public exploit code, and no EPSS data in the provided intelligence, so this is currently a patch-priority issue for Oracle E-Business Suite shops rather than a confirmed actively exploited threat.
Unauthenticated attackers with network access to the HTTP service can fully compromise Oracle Document Management and Collaboration (the Internal Operations component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15, achieving complete loss of confidentiality, integrity and availability - CVSS 3.1 base score 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The root cause is an authentication bypass (CWE-287), meaning no credentials, user interaction or non-default configuration are required; the only prerequisite is that the affected HTTP endpoint be reachable by the attacker, so internet-facing or broadly exposed EBS deployments carry the highest realistic risk. At time of analysis there is no confirmed active exploitation (CISA SSVC exploitation value: none) and no public exploit identified at time of analysis; CISA's SSVC assessment rates the vulnerability as automatable with total technical impact.
Authenticated takeover of Oracle Product Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker reaching the application over HTTP, with the vendor scoring it 8.5 for high confidentiality, integrity and availability impact plus a scope change that extends damage onto other EBS products. Exploitation is rated difficult (AC:H) because the attacker must satisfy specific conditions inside the Internal Operations component, and no public exploit code or CISA KEV entry has been identified at time of analysis. No EPSS score was supplied, so real-world exploitation likelihood is not independently quantified and the flaw should be treated as a patch-cycle priority rather than a confirmed emergency.
High-privileged users who can already authenticate to Oracle E-Business Suite can trigger a hard-to-reach flaw in the Bills of Material Setup Workbench component of versions 12.2.3 through 12.2.15 and take full control of that module, with the potential to pivot into other connected EBS products because of the scope change. Oracle rates the issue CVSS 3.1 base 8.0 with high confidentiality, integrity and availability impact, but exploitation is described as difficult and requires an authenticated, privileged position plus network access over HTTP. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and the only reference available is Oracle's Critical Security Patch Update advisory.
A low-privileged authenticated attacker with HTTP access to the Oracle Bills of Material module in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Bills of Material data beyond their authorization and partially degrade availability of the module, with the impact extending into other, additional Oracle products (scope change). Oracle rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) in its 2026 Critical Security Patch Update advisory, and the flaw is considered easily exploitable because it needs no user interaction or complex timing. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; no EPSS score or POC reference was supplied with the intelligence for this analysis.
Low-privileged Oracle E-Business Suite accounts can read and modify all Bills of Material data by reaching the Internal Operations component of Oracle Bills of Material over HTTP in versions 12.2.3 through 12.2.15 (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The flaw is rated easily exploitable, but it is not pre-authentication: an attacker must first hold a valid low-privileged EBS account, which is the primary limiting factor, and no user interaction or elevated privileges are needed. Impact is confined to confidentiality and integrity - creation, deletion, modification and disclosure of Bills of Material-accessible data - with availability unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Oracle Bills of Material, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations component that fails to properly restrict what a low-privileged authenticated user can do over HTTP. An attacker holding any valid low-privilege E-Business Suite account can send crafted HTTP requests that read all Bills of Material data and create, delete, or modify it, giving full confidentiality and integrity compromise of the module's records without any user interaction. At the time of analysis there is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied, so the practical near-term risk is driven by whether the target EBS instance is internet-facing or reachable from a compromised low-privilege account.
Low-privileged users of Oracle E-Business Suite 12.2.3 through 12.2.15 can read and modify critical Financials Common Modules data by sending crafted HTTP requests to a vulnerable Common Components endpoint, with no user interaction required. Oracle scores the flaw 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact. No public exploit code or CISA KEV entry has been identified at time of analysis, although the low attack complexity and the fact that only a normal authenticated session is needed make weaponization plausible and patch urgency high.
Low-privileged attackers with HTTPS network access can fully compromise the Internal Operations component of Oracle Complex Maintenance, Repair and Overhaul (CMRO) in Oracle E-Business Suite versions 12.2.3 through 12.2.15, achieving complete confidentiality, integrity, and availability impact on the affected module. The flaw carries a CVSS 3.1 base score of 8.8 and requires only an authenticated network session (PR:L) with no user interaction, making it a straightforward lateral escalation for any user holding a valid low-privilege EBS account. At time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS data provided, so risk is driven by the exposed attack surface of internet- or intranet-reachable EBS deployments rather than confirmed active exploitation.
Oracle Product Hub, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged attacker with HTTP network access take over the Product Hub application. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields high confidentiality, integrity and availability impact across the module. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, though Oracle treats this class of flaw as remotely exploitable and easily abused, making prompt patching of internet- or intranet-exposed E-Business Suite deployments important.
Oracle Product Hub, the product master-data module of Oracle E-Business Suite, fails to properly enforce authorization in its Internal Operations component across supported releases 12.2.3 through 12.2.15, allowing an attacker who already holds a high-privileged account to achieve full takeover of the module over HTTP. Successful exploitation yields complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning master data, configuration and administrative functions can be read and altered. Oracle did not publish a CWE identifier with this record, no public exploit code has been identified at time of analysis, and neither CISA KEV nor EPSS data was supplied, so active exploitation cannot be confirmed.
Takeover of Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a highly privileged authenticated attacker with network HTTP access to the Internal Operations component, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). The flaw is rated easily exploitable (AC:L, UI:N) once the required credentials are held, and no public exploit has been identified at time of analysis. Because the CVSS vector specifies PR:H, anonymous or low-privileged internet attackers are ruled out, leaving the mandatory high-privilege account as the primary gating factor.
An authentication/authorization bypass in Oracle Helidon's helidon-security-providers-idcs-mapper component (versions 3.0.0–3.2.20 and 4.0.0–4.5.4) lets a low-privileged attacker with network access over HTTP impersonate or over-privilege an identity mapped from Oracle Identity Cloud Service, gaining unauthorized read and modification access to critical application data. Oracle's advisory rates it CVSS 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact). No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, but the flaw is trivially automatable against any Helidon service that enables the IDCS mapper, so internet-facing deployments should be treated as high priority.
Improper access control in the Internal Operations component of Oracle Engineering within Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated but low-privileged attacker reaching the application over HTTP to create, delete, modify, and read critical Engineering data, with the impact extending beyond the vulnerable component (CVSS scope change). Oracle rates it 8.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), noting the attack is difficult to execute, so it is a targeted-risk issue rather than an opportunistic mass-exploitation one. No public exploit code is identified in the supplied intelligence, and the product is not listed in CISA KEV.
Unauthenticated? No — low-privileged authenticated users of Oracle Engineering, the engineering change-management module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), can read data well beyond their authorization by sending crafted HTTP requests to the Change Management component. Because the CVSS scope is marked Changed (S:C), the confidentiality loss is not confined to Engineering records — the vendor warns that attacks may significantly impact additional EBS products sharing the same database instance, yielding high (C:H) unauthorized access to critical data with no integrity or availability impact. No public exploit code or CISA KEV listing is identified in the available intelligence, and no EPSS score was supplied, so the practical risk today is driven mainly by the large authenticated user population typical of EBS deployments and the difficulty of patching ERP systems promptly.
Low-privileged users with network access to Oracle Depot Repair inside Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical repair and recall records they are not entitled to and partially degrade availability of the module by sending crafted HTTP requests to the Recall Management component. Oracle rates the flaw 7.1 using CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, meaning a valid but unprivileged account is the main barrier — no user interaction, no elevated role, and no special attack complexity. The provided intelligence contains no CISA KEV listing and no public exploit code, so exploitation is currently assessed as authenticated and targeted rather than opportunistic mass scanning.
Oracle E-Business Suite's Bills of Material module (versions 12.2.13 through 12.2.15) contains a difficult-to-exploit flaw in the Internal Operations component that lets a low-privileged, authenticated attacker with HTTP network access read and tamper with critical manufacturing data. Successful exploitation yields high confidentiality and integrity impact and, per Oracle, can spill over into other EBS modules because of a scope change, though availability is unaffected. There is no CISA KEV listing and no public exploit code identified at time of analysis; the vendor advisory is the primary source of truth.
Oracle Product Workbench, a module within Oracle E-Business Suite, permits a low-privileged attacker who already holds a valid account and HTTP network access to read, create, delete, or modify critical business data across the module's Internal Operations component, affecting supported releases 12.2.3 through 12.2.15. With CVSS 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), exploitation requires only an authenticated session rather than user interaction or a race condition. No public exploit code, POC, or CISA KEV entry has been identified at time of analysis, and no EPSS score was supplied, so the current risk is driven by the low skill barrier and the sensitivity of ERP data rather than confirmed active exploitation.
Oracle Depot Repair, a module of Oracle E-Business Suite, exposes the Estimate and Actual Charges component to a low-privileged, authenticated attacker who can reach the application over HTTP. Because the component fails to enforce proper authorization on its data operations, a successful attack grants full read and write access to charge records that the user should never be able to see or change, giving a broad confidentiality and integrity impact across all Depot Repair data. Oracle rates this 8.1 against versions 12.2.3 through 12.2.15; no public exploit code or CISA KEV entry is associated with the issue at the time of analysis, and no EPSS score was supplied with the intelligence feed.
Low-privileged users with network access to Oracle E-Business Suite's Product Workbench component (Internal Operations) can read, create, modify, and delete critical business data across the full 12.2.3–12.2.15 release range. Oracle rates this 8.1 with a network-accessible, low-complexity, no-user-interaction vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning a valid but unprivileged account is enough to reach full confidentiality and integrity impact on Product Workbench data, with no availability impact. No CISA KEV listing, no public exploit code, and no EPSS score were provided in the source data, so current exploitation activity is unconfirmed — though Oracle CPU-class issues in EBS are historically targeted by attackers who already hold a foothold account.
Oracle Demand Signal Repository, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker with network access over HTTP, leading to unauthorized read, creation, deletion, or modification of the module's critical data. Oracle rates the flaw CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), meaning exploitation is straightforward but requires some level of authenticated access. There is no public exploit code identified and no CISA KEV listing at time of analysis; the vulnerability is addressed through Oracle's Critical Security Patch Update process referenced in the advisory.
Oracle E-Business Suite 12.2.3 through 12.2.15 ships a Demand Signal Repository module whose Internal Operations component fails to enforce proper authorization, letting any holder of a low-privileged account read, create, modify, or delete critical records through ordinary HTTP requests. Oracle's CVSS 8.1 rating reflects full confidentiality and integrity impact with no availability impact, and the flaw is rated easily exploitable because it needs only network reachability, no user interaction, and a low-privileged login. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so exploitation is currently a patch-window problem rather than a confirmed active campaign.
Low-privileged authenticated users of Oracle Complex Maintenance, Repair and Overhaul (CMRO) 12.2.12–12.2.15 can send crafted HTTP requests to the Internal Operations component to gain unauthorized access to critical data and partially degrade availability, with the CVSS scope-change flag indicating impact can extend to other Oracle E-Business Suite modules. Oracle's Critical Security Patch Update is the only remediation reference supplied; there is no EPSS score, no CISA KEV listing and no public exploit evidence in the provided intelligence, so the issue is currently a patch-now hygiene item rather than a confirmed actively exploited threat.
Unauthenticated attackers with HTTP access to Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 can read the full contents of data reachable through the product's HTTP interface, including critical application data. The flaw is fully remote and requires no credentials or user interaction (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N), and Oracle classifies it as easily exploitable while impacting confidentiality only. No public exploit code has been identified and the issue is not listed in CISA KEV, but Oracle has published a fix through its Critical Patch Update program.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Fusion Middleware Security Framework component that lets a low-privileged attacker who can reach the IDE over HTTP achieve a full takeover of the product, with high confidentiality, integrity, and availability impact. Oracle rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation needs a valid low-privilege account but no user interaction or elevated privilege. There is no public exploit code identified and no CISA KEV listing at time of analysis, and no EPSS score was supplied, so the immediate operational risk is driven mainly by exposure of JDeveloper HTTP services rather than by observed exploitation.
Unauthenticated remote attackers can obtain complete read and write access to Oracle Identity Manager's OIM Legacy UI component in supported versions 12.2.1.4.0 and 14.1.2.1.0, enabling unauthorized creation, deletion and modification of critical identity data as well as full disclosure of OIM-accessible data (CVSS 3.1 base score 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The decisive limiting factor is the UI:R requirement: a legitimate OIM user or administrator must be induced to interact with attacker-supplied content over HTTP, which makes this a targeted social-engineering vector rather than a fully automated one, and there is no availability impact. No public exploit has been identified at time of analysis, and Oracle published the issue as part of its September 2026 Critical Patch Update, which is the authoritative remediation source; the issue is tracked in the EU as EUVD-2026-79722.
Local low-privileged users who can log on to hosts running Oracle PeopleSoft Enterprise FIN Engineering Brazil 9.1 can fully take over the affected Engineering component, with high impact to confidentiality, integrity and availability. Oracle's advisory assigns a base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the flaw is trivially exploitable once any valid low-privilege logon on the infrastructure is obtained - no user interaction and no elevated privileges are required. There is no public exploit code or CISA KEV listing identified at time of analysis, so the immediate risk is concentrated in environments where untrusted or over-privileged users share the PeopleSoft application or database host.
Authentication bypass in Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) versions 26.1.200 and 25.2.201 lets a low-privileged attacker with network access over HTTP read and modify critical SEPP data, with the flaw's scope change (S:C) extending impact to interconnected network functions. The attacker must already hold some valid, low-privileged identity and overcome non-trivial exploitation conditions (CVSS 8.2, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), so this is not an anonymous drive-by. No public exploit code and no CISA KEV listing were provided in the intelligence feed at time of analysis.
Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) versions 26.1.200 and 25.2.201 are exposed to an unauthenticated, low-complexity attack launched from the adjacent network segment on which the SEPP host resides. A successful exploit gives the attacker high-impact read access to critical SEPP data plus limited ability to modify or delete that data (CVSS 3.1 base 7.1, AV:A/AC:L/PR:N/UI:N/C:H/I:L/A:N), which in a 5G roaming architecture could mean exposure of inter-PLMN signaling and subscriber-adjacent metadata. No public exploit code and no CISA KEV entry were identified in the available data, so exploitation is currently assessed as opportunistic rather than confirmed in the wild, and the primary exposure is limited to deployments where untrusted parties can reach the SEPP's network segment.
Oracle Coherence (Core component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 can be fully taken over by a low-privileged attacker who can reach the HTTP interface, per Oracle's Critical Security Patch Update. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N, C/I/A all High) confirms a network-reachable but difficult-to-exploit flaw that yields complete compromise of the data grid rather than a limited data leak. No CISA KEV listing, public exploit code, or EPSS score is present in the supplied intelligence, so no public exploit identified at time of analysis and active exploitation is unconfirmed.
Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a flaw in the Core component that allows a low-privileged attacker with TCP network access to create, delete, or modify critical clustered data and to read all data accessible to Coherence. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) yields a base score of 8.1, reflecting complete confidentiality and integrity loss with no availability impact and no user interaction. No public exploit code and no CISA KEV entry were present in the supplied intelligence at time of analysis, so exploitation status remains unconfirmed rather than actively exploited.
Full compromise of Oracle Coherence is achievable by low-privileged attackers who can reach the Coherence Core HTTP interface, affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 of the Oracle Fusion Middleware product. Successful exploitation gives complete loss of confidentiality, integrity and availability — Oracle describes the outcome as "takeover of Oracle Coherence" — with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was supplied with the source data, so the practical urgency currently rests on the size of the exposed Coherence estate rather than on observed exploitation.
Oracle Coherence, Oracle's in-memory data grid shipped as part of Fusion Middleware, can be fully taken over by a low-privileged attacker who can reach the cluster over the network in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The flaw sits in the Core component and is rated by Oracle as easily exploitable — CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — with confidentiality, integrity and availability all fully impacted, meaning compromise of the Coherence cluster rather than a narrow data leak. No EPSS score, CISA KEV entry or public exploit code was provided with this record; the only authoritative source is Oracle's Critical Security Patch Update advisory, so treat exploitation status as unconfirmed (no public exploit identified at time of analysis).
Oracle's Enterprise Command Center (ECC) Framework in Oracle E-Business Suite V16 exposes sensitive data to any authenticated low-privileged user who can reach the HTTP interface, because the component fails to enforce proper access controls on data it serves. Successful exploitation yields high confidentiality impact on the ECC Framework and can extend beyond it (scope change) to connected E-Business Suite components, though integrity and availability are unaffected. No public exploit code or CISA KEV entry was present in the provided intelligence at time of analysis, but the attack requires only a valid low-privilege account and a network path to the application, which Oracle itself characterizes as easily exploitable.
Authentication bypass in the Metrics component of Oracle Enterprise Manager for Fusion Middleware (versions 13.5 and 24.1) allows a remote, unauthenticated attacker with HTTP access to the management console to take over the affected deployment, with total loss of confidentiality, integrity and availability, and an assessed CVSS of 9.8. The root cause is CWE-287 (Improper Authentication), and the exploitation prerequisites assessed from the CVSS vector (AV:N/AC:L/PR:N/UI:N) are effectively none beyond network reachability - no credentials, no user interaction and no non-default configuration are required. No public exploit code has been identified and there is no confirmed active exploitation at time of analysis; no EPSS score was supplied, so the dominant real-world risk factor is whether the EM console is exposed, since these consoles are frequently segmented to internal networks.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 can be taken over by a low-privileged local attacker with logon access to the host infrastructure, allowing complete compromise of the Content Server component's confidentiality, integrity, and availability. The flaw is easily exploitable given local access and a valid account, but no public exploit or active exploitation has been identified at time of analysis. This is a locally-scoped critical-impact issue, not a remote-drive-by vulnerability.
Oracle XML Gateway, a module delivered with Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an install-related component that a low-privileged, network-positioned attacker can abuse over HTTP to read data the account should never reach — up to the full set of XML Gateway-accessible data — and to degrade service availability. Oracle rates it 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), meaning the confidentiality hit is total for that module while the availability impact is only partial and there is no integrity impact. There is no public exploit code and no CISA KEV listing at time of analysis, and no EPSS score was supplied, so this reads as a patch-cycle obligation rather than an emergency — but the Oracle CPU reference (cspusep2026) is the authoritative fix source.
Unauthenticated database takeover is possible in Oracle Database Server RDBMS releases 23.4.0 through 23.26.3 via crafted traffic sent to the Oracle Net listener. Per the Oracle-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), an attacker with network reachability can fully compromise confidentiality, integrity and availability of the RDBMS without credentials or user interaction, though Oracle characterizes the flaw as 'difficult to exploit' (AC:H). There is no public exploit code and no CISA KEV listing at time of analysis, so this is a patch-now enterprise hygiene issue rather than a confirmed active campaign.
Unauthenticated attackers with network reachability to the Oracle Net listener can hang or repeatedly crash Oracle Net Services on Oracle Database Server, cutting off client connectivity to the database. The affected releases are 21.3 through 21.23 and 23.4.0 through 23.26.3, and the flaw affects availability only — confidentiality and integrity are untouched. Oracle scores it 7.5; no public exploit code, EPSS value, or CISA KEV entry was supplied with this record, so active exploitation is unconfirmed.
Unauthenticated denial of service in Oracle Net Services, the networking component bundled with Oracle Database Server, allows a remote attacker who can reach the Oracle Net listener to hang or repeatedly crash the service. Affected releases are Oracle Database 19c (19.3-19.32), 21c (21.3-21.23) and 23ai (23.4.0-23.26.3), with a CVSS 3.1 base score of 7.5 driven purely by availability impact. There is no CISA KEV listing and no public exploit code identified at time of analysis, but the attack is network-reachable, low-complexity and requires no credentials, so any database listener exposed to untrusted networks is at risk.
Oracle Database Server's RDBMS engine can be fully compromised by any database account holding the CREATE DATABASE LINK privilege, affecting releases 19.3–19.32, 21.3–21.23 and 23.4.0–23.26.3. The flaw is reachable over Oracle Net with no user interaction and yields complete confidentiality, integrity and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N), i.e. full takeover of the RDBMS rather than a narrow data leak. Oracle has published a fix through its security advisory referenced by NVD; no public exploit code, EPSS score or CISA KEV entry was supplied, so there is no evidence of active exploitation at time of analysis.
Improper access control in the Install component of Oracle XML Gateway within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with network access over HTTP read all data the XML Gateway can reach and partially degrade its availability. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), meaning exploitation is straightforward once a valid low-privilege account exists, but it is not unauthenticated. No public exploit code has been identified and the issue is not listed in CISA KEV; Oracle addresses it in its September 2026 Critical Security Patch Update.
Takeover of the Oracle Identity Manager Connector (component: Database Application Table) in Oracle Fusion Middleware is possible for a high-privileged attacker who can reach the affected HTTP interface, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Oracle rates the flaw 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker who already holds elevated privileges can fully compromise confidentiality, integrity and availability of the connector with no user interaction and low attack complexity. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV), though it was published within Oracle's scheduled Critical Patch Update cycle.
Unauthenticated remote attackers can reach the System Wide component of Oracle Utilities Network Management System over HTTP and obtain high-impact read access to critical data, plus limited ability to modify records, across supported releases 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3. Oracle rates the issue 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), meaning no credentials, no user interaction and no unusual conditions are needed to attempt exploitation. It is tagged as an authentication bypass, but no public exploit code, EPSS score or CISA KEV entry was supplied with this report, so active exploitation is unconfirmed at time of analysis.
Local privilege escalation in Oracle Utilities Network Management System (NMS) allows any attacker holding a low-privileged logon on the host where the product executes to take over the affected application, with full loss of confidentiality, integrity and availability. The flaw spans the entire supported release line, from 2.4.0.1.0 through 2.4.0.1.33, 2.5.0.1.0-2.5.0.1.19, 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3, so virtually every deployed version is affected until the Vendor-released patch per the Oracle Critical Security Patch Update is applied. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and absence of user interaction make the flaw attractive once an attacker already has a foothold on the utility server.
An unauthenticated remote attacker with HTTP access to the Oracle Applications Manager component of Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical configuration and management data without supplying credentials. The flaw lives in the Command Line - RapidClone component and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact). No public exploit code, EPSS score, or CISA KEV listing was supplied in the input, so active exploitation is unconfirmed, but the zero-privilege, zero-interaction network vector makes this a high-value target for opportunistic scanning of internet-facing EBS deployments.
Oracle Identity Manager (OIM) releases 12.2.1.4.0 and 14.1.2.1.0, shipped as part of Oracle Fusion Middleware, contain a flaw in the Security component that lets an attacker holding a low-privileged account reach the application over HTTP and take full control of the identity platform. Oracle rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting complete loss of confidentiality, integrity and availability with no user interaction required. No public exploit code or CISA KEV entry was available at time of analysis, so exploitation is assessed as plausible but not yet observed in the wild.
Unauthenticated HTTP exploitation of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can lead to full takeover of the application. The vulnerability resides in the Client Bundle component and is easily exploitable over the network without credentials. No public exploit or CISA KEV listing was identified in the provided data.
Authenticated, low-privileged network attackers can achieve full takeover of Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 through the Oracle Diagnostics Interfaces component, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is network-reachable over HTTP, requires only a low-privileged account and no user interaction, and is not pre-authentication, so exposure is greatest where many low-trust users can authenticate or where the EBS instance is internet-accessible. No public exploit code has been identified at time of analysis and EPSS is 0.45% (38th percentile); Oracle addresses the flaw in its September 2026 Critical Patch Update.
A locally exploitable privilege-escalation vulnerability in the Remote Diagnostic Agent component of Oracle Middleware Common Libraries and Tools (Oracle Fusion Middleware) allows any low-privileged user with a logon on the host to fully compromise the affected middleware installation. Successful exploitation results in complete loss of confidentiality, integrity, and availability — effectively a full takeover — across versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit code has been identified and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant or shared-host deployments where untrusted users already have accounts.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (Analytics Server component) lets any low-privileged user who can log on to the host where the service runs take full control of the BI platform. Both supported branches - 8.2.0.0.0 and 26.01.0.0.0.0 - are affected, with a CVSS 3.1 base score of 7.8 reflecting complete loss of confidentiality, integrity and availability. Oracle addressed it in its Critical Patch Update (cspusep2026); no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated low-privileged users can fully compromise Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 26.01.0.0.0 by sending crafted HTTP requests to the Analytics Server component, obtaining complete control over confidentiality, integrity, and availability of the platform. Oracle rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the only real prerequisite is a valid low-privilege account and network reachability to the HTTP interface. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so the immediate risk is driven by the severity of a successful takeover rather than confirmed in-the-wild activity.
Unauthenticated network attackers can exploit a hard-to-trigger flaw in the Web Services Security component of Oracle Web Services Manager 12.2.1.4.0 and 14.1.2.0.0 to read all data the service can access and to repeatedly hang or crash it. Oracle rates the issue 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H), reflecting high confidentiality and availability impact offset by high attack complexity and no integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and no CWE classification was supplied.
Unauthenticated remote attackers can repeatedly hang or crash Oracle Net Services — the TNS-based networking layer of Oracle Database Server versions 23.4.0 through 23.26.3 — by sending crafted traffic over Oracle Net, producing a complete denial of service for database connectivity. The flaw carries a CVSS 3.1 base score of 7.5 with a network, low-complexity, no-privileges, no-user-interaction vector, so it is trivially automatable once the listener is reachable. No public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at the time of analysis.
Oracle E-Business Suite versions 12.2.9 through 12.2.15 ship a flaw in the Oracle Applications Framework Personalization component that lets a low-privileged authenticated user reach data and functionality they should not be able to touch, via ordinary HTTP requests. Successful exploitation yields high-impact confidentiality loss (read access to critical application data) plus limited integrity impact (unauthorized insert, update or delete of some records); availability is unaffected. Oracle rates it 7.1 on CVSS 3.1, and no public exploit code or active exploitation has been reported at time of analysis.
Authenticated low-privileged users can fully compromise the Oracle Applications Framework (Personalization) component of Oracle E-Business Suite 12.2.9 through 12.2.15 by sending crafted HTTP requests, achieving complete loss of confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Oracle rates the flaw as easily exploitable with no user interaction, and the impact is described as full takeover of the Applications Framework rather than simple data exposure. No public exploit code or CISA KEV listing was identified at time of analysis, and remediation is available through Oracle's Critical Security Patch Update (cspusep2026).
Denial of service in Oracle Helidon versions 4.0.0 through 4.5.4 allows an unauthenticated remote attacker to hang or repeatedly crash the server by sending crafted traffic to the WebSocket component over HTTP. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N, availability impact only) and Oracle's own advisory text describes it as easily exploitable. No public exploit code and no CISA KEV listing appear in the supplied intelligence at time of analysis, but the zero-authentication, zero-complexity attack path and availability-only impact make this a low-skill, repeatable disruption vector for any internet-exposed Helidon deployment.
Oracle E-Business Suite 12.2.9 through 12.2.15 contain a flaw in the Personalization component of the Oracle Applications Framework that lets a low-privileged user with HTTP network access take full control of the framework, with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). Exploitation is rated 'easily exploitable' by the vendor because it requires no user interaction and no special complexity — only a valid low-privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation status is currently unconfirmed. The vendor has published an out-of-band Critical Security Patch Update covering this issue; organizations running affected EBS releases should treat patching as urgent because the pre-authentication barrier is only a low-privilege login.
Authenticated high-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can fully take over the Oracle Applications Framework Personalization component, with high impact to confidentiality, integrity and availability. The flaw scores 7.2 on CVSS 3.1 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and low attack complexity once an attacker already holds a privileged EBS account. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so the practical risk is dominated by the credential-privilege precondition rather than by mass exploitation.
Improper authentication in the Personalization component of Oracle Applications Framework (Oracle E-Business Suite 12.2.3 through 12.2.15) lets an unauthenticated remote attacker reach the SOAP interface and take over the framework, with full confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). CISA's SSVC assessment rates the technical impact as total and the vulnerability as automatable, meaning exploitation could be scripted and scaled once a target is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven mainly by whether an organisation exposes EBS SOAP endpoints to untrusted networks.
Unauthenticated attackers with network access can read critical data from the Open Integration component of Oracle Siebel CRM Integration in versions 25.12 through 26.7 by sending crafted HTTP requests, because the component fails to enforce authentication on its integration interfaces. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), making it trivially automatable against any reachable deployment. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle has published a Critical Security Patch Update covering the affected releases.
High-privileged users of Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) can exploit a flaw in the Platform Security component over HTTP to take complete control of the BI platform. The vendor rates this CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a highly privileged account but needs no user interaction and faces low attack complexity, with full confidentiality, integrity and availability impact. No public exploit code or CISA KEV entry is identified in the available data, and EPSS scoring was not supplied, so real-world exploitation activity is unconfirmed at time of analysis.
Oracle Business Intelligence Enterprise Edition (BI Platform Security component) versions 8.2.0.0.0 and 26.01.0.0.0 contain a difficult-to-exploit flaw that lets a low-privileged, authenticated attacker reach the BI platform over HTTP and gain unauthorized create, delete, or modify access to critical BI data, plus read access to a subset of it. Oracle's own CVSS 3.1 rating is 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N), with the scope change indicating successful attacks can also affect connected products. No EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so exploitation is currently assessed as theoretical rather than observed.
A hard-to-exploit local vulnerability in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 (Oracle Analytics, Platform Security component) lets a low-privileged user who can already log on to the host running the platform take full control of the BI service, with knock-on impact to connected products because the vulnerable component operates with changed scope. The attacker must additionally induce a separate legitimate user to perform an action (UI:R) and clear a high attack-complexity bar (AC:H), so exploitation is neither trivial nor remote. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; Oracle shipped the fix in its Critical Security Patch Update advisory (cspusep2026).
Attackers who already hold an elevated account on Oracle Business Intelligence Enterprise Edition can fully take over the platform by sending crafted HTTP requests to its Platform Security component, impacting confidentiality, integrity and availability of the whole deployment. Supported versions 8.2.0.0.0 and 26.01.0.0.0 are affected, and Oracle delivered the fix through its out-of-band critical security patch update. No public exploit code or CISA KEV entry has been identified at time of analysis, so the practical risk is driven by the high-privilege prerequisite rather than by active exploitation.
Oracle Business Intelligence Enterprise Edition (BI EE) versions 8.2.0.0.0 and 26.01.0.0.0 contain an easily exploitable flaw in the Analytics Actions component that lets a low-privileged, HTTP-reachable user read critical data and tamper with a subset of stored data, with the impact extending beyond the BI EE instance itself (CVSS scope change). Oracle rates it 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and the vulnerability is addressed in the April 2026 Critical Security Patch Update. No public exploit code has been identified and the issue is not listed in CISA KEV, so risk is driven by exposure of BI EE endpoints to authenticated internal or external users.
Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 expose an Administration component flaw that lets a low-privileged, network-connected user leverage another person's interaction to read or modify report data — including data belonging to products outside BI Publisher itself, per the CVSS scope-change metric. Oracle rates the issue 7.6 with high confidentiality impact and low integrity impact, and no availability impact. No EPSS score, CISA KEV listing or public proof-of-concept was included in the provided intelligence, so no public exploit is identified at time of analysis; remediation is via Oracle's September 2026 Critical Security Patch Update advisory.
Unauthorized access to critical data in Oracle BI Publisher 12.2.1.4.0 allows a low-privileged attacker with network reachability to the SOAP-based Web Service API to read data that should be outside their authorization. Because the flaw carries a scope change (S:C), compromised BI Publisher data can extend to other Oracle Analytics components that trust the service. No public exploit code and no CISA KEV listing were identified at time of analysis; the issue is addressed only through Oracle's Critical Patch Update cycle.
A difficult-to-exploit flaw in the Administration component of Oracle BI Publisher lets a low-privileged, authenticated attacker who can reach the server over HTTP take complete control of the platform, with high confidentiality, integrity and availability impact. Affected releases are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, as listed in Oracle's Critical Security Patch Update (cspusep2026). There is no CISA KEV listing, no referenced public exploit code and no EPSS score in the supplied data, so this reads as a patch-on-cadence item rather than an emergency — though the outcome is full platform takeover.
Local privilege escalation in the Installation component of Oracle Business Intelligence Enterprise Edition lets any low-privileged user who can log on to the host running the product take full control of the BI platform, affecting versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. With complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8), the flaw is attractive as a post-compromise escalation step, but it is not network-reachable and requires an existing OS-level account on the infrastructure. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and no EPSS data was supplied to gauge mass-exploitation likelihood.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 allows an attacker who already holds a low-privileged logon on the host running the platform to take full control of the BI EE deployment, with high confidentiality, integrity and availability impact across the Platform Security component. Oracle rates the flaw 7.0 (AV:L/AC:H/PR:L/UI:N), reflecting that exploitation is difficult and confined to the local host rather than reachable over the network. No public exploit code or evidence of active exploitation was identified in the supplied intelligence at time of analysis.
Oracle BI Publisher in Oracle Analytics (versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0) contains a flaw in the BI Platform Security component reachable over SOAP that allows a low-privileged, authenticated attacker with network access to fully take over the affected BI Publisher instance, with high confidentiality, integrity and availability impact (CVSS 8.8). Oracle characterizes the issue as easily exploitable, and the reference is the Oracle Critical Security Patch Update cspusep2026 advisory. No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis, and no EPSS score was provided.
Low-privileged remote attackers can compromise Oracle BI Publisher through its SOAP-based Web Service API, gaining unauthorized ability to create, delete or modify critical report data and to repeatedly crash the service for a complete denial of service. The affected versions are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, and the flaw carries a CVSS 3.1 base score of 8.1 (network vector, low complexity, low privileges required, no user interaction). No public exploit code has been identified and the vulnerability is not listed in CISA KEV, although enterprise reporting platforms of this kind are attractive targets once technical details become public.
Authenticated low-privileged users of Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 can read sensitive report data they should not be able to access by sending crafted HTTP requests to the BI Platform Security component. The flaw is network-reachable, low complexity, and can pivot beyond BI Publisher itself (CVSS scope change), though it affects confidentiality only — no data modification or denial of service. No CISA KEV listing, EPSS score or public exploit code was supplied at time of analysis, and Oracle has published a Critical Security Patch Update advisory covering the fix.
Oracle BI Publisher, in its E-Business Suite XDO integration component, mishandles access control in a way that lets a low-privileged user with ordinary HTTP network access read critical data — including all data the BI Publisher instance can reach — across versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. The CVSS 3.1 base score is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), reflecting confidentiality-only impact with a scope change that can spill into connected E-Business Suite products. No public exploit code was identified at time of analysis, and the CVE is not listed in CISA KEV, but the low privilege bar and network reachability make it a realistic post-authentication data-exfiltration risk rather than a theoretical one.
Oracle BI Publisher (a component of Oracle Analytics) is affected by an easily exploitable, network-reachable flaw in the BI Platform Security component across versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. A low-privileged attacker who can reach the SOAP interface can compromise the reporting platform, obtaining high-confidence read access to critical data and limited ability to modify it, with the impact spilling over into other Oracle products because the CVSS vector carries a scope change (S:C). No public exploit code or CISA KEV entry was present at time of analysis, and the vendor's own score of 8.5 reflects high confidentiality impact rather than a wormable, unauthenticated issue.
Oracle BI Publisher — the reporting and publishing component of Oracle Analytics — is exposed in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 to an easily exploitable flaw that lets a low-privileged, authenticated user reach the application over HTTP and, once a victim is persuaded to interact, obtain full read and write access to critical BI Publisher data. The CVSS 3.1 base score of 8.7 reflects high confidentiality and integrity impact plus a scope change that allows the compromise to spill over into additional, connected Oracle products. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical urgency currently rests on Oracle's criticality rating rather than observed exploitation.
A high-privileged attacker with network access to the Oracle Contracts module of Oracle E-Business Suite 12.2.14 or 12.2.15 can fully compromise that module, affecting confidentiality, integrity, and availability. The flaw sits in the Internal Operations component and requires an already-elevated application account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 7.2) - it is not reachable by unauthenticated or low-privileged users, and no user interaction is needed once the prerequisite access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical risk is therefore concentrated in environments where many users or service accounts already hold broad Contracts privileges.
Oracle Contracts, a module within Oracle E-Business Suite, can be fully taken over by a high-privileged attacker who can reach the application over HTTP in versions 12.2.14 and 12.2.15. Oracle's own advisory rates this 7.2 with complete confidentiality, integrity, and availability impact, and notes it is 'easily exploitable' once the attacker holds elevated privileges. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-priority issue rather than an observed campaign.
Oracle Contracts, a module within Oracle E-Business Suite 12.2.14-12.2.15, allows a low-privileged authenticated attacker with HTTP network access to take over the Contracts component, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw requires any valid low-privilege account but no user interaction or elevated rights, and it works against default configurations of the affected versions, so the primary limiting factor is obtaining an authenticated foothold on the EBS instance. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the combination of low privileges, network reach, and full component takeover places it in a high-priority tier rather than the pre-authentication maximum tier.
Oracle Work in Process, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes a flaw in its Workbenches component that lets an unauthenticated attacker on an adjacent network segment read and modify critical data without any credentials or user interaction. Per the vendor's advisory the issue is 'easily exploitable,' so anyone with a presence on the same physical communication segment as the Oracle WIP application server can tamper with or extract manufacturing/Work-in-Process records. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so confirmed active exploitation cannot be asserted at this time.
Unauthenticated denial of service combined with unauthorized data modification in the Oracle Mobile Application Server (MWA Terminal Server) component of Oracle E-Business Suite 12.2.3 through 12.2.15. A remote attacker with HTTP access can send crafted requests that hang or repeatedly crash the MWA service while also inserting, updating, or deleting some MWA-accessible data, but the attack requires a victim — not the attacker — to perform some interaction (UI:R), and Oracle's scope-change rating indicates effects can spill over to related products. Oracle rates this 8.2 High; no public exploit code and no CISA KEV listing were identified in the supplied intelligence, and no EPSS score was provided.
Unauthenticated attackers with network reach to the Mobile Application Server of Oracle E-Business Suite can fully take over the MWA Terminal Server component in supported 12.2.3 through 12.2.15 releases, gaining high impact across confidentiality, integrity and availability. Exploitation is rated high-complexity (AC:H) but requires no credentials and no user interaction, and Oracle scores it 8.1. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so the current real-world exploitation picture is unconfirmed.
Oracle E-Business Suite's Mobile Application Server (MWA Terminal Server component) in versions 12.2.3 through 12.2.15 can be fully taken over by an unauthenticated attacker who can reach the host over an adjacent network segment. The flaw is rated 7.5 with a CVSS vector of AV:A/AC:H/PR:N/UI:N and high confidentiality, integrity and availability impact, meaning an attacker positioned on the same physical communication segment as the Mobile Application Server hardware can compromise the service without credentials, though exploitation is complicated by conditions beyond the attacker's control (AC:H). Oracle has published the fix through its Critical Security Patch Update advisory; at the time of analysis there is no CISA KEV listing, no confirmed public exploit code and no EPSS score provided.
Unauthenticated remote takeover of the Oracle Mobile Application Server component (MWA Terminal Server) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by any attacker who can reach the service over TCP; the flaw is rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials or user interaction are required and confidentiality, integrity, and availability are all fully impacted. CISA's SSVC assessment rates the issue as automatable with total technical impact while indicating no observed exploitation, and no public exploit code or proof of concept has been identified at time of analysis, so the practical risk is dominated by network exposure of what is normally an internal warehouse/handheld-terminal service rather than by active attack campaigns. Prioritize hosts where the MWA Terminal Server TCP listener is reachable from untrusted networks.
Unauthenticated TCP network access to the Oracle Mobile Application Server component (MWA Terminal Server) in Oracle E-Business Suite 12.2.3 through 12.2.15 lets an attacker bypass authentication details and gain unrestricted read access to data reachable by that service while also degrading its availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:L, base 8.2) confirms no credentials or victim interaction are needed, making exploitation trivially automatable once the middle-tier service is reachable. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Oracle E-Business Suite's Demand Signal Repository component (versions 12.2.3 through 12.2.15) contains an access-control weakness that lets a low-privileged, network-positioned user reach Internal Operations functionality over HTTP and perform unauthorized creation, deletion, or modification of critical DSR data while also triggering a hang or repeated crashes for a complete denial of service. Rated CVSS 3.1 base 8.1 (AV:N/AC:L/PR:L/UI:N, Integrity and Availability High), the flaw requires a valid low-privileged account but no user interaction. There is no public exploit code identified and the issue is not listed in CISA KEV; no EPSS score was supplied with the intelligence feed.
Component takeover in Oracle E-Business Suite's Demand Signal Repository (supported releases 12.2.3 through 12.2.15) lets an authenticated, low-privileged attacker reachable over HTTP (PR:L, network vector) seize control of the affected module, with full confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). The flaw sits in the Internal Operations component of the Demand Signal Repository and requires no user interaction, making it straightforward to trigger once a valid low-privilege session or role is obtained. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the Oracle Critical Security Patch Update advisory is the only authoritative reference and no EPSS score was supplied, so real-world exploitation likelihood is unquantified. Oracle E-Business Suite operators running the affected module should treat the corresponding Critical Patch Update as the remediation path.
Oracle Demand Signal Repository, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, contains a flaw in its Internal Operations component that lets a low-privileged, authenticated user reach network-exposed HTTP functionality and read or alter data well beyond their intended authorization level. Successful exploitation yields high confidentiality and integrity impact - unauthorized creation, deletion, modification of, and full read access to, critical Demand Signal Repository data. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the low privileges required and network attack vector make it attractive for insider or compromised-account abuse.
Application takeover of the Document Management and Collaboration module in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by any authenticated low-privileged user with HTTP access, with high confidentiality, integrity and availability impact. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) because the attack is simple, needs no user interaction, and defeats the authorization boundary around the module's internal operations. No public exploit code or CISA KEV entry is identified at time of analysis, but the low privilege bar combined with broad enterprise EBS deployment makes this a patch-now item.
Oracle Document Management and Collaboration, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP. Successful exploitation grants complete control over the module's confidentiality, integrity, and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker can read, alter, or destroy managed documents and related business data. There is no CISA KEV listing, no public exploit code, and no EPSS data in the provided intelligence, so this is currently a patch-priority issue for Oracle E-Business Suite shops rather than a confirmed actively exploited threat.
Unauthenticated attackers with network access to the HTTP service can fully compromise Oracle Document Management and Collaboration (the Internal Operations component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15, achieving complete loss of confidentiality, integrity and availability - CVSS 3.1 base score 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The root cause is an authentication bypass (CWE-287), meaning no credentials, user interaction or non-default configuration are required; the only prerequisite is that the affected HTTP endpoint be reachable by the attacker, so internet-facing or broadly exposed EBS deployments carry the highest realistic risk. At time of analysis there is no confirmed active exploitation (CISA SSVC exploitation value: none) and no public exploit identified at time of analysis; CISA's SSVC assessment rates the vulnerability as automatable with total technical impact.
Authenticated takeover of Oracle Product Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker reaching the application over HTTP, with the vendor scoring it 8.5 for high confidentiality, integrity and availability impact plus a scope change that extends damage onto other EBS products. Exploitation is rated difficult (AC:H) because the attacker must satisfy specific conditions inside the Internal Operations component, and no public exploit code or CISA KEV entry has been identified at time of analysis. No EPSS score was supplied, so real-world exploitation likelihood is not independently quantified and the flaw should be treated as a patch-cycle priority rather than a confirmed emergency.
High-privileged users who can already authenticate to Oracle E-Business Suite can trigger a hard-to-reach flaw in the Bills of Material Setup Workbench component of versions 12.2.3 through 12.2.15 and take full control of that module, with the potential to pivot into other connected EBS products because of the scope change. Oracle rates the issue CVSS 3.1 base 8.0 with high confidentiality, integrity and availability impact, but exploitation is described as difficult and requires an authenticated, privileged position plus network access over HTTP. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and the only reference available is Oracle's Critical Security Patch Update advisory.
A low-privileged authenticated attacker with HTTP access to the Oracle Bills of Material module in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Bills of Material data beyond their authorization and partially degrade availability of the module, with the impact extending into other, additional Oracle products (scope change). Oracle rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) in its 2026 Critical Security Patch Update advisory, and the flaw is considered easily exploitable because it needs no user interaction or complex timing. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; no EPSS score or POC reference was supplied with the intelligence for this analysis.
Low-privileged Oracle E-Business Suite accounts can read and modify all Bills of Material data by reaching the Internal Operations component of Oracle Bills of Material over HTTP in versions 12.2.3 through 12.2.15 (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The flaw is rated easily exploitable, but it is not pre-authentication: an attacker must first hold a valid low-privileged EBS account, which is the primary limiting factor, and no user interaction or elevated privileges are needed. Impact is confined to confidentiality and integrity - creation, deletion, modification and disclosure of Bills of Material-accessible data - with availability unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Oracle Bills of Material, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations component that fails to properly restrict what a low-privileged authenticated user can do over HTTP. An attacker holding any valid low-privilege E-Business Suite account can send crafted HTTP requests that read all Bills of Material data and create, delete, or modify it, giving full confidentiality and integrity compromise of the module's records without any user interaction. At the time of analysis there is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied, so the practical near-term risk is driven by whether the target EBS instance is internet-facing or reachable from a compromised low-privilege account.
Low-privileged users of Oracle E-Business Suite 12.2.3 through 12.2.15 can read and modify critical Financials Common Modules data by sending crafted HTTP requests to a vulnerable Common Components endpoint, with no user interaction required. Oracle scores the flaw 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact. No public exploit code or CISA KEV entry has been identified at time of analysis, although the low attack complexity and the fact that only a normal authenticated session is needed make weaponization plausible and patch urgency high.
Low-privileged attackers with HTTPS network access can fully compromise the Internal Operations component of Oracle Complex Maintenance, Repair and Overhaul (CMRO) in Oracle E-Business Suite versions 12.2.3 through 12.2.15, achieving complete confidentiality, integrity, and availability impact on the affected module. The flaw carries a CVSS 3.1 base score of 8.8 and requires only an authenticated network session (PR:L) with no user interaction, making it a straightforward lateral escalation for any user holding a valid low-privilege EBS account. At time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS data provided, so risk is driven by the exposed attack surface of internet- or intranet-reachable EBS deployments rather than confirmed active exploitation.
Oracle Product Hub, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged attacker with HTTP network access take over the Product Hub application. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields high confidentiality, integrity and availability impact across the module. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, though Oracle treats this class of flaw as remotely exploitable and easily abused, making prompt patching of internet- or intranet-exposed E-Business Suite deployments important.
Oracle Product Hub, the product master-data module of Oracle E-Business Suite, fails to properly enforce authorization in its Internal Operations component across supported releases 12.2.3 through 12.2.15, allowing an attacker who already holds a high-privileged account to achieve full takeover of the module over HTTP. Successful exploitation yields complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning master data, configuration and administrative functions can be read and altered. Oracle did not publish a CWE identifier with this record, no public exploit code has been identified at time of analysis, and neither CISA KEV nor EPSS data was supplied, so active exploitation cannot be confirmed.
Takeover of Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a highly privileged authenticated attacker with network HTTP access to the Internal Operations component, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). The flaw is rated easily exploitable (AC:L, UI:N) once the required credentials are held, and no public exploit has been identified at time of analysis. Because the CVSS vector specifies PR:H, anonymous or low-privileged internet attackers are ruled out, leaving the mandatory high-privilege account as the primary gating factor.
An authentication/authorization bypass in Oracle Helidon's helidon-security-providers-idcs-mapper component (versions 3.0.0–3.2.20 and 4.0.0–4.5.4) lets a low-privileged attacker with network access over HTTP impersonate or over-privilege an identity mapped from Oracle Identity Cloud Service, gaining unauthorized read and modification access to critical application data. Oracle's advisory rates it CVSS 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact). No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, but the flaw is trivially automatable against any Helidon service that enables the IDCS mapper, so internet-facing deployments should be treated as high priority.
Improper access control in the Internal Operations component of Oracle Engineering within Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated but low-privileged attacker reaching the application over HTTP to create, delete, modify, and read critical Engineering data, with the impact extending beyond the vulnerable component (CVSS scope change). Oracle rates it 8.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), noting the attack is difficult to execute, so it is a targeted-risk issue rather than an opportunistic mass-exploitation one. No public exploit code is identified in the supplied intelligence, and the product is not listed in CISA KEV.
Unauthenticated? No — low-privileged authenticated users of Oracle Engineering, the engineering change-management module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), can read data well beyond their authorization by sending crafted HTTP requests to the Change Management component. Because the CVSS scope is marked Changed (S:C), the confidentiality loss is not confined to Engineering records — the vendor warns that attacks may significantly impact additional EBS products sharing the same database instance, yielding high (C:H) unauthorized access to critical data with no integrity or availability impact. No public exploit code or CISA KEV listing is identified in the available intelligence, and no EPSS score was supplied, so the practical risk today is driven mainly by the large authenticated user population typical of EBS deployments and the difficulty of patching ERP systems promptly.
Low-privileged users with network access to Oracle Depot Repair inside Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical repair and recall records they are not entitled to and partially degrade availability of the module by sending crafted HTTP requests to the Recall Management component. Oracle rates the flaw 7.1 using CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, meaning a valid but unprivileged account is the main barrier — no user interaction, no elevated role, and no special attack complexity. The provided intelligence contains no CISA KEV listing and no public exploit code, so exploitation is currently assessed as authenticated and targeted rather than opportunistic mass scanning.
Oracle E-Business Suite's Bills of Material module (versions 12.2.13 through 12.2.15) contains a difficult-to-exploit flaw in the Internal Operations component that lets a low-privileged, authenticated attacker with HTTP network access read and tamper with critical manufacturing data. Successful exploitation yields high confidentiality and integrity impact and, per Oracle, can spill over into other EBS modules because of a scope change, though availability is unaffected. There is no CISA KEV listing and no public exploit code identified at time of analysis; the vendor advisory is the primary source of truth.
Oracle Product Workbench, a module within Oracle E-Business Suite, permits a low-privileged attacker who already holds a valid account and HTTP network access to read, create, delete, or modify critical business data across the module's Internal Operations component, affecting supported releases 12.2.3 through 12.2.15. With CVSS 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), exploitation requires only an authenticated session rather than user interaction or a race condition. No public exploit code, POC, or CISA KEV entry has been identified at time of analysis, and no EPSS score was supplied, so the current risk is driven by the low skill barrier and the sensitivity of ERP data rather than confirmed active exploitation.
Oracle Depot Repair, a module of Oracle E-Business Suite, exposes the Estimate and Actual Charges component to a low-privileged, authenticated attacker who can reach the application over HTTP. Because the component fails to enforce proper authorization on its data operations, a successful attack grants full read and write access to charge records that the user should never be able to see or change, giving a broad confidentiality and integrity impact across all Depot Repair data. Oracle rates this 8.1 against versions 12.2.3 through 12.2.15; no public exploit code or CISA KEV entry is associated with the issue at the time of analysis, and no EPSS score was supplied with the intelligence feed.
Low-privileged users with network access to Oracle E-Business Suite's Product Workbench component (Internal Operations) can read, create, modify, and delete critical business data across the full 12.2.3–12.2.15 release range. Oracle rates this 8.1 with a network-accessible, low-complexity, no-user-interaction vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning a valid but unprivileged account is enough to reach full confidentiality and integrity impact on Product Workbench data, with no availability impact. No CISA KEV listing, no public exploit code, and no EPSS score were provided in the source data, so current exploitation activity is unconfirmed — though Oracle CPU-class issues in EBS are historically targeted by attackers who already hold a foothold account.
Oracle Demand Signal Repository, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker with network access over HTTP, leading to unauthorized read, creation, deletion, or modification of the module's critical data. Oracle rates the flaw CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), meaning exploitation is straightforward but requires some level of authenticated access. There is no public exploit code identified and no CISA KEV listing at time of analysis; the vulnerability is addressed through Oracle's Critical Security Patch Update process referenced in the advisory.
Oracle E-Business Suite 12.2.3 through 12.2.15 ships a Demand Signal Repository module whose Internal Operations component fails to enforce proper authorization, letting any holder of a low-privileged account read, create, modify, or delete critical records through ordinary HTTP requests. Oracle's CVSS 8.1 rating reflects full confidentiality and integrity impact with no availability impact, and the flaw is rated easily exploitable because it needs only network reachability, no user interaction, and a low-privileged login. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so exploitation is currently a patch-window problem rather than a confirmed active campaign.
Low-privileged authenticated users of Oracle Complex Maintenance, Repair and Overhaul (CMRO) 12.2.12–12.2.15 can send crafted HTTP requests to the Internal Operations component to gain unauthorized access to critical data and partially degrade availability, with the CVSS scope-change flag indicating impact can extend to other Oracle E-Business Suite modules. Oracle's Critical Security Patch Update is the only remediation reference supplied; there is no EPSS score, no CISA KEV listing and no public exploit evidence in the provided intelligence, so the issue is currently a patch-now hygiene item rather than a confirmed actively exploited threat.
Unauthenticated attackers with HTTP access to Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 can read the full contents of data reachable through the product's HTTP interface, including critical application data. The flaw is fully remote and requires no credentials or user interaction (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N), and Oracle classifies it as easily exploitable while impacting confidentiality only. No public exploit code has been identified and the issue is not listed in CISA KEV, but Oracle has published a fix through its Critical Patch Update program.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Fusion Middleware Security Framework component that lets a low-privileged attacker who can reach the IDE over HTTP achieve a full takeover of the product, with high confidentiality, integrity, and availability impact. Oracle rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation needs a valid low-privilege account but no user interaction or elevated privilege. There is no public exploit code identified and no CISA KEV listing at time of analysis, and no EPSS score was supplied, so the immediate operational risk is driven mainly by exposure of JDeveloper HTTP services rather than by observed exploitation.
Unauthenticated remote attackers can obtain complete read and write access to Oracle Identity Manager's OIM Legacy UI component in supported versions 12.2.1.4.0 and 14.1.2.1.0, enabling unauthorized creation, deletion and modification of critical identity data as well as full disclosure of OIM-accessible data (CVSS 3.1 base score 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The decisive limiting factor is the UI:R requirement: a legitimate OIM user or administrator must be induced to interact with attacker-supplied content over HTTP, which makes this a targeted social-engineering vector rather than a fully automated one, and there is no availability impact. No public exploit has been identified at time of analysis, and Oracle published the issue as part of its September 2026 Critical Patch Update, which is the authoritative remediation source; the issue is tracked in the EU as EUVD-2026-79722.
Local low-privileged users who can log on to hosts running Oracle PeopleSoft Enterprise FIN Engineering Brazil 9.1 can fully take over the affected Engineering component, with high impact to confidentiality, integrity and availability. Oracle's advisory assigns a base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the flaw is trivially exploitable once any valid low-privilege logon on the infrastructure is obtained - no user interaction and no elevated privileges are required. There is no public exploit code or CISA KEV listing identified at time of analysis, so the immediate risk is concentrated in environments where untrusted or over-privileged users share the PeopleSoft application or database host.
Authentication bypass in Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) versions 26.1.200 and 25.2.201 lets a low-privileged attacker with network access over HTTP read and modify critical SEPP data, with the flaw's scope change (S:C) extending impact to interconnected network functions. The attacker must already hold some valid, low-privileged identity and overcome non-trivial exploitation conditions (CVSS 8.2, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), so this is not an anonymous drive-by. No public exploit code and no CISA KEV listing were provided in the intelligence feed at time of analysis.
Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) versions 26.1.200 and 25.2.201 are exposed to an unauthenticated, low-complexity attack launched from the adjacent network segment on which the SEPP host resides. A successful exploit gives the attacker high-impact read access to critical SEPP data plus limited ability to modify or delete that data (CVSS 3.1 base 7.1, AV:A/AC:L/PR:N/UI:N/C:H/I:L/A:N), which in a 5G roaming architecture could mean exposure of inter-PLMN signaling and subscriber-adjacent metadata. No public exploit code and no CISA KEV entry were identified in the available data, so exploitation is currently assessed as opportunistic rather than confirmed in the wild, and the primary exposure is limited to deployments where untrusted parties can reach the SEPP's network segment.
Oracle Coherence (Core component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 can be fully taken over by a low-privileged attacker who can reach the HTTP interface, per Oracle's Critical Security Patch Update. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N, C/I/A all High) confirms a network-reachable but difficult-to-exploit flaw that yields complete compromise of the data grid rather than a limited data leak. No CISA KEV listing, public exploit code, or EPSS score is present in the supplied intelligence, so no public exploit identified at time of analysis and active exploitation is unconfirmed.
Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a flaw in the Core component that allows a low-privileged attacker with TCP network access to create, delete, or modify critical clustered data and to read all data accessible to Coherence. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) yields a base score of 8.1, reflecting complete confidentiality and integrity loss with no availability impact and no user interaction. No public exploit code and no CISA KEV entry were present in the supplied intelligence at time of analysis, so exploitation status remains unconfirmed rather than actively exploited.
Full compromise of Oracle Coherence is achievable by low-privileged attackers who can reach the Coherence Core HTTP interface, affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 of the Oracle Fusion Middleware product. Successful exploitation gives complete loss of confidentiality, integrity and availability — Oracle describes the outcome as "takeover of Oracle Coherence" — with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was supplied with the source data, so the practical urgency currently rests on the size of the exposed Coherence estate rather than on observed exploitation.
Oracle Coherence, Oracle's in-memory data grid shipped as part of Fusion Middleware, can be fully taken over by a low-privileged attacker who can reach the cluster over the network in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The flaw sits in the Core component and is rated by Oracle as easily exploitable — CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — with confidentiality, integrity and availability all fully impacted, meaning compromise of the Coherence cluster rather than a narrow data leak. No EPSS score, CISA KEV entry or public exploit code was provided with this record; the only authoritative source is Oracle's Critical Security Patch Update advisory, so treat exploitation status as unconfirmed (no public exploit identified at time of analysis).
Oracle's Enterprise Command Center (ECC) Framework in Oracle E-Business Suite V16 exposes sensitive data to any authenticated low-privileged user who can reach the HTTP interface, because the component fails to enforce proper access controls on data it serves. Successful exploitation yields high confidentiality impact on the ECC Framework and can extend beyond it (scope change) to connected E-Business Suite components, though integrity and availability are unaffected. No public exploit code or CISA KEV entry was present in the provided intelligence at time of analysis, but the attack requires only a valid low-privilege account and a network path to the application, which Oracle itself characterizes as easily exploitable.
Authentication bypass in the Metrics component of Oracle Enterprise Manager for Fusion Middleware (versions 13.5 and 24.1) allows a remote, unauthenticated attacker with HTTP access to the management console to take over the affected deployment, with total loss of confidentiality, integrity and availability, and an assessed CVSS of 9.8. The root cause is CWE-287 (Improper Authentication), and the exploitation prerequisites assessed from the CVSS vector (AV:N/AC:L/PR:N/UI:N) are effectively none beyond network reachability - no credentials, no user interaction and no non-default configuration are required. No public exploit code has been identified and there is no confirmed active exploitation at time of analysis; no EPSS score was supplied, so the dominant real-world risk factor is whether the EM console is exposed, since these consoles are frequently segmented to internal networks.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 can be taken over by a low-privileged local attacker with logon access to the host infrastructure, allowing complete compromise of the Content Server component's confidentiality, integrity, and availability. The flaw is easily exploitable given local access and a valid account, but no public exploit or active exploitation has been identified at time of analysis. This is a locally-scoped critical-impact issue, not a remote-drive-by vulnerability.
Oracle XML Gateway, a module delivered with Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an install-related component that a low-privileged, network-positioned attacker can abuse over HTTP to read data the account should never reach — up to the full set of XML Gateway-accessible data — and to degrade service availability. Oracle rates it 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), meaning the confidentiality hit is total for that module while the availability impact is only partial and there is no integrity impact. There is no public exploit code and no CISA KEV listing at time of analysis, and no EPSS score was supplied, so this reads as a patch-cycle obligation rather than an emergency — but the Oracle CPU reference (cspusep2026) is the authoritative fix source.
Unauthenticated database takeover is possible in Oracle Database Server RDBMS releases 23.4.0 through 23.26.3 via crafted traffic sent to the Oracle Net listener. Per the Oracle-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), an attacker with network reachability can fully compromise confidentiality, integrity and availability of the RDBMS without credentials or user interaction, though Oracle characterizes the flaw as 'difficult to exploit' (AC:H). There is no public exploit code and no CISA KEV listing at time of analysis, so this is a patch-now enterprise hygiene issue rather than a confirmed active campaign.
Unauthenticated attackers with network reachability to the Oracle Net listener can hang or repeatedly crash Oracle Net Services on Oracle Database Server, cutting off client connectivity to the database. The affected releases are 21.3 through 21.23 and 23.4.0 through 23.26.3, and the flaw affects availability only — confidentiality and integrity are untouched. Oracle scores it 7.5; no public exploit code, EPSS value, or CISA KEV entry was supplied with this record, so active exploitation is unconfirmed.
Unauthenticated denial of service in Oracle Net Services, the networking component bundled with Oracle Database Server, allows a remote attacker who can reach the Oracle Net listener to hang or repeatedly crash the service. Affected releases are Oracle Database 19c (19.3-19.32), 21c (21.3-21.23) and 23ai (23.4.0-23.26.3), with a CVSS 3.1 base score of 7.5 driven purely by availability impact. There is no CISA KEV listing and no public exploit code identified at time of analysis, but the attack is network-reachable, low-complexity and requires no credentials, so any database listener exposed to untrusted networks is at risk.
Oracle Database Server's RDBMS engine can be fully compromised by any database account holding the CREATE DATABASE LINK privilege, affecting releases 19.3–19.32, 21.3–21.23 and 23.4.0–23.26.3. The flaw is reachable over Oracle Net with no user interaction and yields complete confidentiality, integrity and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N), i.e. full takeover of the RDBMS rather than a narrow data leak. Oracle has published a fix through its security advisory referenced by NVD; no public exploit code, EPSS score or CISA KEV entry was supplied, so there is no evidence of active exploitation at time of analysis.
Improper access control in the Install component of Oracle XML Gateway within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with network access over HTTP read all data the XML Gateway can reach and partially degrade its availability. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), meaning exploitation is straightforward once a valid low-privilege account exists, but it is not unauthenticated. No public exploit code has been identified and the issue is not listed in CISA KEV; Oracle addresses it in its September 2026 Critical Security Patch Update.
Takeover of the Oracle Identity Manager Connector (component: Database Application Table) in Oracle Fusion Middleware is possible for a high-privileged attacker who can reach the affected HTTP interface, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Oracle rates the flaw 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker who already holds elevated privileges can fully compromise confidentiality, integrity and availability of the connector with no user interaction and low attack complexity. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV), though it was published within Oracle's scheduled Critical Patch Update cycle.
Unauthenticated remote attackers can reach the System Wide component of Oracle Utilities Network Management System over HTTP and obtain high-impact read access to critical data, plus limited ability to modify records, across supported releases 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3. Oracle rates the issue 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), meaning no credentials, no user interaction and no unusual conditions are needed to attempt exploitation. It is tagged as an authentication bypass, but no public exploit code, EPSS score or CISA KEV entry was supplied with this report, so active exploitation is unconfirmed at time of analysis.
Local privilege escalation in Oracle Utilities Network Management System (NMS) allows any attacker holding a low-privileged logon on the host where the product executes to take over the affected application, with full loss of confidentiality, integrity and availability. The flaw spans the entire supported release line, from 2.4.0.1.0 through 2.4.0.1.33, 2.5.0.1.0-2.5.0.1.19, 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3, so virtually every deployed version is affected until the Vendor-released patch per the Oracle Critical Security Patch Update is applied. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and absence of user interaction make the flaw attractive once an attacker already has a foothold on the utility server.
An unauthenticated remote attacker with HTTP access to the Oracle Applications Manager component of Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical configuration and management data without supplying credentials. The flaw lives in the Command Line - RapidClone component and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact). No public exploit code, EPSS score, or CISA KEV listing was supplied in the input, so active exploitation is unconfirmed, but the zero-privilege, zero-interaction network vector makes this a high-value target for opportunistic scanning of internet-facing EBS deployments.
Oracle Identity Manager (OIM) releases 12.2.1.4.0 and 14.1.2.1.0, shipped as part of Oracle Fusion Middleware, contain a flaw in the Security component that lets an attacker holding a low-privileged account reach the application over HTTP and take full control of the identity platform. Oracle rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting complete loss of confidentiality, integrity and availability with no user interaction required. No public exploit code or CISA KEV entry was available at time of analysis, so exploitation is assessed as plausible but not yet observed in the wild.
Unauthenticated HTTP exploitation of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can lead to full takeover of the application. The vulnerability resides in the Client Bundle component and is easily exploitable over the network without credentials. No public exploit or CISA KEV listing was identified in the provided data.
Authenticated, low-privileged network attackers can achieve full takeover of Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 through the Oracle Diagnostics Interfaces component, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is network-reachable over HTTP, requires only a low-privileged account and no user interaction, and is not pre-authentication, so exposure is greatest where many low-trust users can authenticate or where the EBS instance is internet-accessible. No public exploit code has been identified at time of analysis and EPSS is 0.45% (38th percentile); Oracle addresses the flaw in its September 2026 Critical Patch Update.
A locally exploitable privilege-escalation vulnerability in the Remote Diagnostic Agent component of Oracle Middleware Common Libraries and Tools (Oracle Fusion Middleware) allows any low-privileged user with a logon on the host to fully compromise the affected middleware installation. Successful exploitation results in complete loss of confidentiality, integrity, and availability — effectively a full takeover — across versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit code has been identified and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant or shared-host deployments where untrusted users already have accounts.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (Analytics Server component) lets any low-privileged user who can log on to the host where the service runs take full control of the BI platform. Both supported branches - 8.2.0.0.0 and 26.01.0.0.0.0 - are affected, with a CVSS 3.1 base score of 7.8 reflecting complete loss of confidentiality, integrity and availability. Oracle addressed it in its Critical Patch Update (cspusep2026); no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated low-privileged users can fully compromise Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 26.01.0.0.0 by sending crafted HTTP requests to the Analytics Server component, obtaining complete control over confidentiality, integrity, and availability of the platform. Oracle rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the only real prerequisite is a valid low-privilege account and network reachability to the HTTP interface. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so the immediate risk is driven by the severity of a successful takeover rather than confirmed in-the-wild activity.
Unauthenticated network attackers can exploit a hard-to-trigger flaw in the Web Services Security component of Oracle Web Services Manager 12.2.1.4.0 and 14.1.2.0.0 to read all data the service can access and to repeatedly hang or crash it. Oracle rates the issue 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H), reflecting high confidentiality and availability impact offset by high attack complexity and no integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and no CWE classification was supplied.
Unauthenticated remote attackers can repeatedly hang or crash Oracle Net Services — the TNS-based networking layer of Oracle Database Server versions 23.4.0 through 23.26.3 — by sending crafted traffic over Oracle Net, producing a complete denial of service for database connectivity. The flaw carries a CVSS 3.1 base score of 7.5 with a network, low-complexity, no-privileges, no-user-interaction vector, so it is trivially automatable once the listener is reachable. No public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at the time of analysis.
Oracle E-Business Suite versions 12.2.9 through 12.2.15 ship a flaw in the Oracle Applications Framework Personalization component that lets a low-privileged authenticated user reach data and functionality they should not be able to touch, via ordinary HTTP requests. Successful exploitation yields high-impact confidentiality loss (read access to critical application data) plus limited integrity impact (unauthorized insert, update or delete of some records); availability is unaffected. Oracle rates it 7.1 on CVSS 3.1, and no public exploit code or active exploitation has been reported at time of analysis.
Authenticated low-privileged users can fully compromise the Oracle Applications Framework (Personalization) component of Oracle E-Business Suite 12.2.9 through 12.2.15 by sending crafted HTTP requests, achieving complete loss of confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Oracle rates the flaw as easily exploitable with no user interaction, and the impact is described as full takeover of the Applications Framework rather than simple data exposure. No public exploit code or CISA KEV listing was identified at time of analysis, and remediation is available through Oracle's Critical Security Patch Update (cspusep2026).
Denial of service in Oracle Helidon versions 4.0.0 through 4.5.4 allows an unauthenticated remote attacker to hang or repeatedly crash the server by sending crafted traffic to the WebSocket component over HTTP. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N, availability impact only) and Oracle's own advisory text describes it as easily exploitable. No public exploit code and no CISA KEV listing appear in the supplied intelligence at time of analysis, but the zero-authentication, zero-complexity attack path and availability-only impact make this a low-skill, repeatable disruption vector for any internet-exposed Helidon deployment.
Oracle E-Business Suite 12.2.9 through 12.2.15 contain a flaw in the Personalization component of the Oracle Applications Framework that lets a low-privileged user with HTTP network access take full control of the framework, with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). Exploitation is rated 'easily exploitable' by the vendor because it requires no user interaction and no special complexity — only a valid low-privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation status is currently unconfirmed. The vendor has published an out-of-band Critical Security Patch Update covering this issue; organizations running affected EBS releases should treat patching as urgent because the pre-authentication barrier is only a low-privilege login.
Authenticated high-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can fully take over the Oracle Applications Framework Personalization component, with high impact to confidentiality, integrity and availability. The flaw scores 7.2 on CVSS 3.1 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and low attack complexity once an attacker already holds a privileged EBS account. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so the practical risk is dominated by the credential-privilege precondition rather than by mass exploitation.
Improper authentication in the Personalization component of Oracle Applications Framework (Oracle E-Business Suite 12.2.3 through 12.2.15) lets an unauthenticated remote attacker reach the SOAP interface and take over the framework, with full confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). CISA's SSVC assessment rates the technical impact as total and the vulnerability as automatable, meaning exploitation could be scripted and scaled once a target is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven mainly by whether an organisation exposes EBS SOAP endpoints to untrusted networks.
Unauthenticated attackers with network access can read critical data from the Open Integration component of Oracle Siebel CRM Integration in versions 25.12 through 26.7 by sending crafted HTTP requests, because the component fails to enforce authentication on its integration interfaces. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), making it trivially automatable against any reachable deployment. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle has published a Critical Security Patch Update covering the affected releases.
High-privileged users of Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) can exploit a flaw in the Platform Security component over HTTP to take complete control of the BI platform. The vendor rates this CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a highly privileged account but needs no user interaction and faces low attack complexity, with full confidentiality, integrity and availability impact. No public exploit code or CISA KEV entry is identified in the available data, and EPSS scoring was not supplied, so real-world exploitation activity is unconfirmed at time of analysis.
Oracle Business Intelligence Enterprise Edition (BI Platform Security component) versions 8.2.0.0.0 and 26.01.0.0.0 contain a difficult-to-exploit flaw that lets a low-privileged, authenticated attacker reach the BI platform over HTTP and gain unauthorized create, delete, or modify access to critical BI data, plus read access to a subset of it. Oracle's own CVSS 3.1 rating is 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N), with the scope change indicating successful attacks can also affect connected products. No EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so exploitation is currently assessed as theoretical rather than observed.
A hard-to-exploit local vulnerability in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 (Oracle Analytics, Platform Security component) lets a low-privileged user who can already log on to the host running the platform take full control of the BI service, with knock-on impact to connected products because the vulnerable component operates with changed scope. The attacker must additionally induce a separate legitimate user to perform an action (UI:R) and clear a high attack-complexity bar (AC:H), so exploitation is neither trivial nor remote. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; Oracle shipped the fix in its Critical Security Patch Update advisory (cspusep2026).
Attackers who already hold an elevated account on Oracle Business Intelligence Enterprise Edition can fully take over the platform by sending crafted HTTP requests to its Platform Security component, impacting confidentiality, integrity and availability of the whole deployment. Supported versions 8.2.0.0.0 and 26.01.0.0.0 are affected, and Oracle delivered the fix through its out-of-band critical security patch update. No public exploit code or CISA KEV entry has been identified at time of analysis, so the practical risk is driven by the high-privilege prerequisite rather than by active exploitation.
Oracle Business Intelligence Enterprise Edition (BI EE) versions 8.2.0.0.0 and 26.01.0.0.0 contain an easily exploitable flaw in the Analytics Actions component that lets a low-privileged, HTTP-reachable user read critical data and tamper with a subset of stored data, with the impact extending beyond the BI EE instance itself (CVSS scope change). Oracle rates it 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and the vulnerability is addressed in the April 2026 Critical Security Patch Update. No public exploit code has been identified and the issue is not listed in CISA KEV, so risk is driven by exposure of BI EE endpoints to authenticated internal or external users.
Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 expose an Administration component flaw that lets a low-privileged, network-connected user leverage another person's interaction to read or modify report data — including data belonging to products outside BI Publisher itself, per the CVSS scope-change metric. Oracle rates the issue 7.6 with high confidentiality impact and low integrity impact, and no availability impact. No EPSS score, CISA KEV listing or public proof-of-concept was included in the provided intelligence, so no public exploit is identified at time of analysis; remediation is via Oracle's September 2026 Critical Security Patch Update advisory.
Unauthorized access to critical data in Oracle BI Publisher 12.2.1.4.0 allows a low-privileged attacker with network reachability to the SOAP-based Web Service API to read data that should be outside their authorization. Because the flaw carries a scope change (S:C), compromised BI Publisher data can extend to other Oracle Analytics components that trust the service. No public exploit code and no CISA KEV listing were identified at time of analysis; the issue is addressed only through Oracle's Critical Patch Update cycle.
A difficult-to-exploit flaw in the Administration component of Oracle BI Publisher lets a low-privileged, authenticated attacker who can reach the server over HTTP take complete control of the platform, with high confidentiality, integrity and availability impact. Affected releases are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, as listed in Oracle's Critical Security Patch Update (cspusep2026). There is no CISA KEV listing, no referenced public exploit code and no EPSS score in the supplied data, so this reads as a patch-on-cadence item rather than an emergency — though the outcome is full platform takeover.
Local privilege escalation in the Installation component of Oracle Business Intelligence Enterprise Edition lets any low-privileged user who can log on to the host running the product take full control of the BI platform, affecting versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. With complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8), the flaw is attractive as a post-compromise escalation step, but it is not network-reachable and requires an existing OS-level account on the infrastructure. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and no EPSS data was supplied to gauge mass-exploitation likelihood.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 allows an attacker who already holds a low-privileged logon on the host running the platform to take full control of the BI EE deployment, with high confidentiality, integrity and availability impact across the Platform Security component. Oracle rates the flaw 7.0 (AV:L/AC:H/PR:L/UI:N), reflecting that exploitation is difficult and confined to the local host rather than reachable over the network. No public exploit code or evidence of active exploitation was identified in the supplied intelligence at time of analysis.
Oracle BI Publisher in Oracle Analytics (versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0) contains a flaw in the BI Platform Security component reachable over SOAP that allows a low-privileged, authenticated attacker with network access to fully take over the affected BI Publisher instance, with high confidentiality, integrity and availability impact (CVSS 8.8). Oracle characterizes the issue as easily exploitable, and the reference is the Oracle Critical Security Patch Update cspusep2026 advisory. No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis, and no EPSS score was provided.
Low-privileged remote attackers can compromise Oracle BI Publisher through its SOAP-based Web Service API, gaining unauthorized ability to create, delete or modify critical report data and to repeatedly crash the service for a complete denial of service. The affected versions are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, and the flaw carries a CVSS 3.1 base score of 8.1 (network vector, low complexity, low privileges required, no user interaction). No public exploit code has been identified and the vulnerability is not listed in CISA KEV, although enterprise reporting platforms of this kind are attractive targets once technical details become public.
Authenticated low-privileged users of Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 can read sensitive report data they should not be able to access by sending crafted HTTP requests to the BI Platform Security component. The flaw is network-reachable, low complexity, and can pivot beyond BI Publisher itself (CVSS scope change), though it affects confidentiality only — no data modification or denial of service. No CISA KEV listing, EPSS score or public exploit code was supplied at time of analysis, and Oracle has published a Critical Security Patch Update advisory covering the fix.
Oracle BI Publisher, in its E-Business Suite XDO integration component, mishandles access control in a way that lets a low-privileged user with ordinary HTTP network access read critical data — including all data the BI Publisher instance can reach — across versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. The CVSS 3.1 base score is 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), reflecting confidentiality-only impact with a scope change that can spill into connected E-Business Suite products. No public exploit code was identified at time of analysis, and the CVE is not listed in CISA KEV, but the low privilege bar and network reachability make it a realistic post-authentication data-exfiltration risk rather than a theoretical one.
Oracle BI Publisher (a component of Oracle Analytics) is affected by an easily exploitable, network-reachable flaw in the BI Platform Security component across versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. A low-privileged attacker who can reach the SOAP interface can compromise the reporting platform, obtaining high-confidence read access to critical data and limited ability to modify it, with the impact spilling over into other Oracle products because the CVSS vector carries a scope change (S:C). No public exploit code or CISA KEV entry was present at time of analysis, and the vendor's own score of 8.5 reflects high confidentiality impact rather than a wormable, unauthenticated issue.
Oracle BI Publisher — the reporting and publishing component of Oracle Analytics — is exposed in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 to an easily exploitable flaw that lets a low-privileged, authenticated user reach the application over HTTP and, once a victim is persuaded to interact, obtain full read and write access to critical BI Publisher data. The CVSS 3.1 base score of 8.7 reflects high confidentiality and integrity impact plus a scope change that allows the compromise to spill over into additional, connected Oracle products. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical urgency currently rests on Oracle's criticality rating rather than observed exploitation.