Oracle
Monthly
Oracle BI Publisher (an Oracle Analytics reporting component) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 contain a flaw in the Web Server component that lets a low-privileged, network-positioned attacker read critical data and alter or delete a subset of records through HTTP, with impact potentially extending beyond the vulnerable component to other Oracle Analytics products. Oracle rates it CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) in its October-lineage Security Alert. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so active exploitation is unconfirmed.
Oracle BI Publisher (part of Oracle Analytics) is affected by a network-reachable flaw in its BI Platform Security component that lets a low-privileged, authenticated attacker via SOAP tamper with or delete critical reporting data and repeatedly crash the service, enabling a full denial of service. Versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are listed as affected, and the vendor rates it 8.1 with high integrity and availability impact while confidentiality is untouched. No public exploit code or CISA KEV listing was present in the supplied intelligence, and EPSS data was not provided, so real-world exploitation status is unconfirmed.
Low-privileged attackers with HTTP access to Oracle BI Publisher can exploit a flaw in the BI Platform Security component to read and modify critical report data and partially disrupt the service. The issue affects BI Publisher 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 and carries a CVSS 3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, low availability impact). No public exploit code or EPSS/KEV data was supplied with this record, so exploitation status at time of analysis is no public exploit identified at time of analysis, though the low complexity and authenticated-but-network-reachable attack path make it attractive for post-compromise lateral movement inside Oracle Fusion Middleware estates.
An authenticated remote attacker with low privileges can fully take over Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 by sending crafted HTTP requests to the Resource Catalog Services component, which is part of Oracle Fusion Middleware. The flaw is rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning successful exploitation yields complete loss of confidentiality, integrity and availability of the affected JDeveloper instance. No CWE, EPSS score, KEV entry or public proof-of-concept was supplied in the source data, so active exploitation is not confirmed, but the low attack complexity and lack of user interaction make rapid patching advisable once the Oracle CPU fix is applied.
Unauthenticated remote attackers can compromise Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 through the HTTP interface, gaining high-impact read access to all data reachable by the application plus limited write and partial denial-of-service capability. Oracle rates the flaw 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) and classifies it as easily exploitable in the BI Platform Security component of Oracle Analytics; no public exploit code, EPSS score, or CISA KEV entry was supplied with the source data at time of analysis.
Oracle Business Intelligence Enterprise Edition (8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0) exposes an unauthenticated, network-reachable flaw in the Analytics Web General component that lets an attacker read and tamper with critical data and degrade service availability, with the impact extending beyond the vulnerable product itself (scope change). Oracle rates it 8.9 but flags it as difficult to exploit, meaning the high attack complexity — not missing credentials or user interaction — is the main barrier. No public exploit code and no CISA KEV listing were identified at time of analysis.
Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 contain a flaw in the BI Platform Security component that lets a low-privileged attacker with network access to the SOAP interface alter or delete critical report and platform data, and read a limited portion of it. The CVSS 3.1 base score is 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N), driven by a scope change that means compromise of BI Publisher can cascade into other Oracle Analytics components. No public exploit code or active exploitation has been identified at time of analysis, and no CWE or EPSS data was supplied.
Oracle BI Publisher 12.2.1.4.0, the enterprise reporting tier of Oracle Analytics, lets a low-privileged network attacker reach data well beyond their granted entitlements and partially degrade the service through crafted HTTP requests to the BI Publisher Security component. Oracle scores it 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), and the scope-change metric indicates that a compromised deployment can expose additional, integrated Oracle products that trust BI Publisher. No public exploit code, CISA KEV listing, or EPSS estimate was supplied with the source data, so exploitation status at time of analysis is 'no public exploit identified' and remediation depends on the referenced Oracle security alert.
Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 contains an easily exploitable flaw in the Service Administration UI component that allows a low-privileged attacker with network access over HTTP to fully take over the platform, with high confidentiality, integrity, and availability impact (CVSS 8.8). Because exploitation only requires a valid low-privileged account rather than an administrator, any provisioned BI user could potentially escalate to full control of the BI deployment. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS data supplied; Oracle has published a Critical Security Patch Update advisory covering the issue.
A low-privileged authenticated attacker with HTTP network access can exploit the Install component of Oracle XML Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 to read critical data, gain complete access to all XML Gateway-accessible data, and trigger a partial denial of service. The vulnerability carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), indicating easy exploitation once valid credentials are held, with confidentiality as the dominant impact. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the only intelligence source is Oracle's September 2026 Critical Patch Update advisory.
Unauthenticated attackers with network reachability to the Analytics Web component of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can exploit a hard-to-trigger flaw to fully compromise the platform, achieving high confidentiality, integrity and availability impact consistent with a complete takeover. Oracle rates this CVSS 3.1 base 8.1 with attack complexity High, meaning exploitation depends on conditions outside the attacker's direct control rather than simply sending a request. No public exploit code has been identified and the issue is not listed in CISA KEV, so measured risk is driven by exposure of the Analytics Web HTTP interface rather than by observed in-the-wild activity.
Oracle BI Publisher 12.2.1.4.0 can be fully taken over by an attacker who already holds a high-privileged account and can reach the product's HTTP interface, with complete loss of confidentiality, integrity and availability (CVSS 3.1 base 7.2). The defect resides in the BI Platform Security component of Oracle Analytics and is rated low-complexity with no user interaction required, so a single crafted request from a privileged session is sufficient. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied with the source data.
Oracle BI Publisher (Oracle Analytics, BI Platform Security component) in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 permits a low-privileged attacker with network reach to the LDAP-facing interface to read, create, delete or modify critical BI Publisher data, effectively breaking the authorization boundary between a basic account and the full reporting repository. Oracle scores this 8.1 with high confidentiality and integrity impact, low attack complexity and no user interaction, making it trivially automatable once a low-privileged credential is held. No public exploit code and no CISA KEV listing were present at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unmeasured rather than confirmed.
Low-privileged users with HTTP access to Oracle Business Intelligence Enterprise Edition can exploit a hard-to-trigger flaw in the BI Search component to gain full control of the platform, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected supported versions are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. At the time of analysis there is no CISA KEV entry and no public exploit identified; the 7.5 score reflects the vendor's own assessment and exploitation is gated by a high attack-complexity condition.
Oracle Business Intelligence Enterprise Edition (Analytics) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 contain a hard-to-exploit but high-impact flaw in the Presentation Services component that a low-privileged, network-positioned attacker can reach over SOAP to fully take over the BI platform. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a valid low-privilege account and defeat the non-trivial attack complexity. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a patch-priority issue for exposed BI deployments rather than a confirmed active campaign.
Full takeover of Oracle Business Intelligence Enterprise Edition is achievable when an attacker who already holds logon access to the host running the platform induces a different user to perform one interaction, letting them compromise the Platform Security component and gain control over confidentiality, integrity and availability. Supported releases 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are affected; Oracle scores the issue 7.8 with a local access vector and required user interaction. No public exploit code has been identified and the flaw is not listed in CISA KEV, so practical exploitation is currently limited to parties who already have host-level access; no EPSS data was supplied with the intelligence.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 lets any user who already holds a low-privileged logon to the infrastructure hosting the BI server take full control of the platform, with complete loss of confidentiality, integrity and availability. The flaw sits in the FNDN (foundation) component and is rated 7.8 by Oracle, but it is a local vector (AV:L/PR:L) rather than a network-reachable bug, so exploitation requires prior host access as an ordinary user. No public exploit code or active exploitation is identified in the available data, and no EPSS score, KEV entry or CWE classification was supplied.
Complete takeover of Oracle Business Intelligence Enterprise Edition is achievable by a low-privileged attacker who can reach the product's HTTP interface in versions 8.2.0.0.0 and 26.01.0.0.0, through a flaw in the Platform Security component. Oracle rates it 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning confidentiality, integrity and availability of the BI platform are all fully at risk, but exploitation is difficult and requires an existing low-privileged account. At time of analysis there is no CISA KEV listing, no public exploit code, and no EPSS score in the supplied intelligence.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (Platform Security component) lets a low-privileged user who can log on to the host running the BI software take full control of the deployment. Affected releases are 8.2.0.0.0 and 26.01.0.0.0, which receive complete confidentiality, integrity and availability impact on successful exploitation. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the practical barrier is that the attacker must already hold some form of logon/execution capability on the infrastructure where OBIEE runs.
A locally exploitable privilege-escalation flaw in the Platform Security component of Oracle Business Intelligence Enterprise Edition (Oracle Analytics) lets any user who can log on to the operating-system host running the product take full control of the BI platform. Affected supported releases are 8.2.0.0.0 and 26.01.0.0.0. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), the exploit is trivial once host access exists, and no public exploit code or CISA KEV listing was identified at time of analysis, so risk is concentrated in environments where untrusted or over-privileged local accounts exist on BI servers.
Oracle Business Intelligence Enterprise Edition (BI EE, part of Oracle Analytics) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 can be fully taken over by a low-privileged attacker who already holds a valid account and can reach the product's SOAP interface over the network. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity and availability of the Analytics platform, but the vendor also classifies it as 'difficult to exploit', so successful attacks likely require significant timing, sequencing or state knowledge rather than a simple request. No CISA KEV listing, EPSS score or public exploit code was included in the reporting data, and no CWE was assigned, so the precise root-cause class remains undocumented by the vendor.
Local privilege escalation to full instance takeover in Oracle Business Intelligence Enterprise Edition (component: BI Search) affects versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. An attacker who can log on to the host running the BI EE service with only low-privileged credentials can exploit the BI Search component to gain complete control of the platform, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8). No public exploit code or CISA KEV entry is identified in the available data, so this is treated as a patch-now hardening issue rather than an observed campaign.
Oracle Business Intelligence Enterprise Edition (Presentation Services component) fails to properly enforce access controls on its SOAP interface, allowing a user holding only a low-privileged account to read data they should never be able to reach — up to and including all BI data accessible through the platform, with a claimed spillover effect on additional products. Affected releases are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0; Oracle rates it CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), meaning confidentiality-only impact, no integrity or availability loss, and no user interaction. No public exploit code has been identified and the flaw is not listed in CISA KEV, but the barrier to entry is low once any valid BI account is obtained, so the exposure is meaningful for internet- or partner-reachable deployments.
Unauthenticated network attackers can achieve complete takeover of Oracle Business Intelligence Enterprise Edition (Analytics) by exploiting a flaw in the Platform Security component of versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Oracle describes the flaw as 'difficult to exploit' but rates it 8.1 with full confidentiality, integrity and availability impact, so a successful attack means total loss of control over the BI platform and the analytical data it exposes. No EPSS score, KEV listing or public exploit code is present in the input, so there is no public exploit identified at time of analysis, though the unauthenticated network vector makes patching urgent for internet- or intranet-exposed deployments.
Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 contains a flaw in the BI Search component that lets a low-privileged, network-positioned user read, create, modify and delete critical BI data and partially disrupt the service. The CVSS 3.1 base score is 8.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), reflecting a remotely reachable, easily automated attack that yields high confidentiality and integrity impact with a limited availability impact. No public exploit code or CISA KEV listing is present in the supplied intelligence, and the affected build is a single supported release, so exposure is limited to organisations running that version until the Oracle patch from the referenced security alert is applied.
Unauthenticated remote attackers can crash and partially tamper with Oracle BI Publisher by sending crafted requests to its SOAP web services, affecting versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. The flaw is rated CVSS 8.6 (AV:N/AC:L/PR:N/UI:N) with high availability impact plus low confidentiality and integrity impact, meaning a successful hit can hang or repeatedly crash the service while also allowing unauthorized read and update/insert/delete access to some BI Publisher data. No public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so the practical exploitation risk must currently be judged from the exposure of the SOAP interface rather than from observed attack activity.
Authentication bypass in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 (Platform Security component) lets an unauthenticated remote attacker with HTTP access take over the BI platform, yielding full confidentiality, integrity, and availability impact (CVSS 3.1 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation have been identified at time of analysis, so exposure drives urgency: internet-facing BI EE instances are the highest priority, while internal-only deployments carry materially lower reach. The blast radius is bounded by the fact that only the single supported release 12.2.1.4.0 is affected and the sole prerequisite is network reachability of the BI EE HTTP interface.
Authenticated takeover of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 is achievable through the Platform Security component by a low-privileged attacker with network HTTP access, producing high confidentiality, integrity and availability impact (CVSS 9.9, scope change). Exploitation is straightforward once any valid low-privilege credential or session is held - attack complexity is low and no user interaction is required - and the scope change means a successful compromise can extend beyond BI EE into other products integrated with the platform. No public exploit code has been identified at time of analysis, and Oracle classifies the flaw as easily exploitable in its Critical Security Patch Update advisory.
Unauthenticated remote denial of service in Oracle Helidon's helidon-webserver component (versions 4.0.0 through 4.5.4) allows any network-reachable attacker to drive the server into a hang or a repeatable crash, fully denying service. The flaw is rated CVSS 7.5 with a network vector and no authentication or user interaction required, and Oracle lists it in its Fusion Middleware security advisory, making exposure a direct function of whether the Helidon HTTP listener is reachable. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation, but the trivial attack prerequisites mean it should be treated as remotely exploitable by unsophisticated actors.
Unauthenticated HTTP/2 traffic can hang or repeatedly crash the Oracle Helidon webserver, allowing a remote attacker to take a Helidon-hosted application offline. Oracle rates it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so the only impact is availability, but it requires no credentials and no user interaction. Affected releases are Helidon 4.0.0 through 4.5.4; no public exploit code or CISA KEV entry is present in the available data, and no EPSS score was supplied, so the current exploitation status is unconfirmed.
A local privilege-escalation and data-tampering flaw in the CAX Client component of Oracle Agile PLM MCAD Connector 3.6 lets a low-privileged user who can already log on to the host running the connector create, modify, or delete critical PLM data, while also exposing a limited subset of that data to unauthorized reads. Because the vulnerability sits in the connector but the resulting actions reach other integrated products, Oracle assigns a scope change (S:C) and a CVSS 3.1 base score of 7.3. There is no CISA KEV listing, no public exploit code, and no EPSS data in the supplied intelligence, so the issue is currently patch-driven rather than evidence of active exploitation.
Unauthenticated HTTP/2 traffic can hang or repeatedly crash Oracle Helidon versions 4.0.0 through 4.5.4 through a flaw in the helidon-webclient-http2 component, giving a full denial-of-service of the affected service. The issue is network-reachable with no credentials and no user interaction (CVSS 3.1 base 7.5, availability-only impact). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though Oracle's own advisory describes the flaw as 'easily exploitable', so the barrier to a working denial-of-service is judged to be low.
Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 contains a flaw in its Platform Security component that allows a high-privileged, authenticated attacker with HTTP network access to fully take over the BI platform, with high confidentiality, integrity and availability impact. Oracle rates it CVSS 7.2 (AV:N/AC:L/PR:H/UI:N) and the affected version is limited to 26.01.0.0.0. No public exploit code or CISA KEV entry was supplied with the available intelligence, so exploitation is not confirmed to be occurring in the wild.
Oracle Text, the full-text indexing subsystem bundled with Oracle Database Server, contains a scope-escalating flaw that lets a low-privileged database account holding the Create Index privilege take over Oracle Text when reached over Oracle Net. Affected builds are 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3; successful exploitation yields high confidentiality, integrity, and availability impact and, per Oracle's own scope-change rating, can spill over to other database components. Exploitation is rated difficult (AC:H) and no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Oracle Database Server's RDBMS component (19c 19.3–19.32, 21c 21.3–21.23, and 23ai 23.4.0–23.26.3) can be fully compromised by a low-privileged database account that holds EXECUTE on the DBMS_REDEFINITION package. An attacker reaching the database over Oracle Net can abuse that package to achieve takeover of the RDBMS, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV listing were identified in the supplied intelligence at the time of analysis; the vulnerability is addressed by Oracle's Critical Security Patch Update referenced at oracle.com/security-alerts/cspusep2026.html.
Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 contain an unauthenticated, network-reachable weakness in the BI Platform Security component that lets an attacker read critical business data, potentially everything the BI platform itself can access. Oracle scores it 7.5 with a vector of AV:N/AC:L/PR:N/UI:N and confidentiality-only impact, and the vendor's own tagging classifies it as an authentication bypass. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data.
Authentication bypass in Oracle BI Publisher (BI Platform Security component of Oracle Analytics) lets unauthenticated remote attackers with HTTP access take over the affected system, with full confidentiality, integrity, and availability impact. Affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and score of 9.8 confirm an easily exploitable, automatable condition; no public exploit or evidence of active exploitation was identified at time of analysis, but CISA SSVC classifies technical impact as total and the vulnerability is automatable, making exposed instances a high priority to patch or isolate.
High-privileged takeover of Oracle BI Publisher is possible through the BI Platform Security component in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, where an attacker who already holds administrative access on the instance can exploit the flaw over HTTP with a Critical CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), taking over the application with full confidentiality, integrity and availability impact. Because the CVSS scope metric is changed (S:C), a successful compromise can extend beyond BI Publisher into additional integrated products rather than being contained by the BI Publisher trust boundary. Exploitation is authenticated and privilege-gated (PR:H) with no user interaction required, so realistic risk is concentrated in deployments where administrative accounts are shared, over-provisioned or reachable from untrusted networks; no public exploit identified at time of analysis.
Oracle BI Publisher (versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0) contains a flaw in its BI Publisher Security component that lets a low-privileged, network-reachable attacker read critical data and modify some data they should not be able to access. Because the vulnerable component is embedded in wider Oracle deployments, successful exploitation can cross a trust boundary and impact additional products (scope change). No public exploit code or active exploitation has been reported at time of analysis, and no EPSS or CISA KEV data was supplied.
Unauthenticated remote attackers with HTTP access to Oracle JDeveloper's Resource Catalog Services component can read critical data and cause partial denial of service, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the issue 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L), reflecting high confidentiality impact combined with limited availability impact and no integrity impact. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied in the source data, so exploitation appears opportunistic rather than confirmed in the wild.
Unauthenticated remote attackers can bypass authentication in Oracle Web Services Manager (Web Services Agent component) and gain unauthorized read access to critical data plus limited write access to some of the product's data. Affected are versions 12.2.1.4.0 and 14.1.2.0.0 of the Fusion Middleware product. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis, but the network-only, no-privilege, no-interaction attack profile (CVSS 8.2) makes exposed WSM deployments a high-value target for credential/assertion theft and configuration tampering.
Low-privileged local attackers who can log on to a host running Oracle Product Lifecycle Analytics 3.6.1 can exploit an installation-related weakness to cross a security boundary and gain unauthorized read and write access to critical data, including all data accessible through the application. The flaw carries a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) because exploitation is easy once logon is achieved, but it requires a local, authenticated foothold rather than remote network access. There is no public exploit identified at time of analysis and no EPSS or CISA KEV signal in the provided intelligence, so the immediate threat is primarily from insider, lateral-movement, or post-compromise abuse rather than opportunistic internet scanning.
Authenticated takeover of Oracle Product Lifecycle Analytics 3.6.1: an attacker holding a low-privileged account can reach the application over HTTP and, through a hard-to-trigger installation-related flaw in the Oracle Supply Chain component, gain full control of the service with complete confidentiality, integrity and availability impact. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), explicitly noting it is difficult to exploit, and no public exploit code or CISA KEV entry has been identified at the time of analysis. Realistic exposure is therefore concentrated in deployments where low-trust users can already authenticate to the product over the network.
Application takeover in Oracle Product Lifecycle Analytics 3.6.1 is reachable over HTTP by an attacker holding a low-privileged account, who can leverage a flaw in the installation-related component to seize full control of the application; Oracle rates it 7.5 with high confidentiality, integrity and availability impact. Exploitation is gated by high attack complexity and prior authentication, and no public exploit code or CISA KEV entry has been identified for this issue at time of analysis, leaving EPSS unquantified in the supplied data.
Unauthenticated, network-reachable attackers can achieve full takeover of Oracle Product Lifecycle Analytics 3.6.1 through a weakness in the Core component of Oracle Supply Chain, scoring CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, CWE-287 improper authentication). Exploitation requires no credentials, no user interaction, and no non-default configuration - only that the PLA HTTP interface be reachable from the attacker's network. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, though the vulnerability is rated Automatable: yes with Total technical impact, making it a high-priority target for internal enterprise deployments.
Takeover of Oracle Agile PLM 9.3.6 is achievable through the Event Java PX component, where an attacker with high privileges and network reachability over T3 or IIOP can fully compromise confidentiality, integrity, and availability while the scope change (S:C) allows significant impact on additional products. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), and the dominant real-world limiter is the PR:H requirement - the attacker must already hold an elevated, authenticated role, so realistic exploitation is confined to insiders or adversaries who have already compromised a privileged account. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (the CVE is not in CISA KEV).
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes a flaw in the Forge component that lets a low-privileged, network-connected attacker read data far beyond their authorization and degrade service availability. Because exploitation requires only a valid low-privilege account and a crafted HTTP request (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, 7.1), the confidentiality impact is severe while integrity is untouched. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, though Oracle has shipped a fix in its Critical Security Patch Update.
Unauthenticated remote takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is possible through the Forge component, which an attacker reachable over HTTP can abuse to gain full control of the platform (confidentiality, integrity and availability all rated High). Oracle scores it 8.1 with a High attack complexity, meaning the attack is feasible but requires favorable timing or a specific internal state rather than a trivial one-shot request. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a patch-now risk rather than an observed campaign.
Full compromise of Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 is possible through a flaw in the Forge component that lets a low-privileged attacker with network access over HTTP take over the affected system, with high confidentiality, integrity and availability impact. Oracle rates exploitation as difficult (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5), meaning an authenticated but unprivileged foothold plus conditions outside the attacker's direct control are required. No public exploit code, EPSS score, or CISA KEV listing was provided with this record, so at time of analysis there is no public exploit identified and no confirmed active exploitation.
Unauthenticated attackers with network access to the Forge indexing component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can achieve complete takeover of the platform, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.1). Oracle rates the flaw as difficult to exploit (AC:H), so it likely requires precise protocol knowledge, timing, or a race condition rather than a simple one-shot request. No public exploit code or CISA KEV listing is present in the available intelligence, and no EPSS score was supplied, so the practical exploitation likelihood remains unquantified.
Unauthenticated network attackers can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 through the Forge component, causing complete loss of confidentiality, integrity and availability of the platform. Oracle's own rating (CVSS 8.1, AV:N/AC:H/PR:N/UI:N) concedes the flaw is 'difficult to exploit', meaning a non-trivial timing or state precondition must be satisfied before the crafted TCP traffic succeeds, which materially lowers real-world urgency versus a typical 8.1. Exploitation status at time of analysis: no public exploit identified — there is no CISA KEV listing and no POC reference in the supplied intelligence, and no EPSS score was provided to quantify likelihood.
Full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by an unauthenticated remote attacker who can reach the Forge component over TCP, with successful exploitation yielding complete confidentiality, integrity, and availability impact (C:H/I:H/A:H) per Oracle's advisory and the corroborating ENISA EUVD-2026-79606 record. Oracle explicitly characterises the flaw as 'Difficult to exploit' (CVSS AC:H), meaning a condition outside the attacker's direct control - such as a timing window, race condition, or a specific data-processing state - must be satisfied before exploitation becomes reliable, so mass opportunistic scanning is unlikely. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data; practical exposure is bounded to installations where Forge is network-reachable, which for most deployments is an internal data-pipeline interface rather than an internet-facing default service.
Local attackers who already hold a logon on the host running Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can
Unauthenticated attackers with HTTP network reachability to the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can read critical application data, make limited unauthorized modifications, and degrade service availability. Oracle rates exploitation as difficult (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 7.0), so the flaw likely depends on timing, specific application state, or non-default conditions rather than a simple one-shot request. There is no public exploit code and no CISA KEV listing at time of analysis, and no EPSS score was included in the supplied intelligence, leaving real-world exploitation likelihood unquantified.
Local privilege escalation in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a low-privileged user who can log on to the underlying host to fully take over the platform, with the attack scope extending to additional products. Exploitation is rated difficult (high attack complexity) and requires prior local logon, so this is primarily an insider/co-tenancy and post-compromise escalation risk rather than a remotely reachable flaw. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; EPSS data was not supplied. Oracle released the fix as part of its Critical Patch Update advisory (cspusep2026.html), though the input does not state an exact patched build number.
Unauthenticated remote attackers with HTTP access to the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can trigger a hang or repeatedly crash the service while also reading a limited subset of its accessible data. The flaw carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, with low confidentiality and high availability impact), reflecting a trivially reachable, low-complexity attack against a supported but legacy enterprise search platform. No public exploit code or CISA KEV entry was identified at time of analysis, so the immediate driver is service availability rather than confirmed active exploitation.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can be fully taken over through a flaw in its Forge component. The vulnerability requires an attacker to already have a logon on the infrastructure hosting the product (local attack vector) but needs no privileges, and it only triggers when a person other than the attacker performs some interactive action, making it a local-vector, user-assisted code-execution class issue rated 7.8 by Oracle. Per the reference, the fix ships in Oracle's Critical Security Patch Update cspusep2026; no public exploit code and no CISA KEV listing were identified at time of analysis.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a vulnerability in the Forge component that lets an unauthenticated attacker reachable over HTTP take over the affected instance, with full confidentiality, integrity, and availability impact. Oracle rates the flaw 8.1 but notes it is difficult to exploit (AC:H), which suggests a race condition, timing dependency, or narrow parsing precondition rather than a straightforward request-and-execute path. No public exploit code has been identified and the issue is not listed in CISA KEV, so current exposure is driven by the value of an internet-facing commerce platform rather than by observed mass exploitation.
Unauthenticated remote attackers can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 by exploiting a difficult-to-trigger flaw in the Forge component that is reachable over HTTP. Oracle rates the issue CVSS 8.1 (AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity and availability impact) while explicitly describing it as hard to exploit. No public exploit code or CISA KEV entry has been identified, and no EPSS score was supplied with the advisory data, so active exploitation is not evidenced at time of analysis.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Forge component) can be compromised by an unauthenticated attacker who already sits on the same physical network segment as the host, yielding full read access to application data, limited data manipulation, and a repeatable denial-of-service condition. Oracle rates the flaw CVSS 7.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H), reflecting that it is reachable only from an adjacent segment and is difficult to trigger reliably. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Oracle has published a fix in its Critical Security Patch Update.
Information disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 lets a low-privileged attacker with HTTP network access read data far beyond their authorized scope, including critical business data reachable through the Experience Manager component. Oracle's own advisory assigns CVSS 3.1 base 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), flagging a scope change that can affect additional, connected products. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS signal was provided, so exposure should be judged against the existence of a reachable, authenticated foothold on the platform.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes an unauthenticated, network-reachable HTTP flaw that lets an attacker read and modify a subset of application data and degrade service availability, rated CVSS 7.3. Because the vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed - only reachability to the affected Experience Manager component. No public exploit code or CISA KEV entry was identified at time of analysis, so this should be treated as a high-severity patch-now item rather than a confirmed active campaign.
Unauthenticated attackers with network access can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 through a flaw in the Forge component, but only if a legitimate user is first induced to interact with attacker-supplied content delivered over HTTP. The vendor rates this CVSS 3.1 base 7.5 (AV:N/AC:H/PR:N/UI:R, C/I/A all High), reflecting high impact gated behind a difficult, interaction-dependent exploit path. No public exploit code and no CISA KEV listing were present in the supplied intelligence at time of analysis, and no EPSS score was provided, so the practical risk profile rests primarily on the vendor advisory and the internal exposure of the affected Forge endpoints.
Local low-privileged users who can log on to a host running Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can abuse the Forge component to create, delete or modify critical search data and to hang or repeatedly crash the service, producing high integrity and availability impact with no confidentiality exposure. The issue carries a CVSS 3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), so it is not remotely exploitable and requires a pre-existing authenticated foothold on the server, which keeps real-world risk genuinely moderate rather than urgent. There is no CISA KEV entry and no public exploit identified at time of analysis, and exploitation is not confirmed actively exploited.
Local privilege escalation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Endeca Application Controller component) allows an attacker who already holds a low-privileged logon on the host to fully compromise the application, affecting confidentiality, integrity, and availability. Oracle rates it 7.0 with CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attack requires local access and high complexity rather than remote reachability. No public exploit code has been identified, the CVE is not listed in CISA KEV, and no EPSS score was provided in the source data.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes its Forge component to a low-privileged, network-reachable attacker over HTTP, allowing unauthorized read access to critical data and a partial denial of service. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), meaning a valid but low-privileged account is enough and no user interaction is required. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but Oracle has published a fix in its Critical Patch Update advisory (cspusep2026.html), and the associated tags also categorize the issue as an authentication bypass.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (the Endeca-based Forge component) can be exploited over HTTP by a low-privileged authenticated attacker to read critical application data and cause a partial denial of service. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and low availability impact) and affects a single supported release, 11.4.0. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unconfirmed.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can be compromised over HTTP by an unauthenticated attacker who persuades another user to interact with attacker-supplied content, yielding high-impact confidentiality loss and partial data tampering that can cross component boundaries (CVSS 3.1 S:C). The published vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N with a base score of 8.2, and no CWE is assigned. No KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows an unauthenticated attacker with HTTP network access to read critical data — potentially the entire data set the platform can reach — through a flaw in the Experience Manager component. The issue is rated 7.5 with a confidentiality-only impact (C:H/I:N/A:N), meaning attackers can exfiltrate data but not modify or destroy it, and exploitation is trivially automatable (AV:N/AC:L/PR:N/UI:N). No public exploit code and no CISA KEV entry were identified at time of analysis, and Oracle has published a fix in its 2026 Critical Security Patch Update advisory.
Unauthenticated attackers with HTTP network access to the Experience Manager component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can bypass authentication and reach data and functions that should require a login. Successful exploitation yields high confidentiality impact - full read access to data the affected component can reach - plus limited integrity impact allowing unauthorized inserts, updates, or deletions of some records. Oracle rates this 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N); there is no public exploit code and no CISA KEV listing at time of analysis, but the unauthenticated, low-complexity attack path makes rapid patching the priority.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an access-control weakness in the Experience Manager component that lets a low-privileged authenticated user read critical data through ordinary HTTP requests, with the impact extending beyond the vulnerable component into other products (scope change). The vendor rates it CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — a confidentiality-only issue, with no integrity or availability impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied; exploitation is therefore likely to require a valid low-privileged account and deliberate targeting rather than opportunistic scanning.
Unauthenticated remote attackers who can reach the Oracle Data Integrator Console / Repository Explorer over HTTP can bypass authentication entirely (CWE-287) and take full control of the affected deployment, affecting versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle Fusion Middleware's ODI product. The flaw is rated CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction, and no special preconditions beyond network reachability of the console interface - the primary exposure limiter is whether the ODI Console is internet-facing versus segmented behind VPN or internal-only access. As of analysis, there is no CISA KEV entry and no public exploit identified at time of analysis, though CISA's SSVC assessment rates the issue as automatable with total technical impact, so patching should be treated as urgent rather than deferred.
Unauthenticated HTTP requests against Oracle Helidon deployments that use the helidon-dbclient-mongodb component can let a remote attacker read or modify MongoDB-backed data and cause a partial denial of service in versions 3.0.0–3.2.20 and 4.0.0–4.5.4. Oracle rates this CVSS 3.1 base 7.0 with high attack complexity (AV:N/AC:H/PR:N/UI:N), meaning successful exploitation depends on conditions that are difficult for an attacker to arrange. No public exploit code or CISA KEV listing was provided at time of analysis, so this should be treated as a patch-priority issue rather than an emergency.
Oracle Siebel CRM Deployment (Siebel Management Console) in versions 17.0 through 26.7 fails to properly restrict what a low-privileged, network-connected user can reach, letting that user read critical deployment data and make limited unauthorized changes. Exploitation is trivial once a valid low-privilege account exists: CVSS 3.1 scores it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N), with the confidentiality impact rated High and integrity impact Low. There is no public exploit code and no CISA KEV listing at time of analysis, so this is currently a patch-on-schedule item for Siebel shops rather than an emergency, though EPSS data was not supplied and the untrusted-network exposure of the management console should drive prioritization.
Takeover of Siebel CRM Deployment 17.0 through 26.7 is possible for high-privileged attackers via HTTP requests to the Siebel Management Console. Oracle rates this 9.1 Critical with low attack complexity and no user interaction, and a scope change means compromise can affect additional products beyond the vulnerable component. No public exploit or CISA KEV listing was identified in the provided data.
Unauthenticated remote denial of service in the Siebel CRM Deployment component (Server Infrastructure) of Oracle Siebel CRM affects supported releases 17.0 through 26.7, allowing any attacker with TCP network access to drive the Deployment service into a hang or frequently repeatable crash. Oracle rates the flaw CVSS 7.5 with a fully remote, low-complexity, no-privilege, no-interaction vector (AV:N/AC:L/PR:N/UI:N) but availability-only impact (C:N/I:N/A:H), meaning confidentiality and integrity of CRM data are not directly at risk. No public exploit code has been identified and the issue does not appear in CISA KEV, though Oracle's own advisory language describes it as 'easily exploitable', so exposure should be treated as urgent for internet- or WAN-reachable deployment instances.
Oracle Siebel CRM versions 17.0 through 26.7 contain a flaw in the Siebel CRM Integration (EAI) component that lets a low-privileged, network-positioned attacker achieve full takeover of the integration service over HTTP. Exploitation is rated difficult (CVSS AV:N/AC:H/PR:L/UI:N, base 7.5) and yields high confidentiality, integrity, and availability impact on the Integration component. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so the immediate risk is driven by patch urgency rather than confirmed in-the-wild activity.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 can be fully taken over by a low-privileged attacker who already holds a valid account and can reach the deployment over HTTP. The flaw is rated 7.5 with High complexity (AC:H), meaning it is not a trivial drive-by exploit but requires a favorable, harder-to-arrange condition to succeed; when it does, confidentiality, integrity, and availability are all fully compromised. There is no CISA KEV listing and no public exploit code identified at time of analysis, but Oracle has published a Security Alert with a patch, so exposure is patch-gated rather than just theoretical.
Unauthenticated remote denial of service in Oracle Siebel CRM Deployment (Server Infrastructure component) affects all supported releases from 17.0 through 26.7 and lets any attacker who can reach the deployment service over TCP hang or repeatedly crash it, with CVSS 3.1 scored 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only). Because the flaw needs no credentials, no user interaction, and no special conditions, any internet- or WAN-exposed deployment endpoint is at risk of sustained outage, though impact is limited to availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Oracle's CPU-style advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source.
Oracle Siebel CRM Deployment (Server Infrastructure component) in supported releases 17.0 through 26.7 exposes critical CRM data to a low-privileged, network-positioned attacker who can reach the deployment service over HTTP, and also allows that attacker to partially degrade availability. Oracle rates it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/A:L) and describes it as easily exploitable in its cspusep2026 security alert; there is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the source data.
Low-privileged attackers who can reach Oracle Siebel CRM Deployment over HTTP can exploit a hard-to-trigger flaw in the Siebel Remote component to fully take over the deployment, gaining high confidentiality, integrity and availability impact across the affected system. The vendor lists all supported Siebel CRM Deployment releases from 17.0 through 26.7 as affected, and rates the issue CVSS 3.1 7.5 with a high attack-complexity metric, meaning successful exploitation demands precise conditions rather than a straightforward request. No public exploit code and no CISA KEV listing were identified at time of analysis, so exploitation currently appears to require attacker-specific research or favorable timing rather than off-the-shelf tooling.
Unauthenticated denial of service against Oracle Siebel CRM Deployment (Server Infrastructure component) lets network-reachable attackers hang or repeatedly crash the service, taking the deployment offline; affected releases span 17.0 through 26.7. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U, availability-only impact), meaning no credentials, no user interaction, and no special complexity are required — a low bar for automation. No public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis, so the immediate concern is exposure management rather than confirmed active exploitation.
Oracle Siebel CRM Integration (EAI component) versions 17.0 through 26.7 expose a network-reachable SOAP interface that fails to properly restrict operations for authenticated low-privileged users, letting an attacker read critical CRM data and perform limited unauthorized inserts, updates, or deletions. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N) and is rated 'easily exploitable' by the vendor, requiring only a valid low-privilege account and network reachability to the EAI endpoint. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
Oracle Siebel CRM Integration versions 23.6 through 26.7 expose the Event Publish and Subscribe component to unauthenticated attackers who can reach the server from the same network segment, allowing them to read, create, delete, or modify critical CRM data (CVSS 3.1 base 8.1, AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:N). Because the attack vector is adjacent network rather than internet-facing, exposure is gated by network topology rather than by credentials, and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis. Exploitation probability scoring (EPSS) was not supplied with the source data, so prioritization should rest on asset criticality and segment reachability.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.7, allows an attacker who already holds a low-privileged logon on the host where the deployment component runs to read, create, modify, and delete all data accessible to that deployment. The vulnerability is locally exploitable with low complexity and no user interaction, but it does not grant entry to the host itself — it escalates what an existing low-privileged account can reach across the Siebel deployment layer, producing high confidentiality and integrity impact (CVSS 3.1 base 7.1) with no availability impact. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score, CWE mapping, or confirmed fix version was supplied with the source data.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contain an authentication-related flaw that lets a remote, unauthenticated attacker over HTTP read, create, delete, or modify critical deployment data - CVSS 3.1 base 7.4 with high confidentiality and integrity impact. Exploitation is rated difficult (AC:H), presumably because the attacker must meet a hard-to-satisfy protocol or timing condition, but no privileges or user interaction are required if that condition is met. Oracle has published a fix via its Critical Security Patch Update advisory; active exploitation is not confirmed and no public exploit code was identified in the supplied intelligence.
Improper access control in the Open UI component of Oracle Siebel CRM (End User) versions 17.0 through 26.7 lets an authenticated low-privilege user issue crafted HTTP requests that expose and modify data beyond their authorized scope. Successful exploitation yields high confidentiality impact — unauthorized read of critical Siebel data — plus limited integrity impact via unauthorized insert, update or delete operations; availability is unaffected (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). No CISA KEV listing, public exploit code or EPSS signal is present in the supplied intelligence, so this is currently a patch-cycle priority rather than a confirmed actively exploited issue.
A local privilege-escalation flaw in the Siebel CRM Deployment component (Server Infrastructure) lets a low-privileged user who can log on to the host where Siebel CRM Deployment runs take full control of that deployment. All supported releases from 17.0 through 26.7 are affected, with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact). Oracle published the fix in its Critical Security Patch Update advisory; no public exploit code or CISA KEV entry was identified at time of analysis, so the practical threat is currently insider- or foothold-driven rather than mass-exploited.
Unauthenticated attackers with HTTP network reachability to the Siebel CRM Deployment component of Oracle Siebel CRM can bypass authentication and gain unauthorized access to critical data, plus limited ability to update, insert, or delete records. The flaw affects supported Siebel CRM versions 17.0 through 26.7 and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N). No public exploit code or active exploitation has been identified from the available intelligence at time of analysis.
Local privilege escalation in Oracle Siebel CRM Deployment (Server Infrastructure component) lets any low-privileged user who can log on to the host running the Deployment service take full control of that deployment. All supported releases from 17.0 through 26.7 are affected, and successful exploitation yields complete loss of confidentiality, integrity and availability of the Siebel environment (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and absence of user interaction mean any compromised service or operator account on a Siebel host is a viable stepping stone.
Oracle BI Publisher (an Oracle Analytics reporting component) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 contain a flaw in the Web Server component that lets a low-privileged, network-positioned attacker read critical data and alter or delete a subset of records through HTTP, with impact potentially extending beyond the vulnerable component to other Oracle Analytics products. Oracle rates it CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) in its October-lineage Security Alert. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so active exploitation is unconfirmed.
Oracle BI Publisher (part of Oracle Analytics) is affected by a network-reachable flaw in its BI Platform Security component that lets a low-privileged, authenticated attacker via SOAP tamper with or delete critical reporting data and repeatedly crash the service, enabling a full denial of service. Versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are listed as affected, and the vendor rates it 8.1 with high integrity and availability impact while confidentiality is untouched. No public exploit code or CISA KEV listing was present in the supplied intelligence, and EPSS data was not provided, so real-world exploitation status is unconfirmed.
Low-privileged attackers with HTTP access to Oracle BI Publisher can exploit a flaw in the BI Platform Security component to read and modify critical report data and partially disrupt the service. The issue affects BI Publisher 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 and carries a CVSS 3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, low availability impact). No public exploit code or EPSS/KEV data was supplied with this record, so exploitation status at time of analysis is no public exploit identified at time of analysis, though the low complexity and authenticated-but-network-reachable attack path make it attractive for post-compromise lateral movement inside Oracle Fusion Middleware estates.
An authenticated remote attacker with low privileges can fully take over Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 by sending crafted HTTP requests to the Resource Catalog Services component, which is part of Oracle Fusion Middleware. The flaw is rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning successful exploitation yields complete loss of confidentiality, integrity and availability of the affected JDeveloper instance. No CWE, EPSS score, KEV entry or public proof-of-concept was supplied in the source data, so active exploitation is not confirmed, but the low attack complexity and lack of user interaction make rapid patching advisable once the Oracle CPU fix is applied.
Unauthenticated remote attackers can compromise Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 through the HTTP interface, gaining high-impact read access to all data reachable by the application plus limited write and partial denial-of-service capability. Oracle rates the flaw 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) and classifies it as easily exploitable in the BI Platform Security component of Oracle Analytics; no public exploit code, EPSS score, or CISA KEV entry was supplied with the source data at time of analysis.
Oracle Business Intelligence Enterprise Edition (8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0) exposes an unauthenticated, network-reachable flaw in the Analytics Web General component that lets an attacker read and tamper with critical data and degrade service availability, with the impact extending beyond the vulnerable product itself (scope change). Oracle rates it 8.9 but flags it as difficult to exploit, meaning the high attack complexity — not missing credentials or user interaction — is the main barrier. No public exploit code and no CISA KEV listing were identified at time of analysis.
Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 contain a flaw in the BI Platform Security component that lets a low-privileged attacker with network access to the SOAP interface alter or delete critical report and platform data, and read a limited portion of it. The CVSS 3.1 base score is 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N), driven by a scope change that means compromise of BI Publisher can cascade into other Oracle Analytics components. No public exploit code or active exploitation has been identified at time of analysis, and no CWE or EPSS data was supplied.
Oracle BI Publisher 12.2.1.4.0, the enterprise reporting tier of Oracle Analytics, lets a low-privileged network attacker reach data well beyond their granted entitlements and partially degrade the service through crafted HTTP requests to the BI Publisher Security component. Oracle scores it 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), and the scope-change metric indicates that a compromised deployment can expose additional, integrated Oracle products that trust BI Publisher. No public exploit code, CISA KEV listing, or EPSS estimate was supplied with the source data, so exploitation status at time of analysis is 'no public exploit identified' and remediation depends on the referenced Oracle security alert.
Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 contains an easily exploitable flaw in the Service Administration UI component that allows a low-privileged attacker with network access over HTTP to fully take over the platform, with high confidentiality, integrity, and availability impact (CVSS 8.8). Because exploitation only requires a valid low-privileged account rather than an administrator, any provisioned BI user could potentially escalate to full control of the BI deployment. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS data supplied; Oracle has published a Critical Security Patch Update advisory covering the issue.
A low-privileged authenticated attacker with HTTP network access can exploit the Install component of Oracle XML Gateway in Oracle E-Business Suite 12.2.3 through 12.2.15 to read critical data, gain complete access to all XML Gateway-accessible data, and trigger a partial denial of service. The vulnerability carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), indicating easy exploitation once valid credentials are held, with confidentiality as the dominant impact. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the only intelligence source is Oracle's September 2026 Critical Patch Update advisory.
Unauthenticated attackers with network reachability to the Analytics Web component of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can exploit a hard-to-trigger flaw to fully compromise the platform, achieving high confidentiality, integrity and availability impact consistent with a complete takeover. Oracle rates this CVSS 3.1 base 8.1 with attack complexity High, meaning exploitation depends on conditions outside the attacker's direct control rather than simply sending a request. No public exploit code has been identified and the issue is not listed in CISA KEV, so measured risk is driven by exposure of the Analytics Web HTTP interface rather than by observed in-the-wild activity.
Oracle BI Publisher 12.2.1.4.0 can be fully taken over by an attacker who already holds a high-privileged account and can reach the product's HTTP interface, with complete loss of confidentiality, integrity and availability (CVSS 3.1 base 7.2). The defect resides in the BI Platform Security component of Oracle Analytics and is rated low-complexity with no user interaction required, so a single crafted request from a privileged session is sufficient. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied with the source data.
Oracle BI Publisher (Oracle Analytics, BI Platform Security component) in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 permits a low-privileged attacker with network reach to the LDAP-facing interface to read, create, delete or modify critical BI Publisher data, effectively breaking the authorization boundary between a basic account and the full reporting repository. Oracle scores this 8.1 with high confidentiality and integrity impact, low attack complexity and no user interaction, making it trivially automatable once a low-privileged credential is held. No public exploit code and no CISA KEV listing were present at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unmeasured rather than confirmed.
Low-privileged users with HTTP access to Oracle Business Intelligence Enterprise Edition can exploit a hard-to-trigger flaw in the BI Search component to gain full control of the platform, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected supported versions are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. At the time of analysis there is no CISA KEV entry and no public exploit identified; the 7.5 score reflects the vendor's own assessment and exploitation is gated by a high attack-complexity condition.
Oracle Business Intelligence Enterprise Edition (Analytics) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 contain a hard-to-exploit but high-impact flaw in the Presentation Services component that a low-privileged, network-positioned attacker can reach over SOAP to fully take over the BI platform. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a valid low-privilege account and defeat the non-trivial attack complexity. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a patch-priority issue for exposed BI deployments rather than a confirmed active campaign.
Full takeover of Oracle Business Intelligence Enterprise Edition is achievable when an attacker who already holds logon access to the host running the platform induces a different user to perform one interaction, letting them compromise the Platform Security component and gain control over confidentiality, integrity and availability. Supported releases 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are affected; Oracle scores the issue 7.8 with a local access vector and required user interaction. No public exploit code has been identified and the flaw is not listed in CISA KEV, so practical exploitation is currently limited to parties who already have host-level access; no EPSS data was supplied with the intelligence.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 lets any user who already holds a low-privileged logon to the infrastructure hosting the BI server take full control of the platform, with complete loss of confidentiality, integrity and availability. The flaw sits in the FNDN (foundation) component and is rated 7.8 by Oracle, but it is a local vector (AV:L/PR:L) rather than a network-reachable bug, so exploitation requires prior host access as an ordinary user. No public exploit code or active exploitation is identified in the available data, and no EPSS score, KEV entry or CWE classification was supplied.
Complete takeover of Oracle Business Intelligence Enterprise Edition is achievable by a low-privileged attacker who can reach the product's HTTP interface in versions 8.2.0.0.0 and 26.01.0.0.0, through a flaw in the Platform Security component. Oracle rates it 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning confidentiality, integrity and availability of the BI platform are all fully at risk, but exploitation is difficult and requires an existing low-privileged account. At time of analysis there is no CISA KEV listing, no public exploit code, and no EPSS score in the supplied intelligence.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (Platform Security component) lets a low-privileged user who can log on to the host running the BI software take full control of the deployment. Affected releases are 8.2.0.0.0 and 26.01.0.0.0, which receive complete confidentiality, integrity and availability impact on successful exploitation. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the practical barrier is that the attacker must already hold some form of logon/execution capability on the infrastructure where OBIEE runs.
A locally exploitable privilege-escalation flaw in the Platform Security component of Oracle Business Intelligence Enterprise Edition (Oracle Analytics) lets any user who can log on to the operating-system host running the product take full control of the BI platform. Affected supported releases are 8.2.0.0.0 and 26.01.0.0.0. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), the exploit is trivial once host access exists, and no public exploit code or CISA KEV listing was identified at time of analysis, so risk is concentrated in environments where untrusted or over-privileged local accounts exist on BI servers.
Oracle Business Intelligence Enterprise Edition (BI EE, part of Oracle Analytics) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 can be fully taken over by a low-privileged attacker who already holds a valid account and can reach the product's SOAP interface over the network. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity and availability of the Analytics platform, but the vendor also classifies it as 'difficult to exploit', so successful attacks likely require significant timing, sequencing or state knowledge rather than a simple request. No CISA KEV listing, EPSS score or public exploit code was included in the reporting data, and no CWE was assigned, so the precise root-cause class remains undocumented by the vendor.
Local privilege escalation to full instance takeover in Oracle Business Intelligence Enterprise Edition (component: BI Search) affects versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. An attacker who can log on to the host running the BI EE service with only low-privileged credentials can exploit the BI Search component to gain complete control of the platform, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8). No public exploit code or CISA KEV entry is identified in the available data, so this is treated as a patch-now hardening issue rather than an observed campaign.
Oracle Business Intelligence Enterprise Edition (Presentation Services component) fails to properly enforce access controls on its SOAP interface, allowing a user holding only a low-privileged account to read data they should never be able to reach — up to and including all BI data accessible through the platform, with a claimed spillover effect on additional products. Affected releases are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0; Oracle rates it CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), meaning confidentiality-only impact, no integrity or availability loss, and no user interaction. No public exploit code has been identified and the flaw is not listed in CISA KEV, but the barrier to entry is low once any valid BI account is obtained, so the exposure is meaningful for internet- or partner-reachable deployments.
Unauthenticated network attackers can achieve complete takeover of Oracle Business Intelligence Enterprise Edition (Analytics) by exploiting a flaw in the Platform Security component of versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Oracle describes the flaw as 'difficult to exploit' but rates it 8.1 with full confidentiality, integrity and availability impact, so a successful attack means total loss of control over the BI platform and the analytical data it exposes. No EPSS score, KEV listing or public exploit code is present in the input, so there is no public exploit identified at time of analysis, though the unauthenticated network vector makes patching urgent for internet- or intranet-exposed deployments.
Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 contains a flaw in the BI Search component that lets a low-privileged, network-positioned user read, create, modify and delete critical BI data and partially disrupt the service. The CVSS 3.1 base score is 8.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), reflecting a remotely reachable, easily automated attack that yields high confidentiality and integrity impact with a limited availability impact. No public exploit code or CISA KEV listing is present in the supplied intelligence, and the affected build is a single supported release, so exposure is limited to organisations running that version until the Oracle patch from the referenced security alert is applied.
Unauthenticated remote attackers can crash and partially tamper with Oracle BI Publisher by sending crafted requests to its SOAP web services, affecting versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. The flaw is rated CVSS 8.6 (AV:N/AC:L/PR:N/UI:N) with high availability impact plus low confidentiality and integrity impact, meaning a successful hit can hang or repeatedly crash the service while also allowing unauthorized read and update/insert/delete access to some BI Publisher data. No public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so the practical exploitation risk must currently be judged from the exposure of the SOAP interface rather than from observed attack activity.
Authentication bypass in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 (Platform Security component) lets an unauthenticated remote attacker with HTTP access take over the BI platform, yielding full confidentiality, integrity, and availability impact (CVSS 3.1 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation have been identified at time of analysis, so exposure drives urgency: internet-facing BI EE instances are the highest priority, while internal-only deployments carry materially lower reach. The blast radius is bounded by the fact that only the single supported release 12.2.1.4.0 is affected and the sole prerequisite is network reachability of the BI EE HTTP interface.
Authenticated takeover of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 is achievable through the Platform Security component by a low-privileged attacker with network HTTP access, producing high confidentiality, integrity and availability impact (CVSS 9.9, scope change). Exploitation is straightforward once any valid low-privilege credential or session is held - attack complexity is low and no user interaction is required - and the scope change means a successful compromise can extend beyond BI EE into other products integrated with the platform. No public exploit code has been identified at time of analysis, and Oracle classifies the flaw as easily exploitable in its Critical Security Patch Update advisory.
Unauthenticated remote denial of service in Oracle Helidon's helidon-webserver component (versions 4.0.0 through 4.5.4) allows any network-reachable attacker to drive the server into a hang or a repeatable crash, fully denying service. The flaw is rated CVSS 7.5 with a network vector and no authentication or user interaction required, and Oracle lists it in its Fusion Middleware security advisory, making exposure a direct function of whether the Helidon HTTP listener is reachable. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation, but the trivial attack prerequisites mean it should be treated as remotely exploitable by unsophisticated actors.
Unauthenticated HTTP/2 traffic can hang or repeatedly crash the Oracle Helidon webserver, allowing a remote attacker to take a Helidon-hosted application offline. Oracle rates it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so the only impact is availability, but it requires no credentials and no user interaction. Affected releases are Helidon 4.0.0 through 4.5.4; no public exploit code or CISA KEV entry is present in the available data, and no EPSS score was supplied, so the current exploitation status is unconfirmed.
A local privilege-escalation and data-tampering flaw in the CAX Client component of Oracle Agile PLM MCAD Connector 3.6 lets a low-privileged user who can already log on to the host running the connector create, modify, or delete critical PLM data, while also exposing a limited subset of that data to unauthorized reads. Because the vulnerability sits in the connector but the resulting actions reach other integrated products, Oracle assigns a scope change (S:C) and a CVSS 3.1 base score of 7.3. There is no CISA KEV listing, no public exploit code, and no EPSS data in the supplied intelligence, so the issue is currently patch-driven rather than evidence of active exploitation.
Unauthenticated HTTP/2 traffic can hang or repeatedly crash Oracle Helidon versions 4.0.0 through 4.5.4 through a flaw in the helidon-webclient-http2 component, giving a full denial-of-service of the affected service. The issue is network-reachable with no credentials and no user interaction (CVSS 3.1 base 7.5, availability-only impact). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though Oracle's own advisory describes the flaw as 'easily exploitable', so the barrier to a working denial-of-service is judged to be low.
Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 contains a flaw in its Platform Security component that allows a high-privileged, authenticated attacker with HTTP network access to fully take over the BI platform, with high confidentiality, integrity and availability impact. Oracle rates it CVSS 7.2 (AV:N/AC:L/PR:H/UI:N) and the affected version is limited to 26.01.0.0.0. No public exploit code or CISA KEV entry was supplied with the available intelligence, so exploitation is not confirmed to be occurring in the wild.
Oracle Text, the full-text indexing subsystem bundled with Oracle Database Server, contains a scope-escalating flaw that lets a low-privileged database account holding the Create Index privilege take over Oracle Text when reached over Oracle Net. Affected builds are 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3; successful exploitation yields high confidentiality, integrity, and availability impact and, per Oracle's own scope-change rating, can spill over to other database components. Exploitation is rated difficult (AC:H) and no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Oracle Database Server's RDBMS component (19c 19.3–19.32, 21c 21.3–21.23, and 23ai 23.4.0–23.26.3) can be fully compromised by a low-privileged database account that holds EXECUTE on the DBMS_REDEFINITION package. An attacker reaching the database over Oracle Net can abuse that package to achieve takeover of the RDBMS, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV listing were identified in the supplied intelligence at the time of analysis; the vulnerability is addressed by Oracle's Critical Security Patch Update referenced at oracle.com/security-alerts/cspusep2026.html.
Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 contain an unauthenticated, network-reachable weakness in the BI Platform Security component that lets an attacker read critical business data, potentially everything the BI platform itself can access. Oracle scores it 7.5 with a vector of AV:N/AC:L/PR:N/UI:N and confidentiality-only impact, and the vendor's own tagging classifies it as an authentication bypass. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data.
Authentication bypass in Oracle BI Publisher (BI Platform Security component of Oracle Analytics) lets unauthenticated remote attackers with HTTP access take over the affected system, with full confidentiality, integrity, and availability impact. Affected versions are 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and score of 9.8 confirm an easily exploitable, automatable condition; no public exploit or evidence of active exploitation was identified at time of analysis, but CISA SSVC classifies technical impact as total and the vulnerability is automatable, making exposed instances a high priority to patch or isolate.
High-privileged takeover of Oracle BI Publisher is possible through the BI Platform Security component in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, where an attacker who already holds administrative access on the instance can exploit the flaw over HTTP with a Critical CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), taking over the application with full confidentiality, integrity and availability impact. Because the CVSS scope metric is changed (S:C), a successful compromise can extend beyond BI Publisher into additional integrated products rather than being contained by the BI Publisher trust boundary. Exploitation is authenticated and privilege-gated (PR:H) with no user interaction required, so realistic risk is concentrated in deployments where administrative accounts are shared, over-provisioned or reachable from untrusted networks; no public exploit identified at time of analysis.
Oracle BI Publisher (versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0) contains a flaw in its BI Publisher Security component that lets a low-privileged, network-reachable attacker read critical data and modify some data they should not be able to access. Because the vulnerable component is embedded in wider Oracle deployments, successful exploitation can cross a trust boundary and impact additional products (scope change). No public exploit code or active exploitation has been reported at time of analysis, and no EPSS or CISA KEV data was supplied.
Unauthenticated remote attackers with HTTP access to Oracle JDeveloper's Resource Catalog Services component can read critical data and cause partial denial of service, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the issue 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L), reflecting high confidentiality impact combined with limited availability impact and no integrity impact. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied in the source data, so exploitation appears opportunistic rather than confirmed in the wild.
Unauthenticated remote attackers can bypass authentication in Oracle Web Services Manager (Web Services Agent component) and gain unauthorized read access to critical data plus limited write access to some of the product's data. Affected are versions 12.2.1.4.0 and 14.1.2.0.0 of the Fusion Middleware product. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis, but the network-only, no-privilege, no-interaction attack profile (CVSS 8.2) makes exposed WSM deployments a high-value target for credential/assertion theft and configuration tampering.
Low-privileged local attackers who can log on to a host running Oracle Product Lifecycle Analytics 3.6.1 can exploit an installation-related weakness to cross a security boundary and gain unauthorized read and write access to critical data, including all data accessible through the application. The flaw carries a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) because exploitation is easy once logon is achieved, but it requires a local, authenticated foothold rather than remote network access. There is no public exploit identified at time of analysis and no EPSS or CISA KEV signal in the provided intelligence, so the immediate threat is primarily from insider, lateral-movement, or post-compromise abuse rather than opportunistic internet scanning.
Authenticated takeover of Oracle Product Lifecycle Analytics 3.6.1: an attacker holding a low-privileged account can reach the application over HTTP and, through a hard-to-trigger installation-related flaw in the Oracle Supply Chain component, gain full control of the service with complete confidentiality, integrity and availability impact. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), explicitly noting it is difficult to exploit, and no public exploit code or CISA KEV entry has been identified at the time of analysis. Realistic exposure is therefore concentrated in deployments where low-trust users can already authenticate to the product over the network.
Application takeover in Oracle Product Lifecycle Analytics 3.6.1 is reachable over HTTP by an attacker holding a low-privileged account, who can leverage a flaw in the installation-related component to seize full control of the application; Oracle rates it 7.5 with high confidentiality, integrity and availability impact. Exploitation is gated by high attack complexity and prior authentication, and no public exploit code or CISA KEV entry has been identified for this issue at time of analysis, leaving EPSS unquantified in the supplied data.
Unauthenticated, network-reachable attackers can achieve full takeover of Oracle Product Lifecycle Analytics 3.6.1 through a weakness in the Core component of Oracle Supply Chain, scoring CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, CWE-287 improper authentication). Exploitation requires no credentials, no user interaction, and no non-default configuration - only that the PLA HTTP interface be reachable from the attacker's network. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, though the vulnerability is rated Automatable: yes with Total technical impact, making it a high-priority target for internal enterprise deployments.
Takeover of Oracle Agile PLM 9.3.6 is achievable through the Event Java PX component, where an attacker with high privileges and network reachability over T3 or IIOP can fully compromise confidentiality, integrity, and availability while the scope change (S:C) allows significant impact on additional products. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), and the dominant real-world limiter is the PR:H requirement - the attacker must already hold an elevated, authenticated role, so realistic exploitation is confined to insiders or adversaries who have already compromised a privileged account. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (the CVE is not in CISA KEV).
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes a flaw in the Forge component that lets a low-privileged, network-connected attacker read data far beyond their authorization and degrade service availability. Because exploitation requires only a valid low-privilege account and a crafted HTTP request (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, 7.1), the confidentiality impact is severe while integrity is untouched. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, though Oracle has shipped a fix in its Critical Security Patch Update.
Unauthenticated remote takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is possible through the Forge component, which an attacker reachable over HTTP can abuse to gain full control of the platform (confidentiality, integrity and availability all rated High). Oracle scores it 8.1 with a High attack complexity, meaning the attack is feasible but requires favorable timing or a specific internal state rather than a trivial one-shot request. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a patch-now risk rather than an observed campaign.
Full compromise of Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 is possible through a flaw in the Forge component that lets a low-privileged attacker with network access over HTTP take over the affected system, with high confidentiality, integrity and availability impact. Oracle rates exploitation as difficult (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5), meaning an authenticated but unprivileged foothold plus conditions outside the attacker's direct control are required. No public exploit code, EPSS score, or CISA KEV listing was provided with this record, so at time of analysis there is no public exploit identified and no confirmed active exploitation.
Unauthenticated attackers with network access to the Forge indexing component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can achieve complete takeover of the platform, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.1). Oracle rates the flaw as difficult to exploit (AC:H), so it likely requires precise protocol knowledge, timing, or a race condition rather than a simple one-shot request. No public exploit code or CISA KEV listing is present in the available intelligence, and no EPSS score was supplied, so the practical exploitation likelihood remains unquantified.
Unauthenticated network attackers can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 through the Forge component, causing complete loss of confidentiality, integrity and availability of the platform. Oracle's own rating (CVSS 8.1, AV:N/AC:H/PR:N/UI:N) concedes the flaw is 'difficult to exploit', meaning a non-trivial timing or state precondition must be satisfied before the crafted TCP traffic succeeds, which materially lowers real-world urgency versus a typical 8.1. Exploitation status at time of analysis: no public exploit identified — there is no CISA KEV listing and no POC reference in the supplied intelligence, and no EPSS score was provided to quantify likelihood.
Full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by an unauthenticated remote attacker who can reach the Forge component over TCP, with successful exploitation yielding complete confidentiality, integrity, and availability impact (C:H/I:H/A:H) per Oracle's advisory and the corroborating ENISA EUVD-2026-79606 record. Oracle explicitly characterises the flaw as 'Difficult to exploit' (CVSS AC:H), meaning a condition outside the attacker's direct control - such as a timing window, race condition, or a specific data-processing state - must be satisfied before exploitation becomes reliable, so mass opportunistic scanning is unlikely. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data; practical exposure is bounded to installations where Forge is network-reachable, which for most deployments is an internal data-pipeline interface rather than an internet-facing default service.
Local attackers who already hold a logon on the host running Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can
Unauthenticated attackers with HTTP network reachability to the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can read critical application data, make limited unauthorized modifications, and degrade service availability. Oracle rates exploitation as difficult (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 7.0), so the flaw likely depends on timing, specific application state, or non-default conditions rather than a simple one-shot request. There is no public exploit code and no CISA KEV listing at time of analysis, and no EPSS score was included in the supplied intelligence, leaving real-world exploitation likelihood unquantified.
Local privilege escalation in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a low-privileged user who can log on to the underlying host to fully take over the platform, with the attack scope extending to additional products. Exploitation is rated difficult (high attack complexity) and requires prior local logon, so this is primarily an insider/co-tenancy and post-compromise escalation risk rather than a remotely reachable flaw. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; EPSS data was not supplied. Oracle released the fix as part of its Critical Patch Update advisory (cspusep2026.html), though the input does not state an exact patched build number.
Unauthenticated remote attackers with HTTP access to the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can trigger a hang or repeatedly crash the service while also reading a limited subset of its accessible data. The flaw carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, with low confidentiality and high availability impact), reflecting a trivially reachable, low-complexity attack against a supported but legacy enterprise search platform. No public exploit code or CISA KEV entry was identified at time of analysis, so the immediate driver is service availability rather than confirmed active exploitation.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can be fully taken over through a flaw in its Forge component. The vulnerability requires an attacker to already have a logon on the infrastructure hosting the product (local attack vector) but needs no privileges, and it only triggers when a person other than the attacker performs some interactive action, making it a local-vector, user-assisted code-execution class issue rated 7.8 by Oracle. Per the reference, the fix ships in Oracle's Critical Security Patch Update cspusep2026; no public exploit code and no CISA KEV listing were identified at time of analysis.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a vulnerability in the Forge component that lets an unauthenticated attacker reachable over HTTP take over the affected instance, with full confidentiality, integrity, and availability impact. Oracle rates the flaw 8.1 but notes it is difficult to exploit (AC:H), which suggests a race condition, timing dependency, or narrow parsing precondition rather than a straightforward request-and-execute path. No public exploit code has been identified and the issue is not listed in CISA KEV, so current exposure is driven by the value of an internet-facing commerce platform rather than by observed mass exploitation.
Unauthenticated remote attackers can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 by exploiting a difficult-to-trigger flaw in the Forge component that is reachable over HTTP. Oracle rates the issue CVSS 8.1 (AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity and availability impact) while explicitly describing it as hard to exploit. No public exploit code or CISA KEV entry has been identified, and no EPSS score was supplied with the advisory data, so active exploitation is not evidenced at time of analysis.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Forge component) can be compromised by an unauthenticated attacker who already sits on the same physical network segment as the host, yielding full read access to application data, limited data manipulation, and a repeatable denial-of-service condition. Oracle rates the flaw CVSS 7.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H), reflecting that it is reachable only from an adjacent segment and is difficult to trigger reliably. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Oracle has published a fix in its Critical Security Patch Update.
Information disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 lets a low-privileged attacker with HTTP network access read data far beyond their authorized scope, including critical business data reachable through the Experience Manager component. Oracle's own advisory assigns CVSS 3.1 base 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), flagging a scope change that can affect additional, connected products. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS signal was provided, so exposure should be judged against the existence of a reachable, authenticated foothold on the platform.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes an unauthenticated, network-reachable HTTP flaw that lets an attacker read and modify a subset of application data and degrade service availability, rated CVSS 7.3. Because the vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed - only reachability to the affected Experience Manager component. No public exploit code or CISA KEV entry was identified at time of analysis, so this should be treated as a high-severity patch-now item rather than a confirmed active campaign.
Unauthenticated attackers with network access can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 through a flaw in the Forge component, but only if a legitimate user is first induced to interact with attacker-supplied content delivered over HTTP. The vendor rates this CVSS 3.1 base 7.5 (AV:N/AC:H/PR:N/UI:R, C/I/A all High), reflecting high impact gated behind a difficult, interaction-dependent exploit path. No public exploit code and no CISA KEV listing were present in the supplied intelligence at time of analysis, and no EPSS score was provided, so the practical risk profile rests primarily on the vendor advisory and the internal exposure of the affected Forge endpoints.
Local low-privileged users who can log on to a host running Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can abuse the Forge component to create, delete or modify critical search data and to hang or repeatedly crash the service, producing high integrity and availability impact with no confidentiality exposure. The issue carries a CVSS 3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), so it is not remotely exploitable and requires a pre-existing authenticated foothold on the server, which keeps real-world risk genuinely moderate rather than urgent. There is no CISA KEV entry and no public exploit identified at time of analysis, and exploitation is not confirmed actively exploited.
Local privilege escalation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Endeca Application Controller component) allows an attacker who already holds a low-privileged logon on the host to fully compromise the application, affecting confidentiality, integrity, and availability. Oracle rates it 7.0 with CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attack requires local access and high complexity rather than remote reachability. No public exploit code has been identified, the CVE is not listed in CISA KEV, and no EPSS score was provided in the source data.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes its Forge component to a low-privileged, network-reachable attacker over HTTP, allowing unauthorized read access to critical data and a partial denial of service. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), meaning a valid but low-privileged account is enough and no user interaction is required. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but Oracle has published a fix in its Critical Patch Update advisory (cspusep2026.html), and the associated tags also categorize the issue as an authentication bypass.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (the Endeca-based Forge component) can be exploited over HTTP by a low-privileged authenticated attacker to read critical application data and cause a partial denial of service. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and low availability impact) and affects a single supported release, 11.4.0. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unconfirmed.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can be compromised over HTTP by an unauthenticated attacker who persuades another user to interact with attacker-supplied content, yielding high-impact confidentiality loss and partial data tampering that can cross component boundaries (CVSS 3.1 S:C). The published vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N with a base score of 8.2, and no CWE is assigned. No KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows an unauthenticated attacker with HTTP network access to read critical data — potentially the entire data set the platform can reach — through a flaw in the Experience Manager component. The issue is rated 7.5 with a confidentiality-only impact (C:H/I:N/A:N), meaning attackers can exfiltrate data but not modify or destroy it, and exploitation is trivially automatable (AV:N/AC:L/PR:N/UI:N). No public exploit code and no CISA KEV entry were identified at time of analysis, and Oracle has published a fix in its 2026 Critical Security Patch Update advisory.
Unauthenticated attackers with HTTP network access to the Experience Manager component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can bypass authentication and reach data and functions that should require a login. Successful exploitation yields high confidentiality impact - full read access to data the affected component can reach - plus limited integrity impact allowing unauthorized inserts, updates, or deletions of some records. Oracle rates this 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N); there is no public exploit code and no CISA KEV listing at time of analysis, but the unauthenticated, low-complexity attack path makes rapid patching the priority.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains an access-control weakness in the Experience Manager component that lets a low-privileged authenticated user read critical data through ordinary HTTP requests, with the impact extending beyond the vulnerable component into other products (scope change). The vendor rates it CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — a confidentiality-only issue, with no integrity or availability impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied; exploitation is therefore likely to require a valid low-privileged account and deliberate targeting rather than opportunistic scanning.
Unauthenticated remote attackers who can reach the Oracle Data Integrator Console / Repository Explorer over HTTP can bypass authentication entirely (CWE-287) and take full control of the affected deployment, affecting versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle Fusion Middleware's ODI product. The flaw is rated CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction, and no special preconditions beyond network reachability of the console interface - the primary exposure limiter is whether the ODI Console is internet-facing versus segmented behind VPN or internal-only access. As of analysis, there is no CISA KEV entry and no public exploit identified at time of analysis, though CISA's SSVC assessment rates the issue as automatable with total technical impact, so patching should be treated as urgent rather than deferred.
Unauthenticated HTTP requests against Oracle Helidon deployments that use the helidon-dbclient-mongodb component can let a remote attacker read or modify MongoDB-backed data and cause a partial denial of service in versions 3.0.0–3.2.20 and 4.0.0–4.5.4. Oracle rates this CVSS 3.1 base 7.0 with high attack complexity (AV:N/AC:H/PR:N/UI:N), meaning successful exploitation depends on conditions that are difficult for an attacker to arrange. No public exploit code or CISA KEV listing was provided at time of analysis, so this should be treated as a patch-priority issue rather than an emergency.
Oracle Siebel CRM Deployment (Siebel Management Console) in versions 17.0 through 26.7 fails to properly restrict what a low-privileged, network-connected user can reach, letting that user read critical deployment data and make limited unauthorized changes. Exploitation is trivial once a valid low-privilege account exists: CVSS 3.1 scores it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N), with the confidentiality impact rated High and integrity impact Low. There is no public exploit code and no CISA KEV listing at time of analysis, so this is currently a patch-on-schedule item for Siebel shops rather than an emergency, though EPSS data was not supplied and the untrusted-network exposure of the management console should drive prioritization.
Takeover of Siebel CRM Deployment 17.0 through 26.7 is possible for high-privileged attackers via HTTP requests to the Siebel Management Console. Oracle rates this 9.1 Critical with low attack complexity and no user interaction, and a scope change means compromise can affect additional products beyond the vulnerable component. No public exploit or CISA KEV listing was identified in the provided data.
Unauthenticated remote denial of service in the Siebel CRM Deployment component (Server Infrastructure) of Oracle Siebel CRM affects supported releases 17.0 through 26.7, allowing any attacker with TCP network access to drive the Deployment service into a hang or frequently repeatable crash. Oracle rates the flaw CVSS 7.5 with a fully remote, low-complexity, no-privilege, no-interaction vector (AV:N/AC:L/PR:N/UI:N) but availability-only impact (C:N/I:N/A:H), meaning confidentiality and integrity of CRM data are not directly at risk. No public exploit code has been identified and the issue does not appear in CISA KEV, though Oracle's own advisory language describes it as 'easily exploitable', so exposure should be treated as urgent for internet- or WAN-reachable deployment instances.
Oracle Siebel CRM versions 17.0 through 26.7 contain a flaw in the Siebel CRM Integration (EAI) component that lets a low-privileged, network-positioned attacker achieve full takeover of the integration service over HTTP. Exploitation is rated difficult (CVSS AV:N/AC:H/PR:L/UI:N, base 7.5) and yields high confidentiality, integrity, and availability impact on the Integration component. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so the immediate risk is driven by patch urgency rather than confirmed in-the-wild activity.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 can be fully taken over by a low-privileged attacker who already holds a valid account and can reach the deployment over HTTP. The flaw is rated 7.5 with High complexity (AC:H), meaning it is not a trivial drive-by exploit but requires a favorable, harder-to-arrange condition to succeed; when it does, confidentiality, integrity, and availability are all fully compromised. There is no CISA KEV listing and no public exploit code identified at time of analysis, but Oracle has published a Security Alert with a patch, so exposure is patch-gated rather than just theoretical.
Unauthenticated remote denial of service in Oracle Siebel CRM Deployment (Server Infrastructure component) affects all supported releases from 17.0 through 26.7 and lets any attacker who can reach the deployment service over TCP hang or repeatedly crash it, with CVSS 3.1 scored 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only). Because the flaw needs no credentials, no user interaction, and no special conditions, any internet- or WAN-exposed deployment endpoint is at risk of sustained outage, though impact is limited to availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Oracle's CPU-style advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source.
Oracle Siebel CRM Deployment (Server Infrastructure component) in supported releases 17.0 through 26.7 exposes critical CRM data to a low-privileged, network-positioned attacker who can reach the deployment service over HTTP, and also allows that attacker to partially degrade availability. Oracle rates it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/A:L) and describes it as easily exploitable in its cspusep2026 security alert; there is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the source data.
Low-privileged attackers who can reach Oracle Siebel CRM Deployment over HTTP can exploit a hard-to-trigger flaw in the Siebel Remote component to fully take over the deployment, gaining high confidentiality, integrity and availability impact across the affected system. The vendor lists all supported Siebel CRM Deployment releases from 17.0 through 26.7 as affected, and rates the issue CVSS 3.1 7.5 with a high attack-complexity metric, meaning successful exploitation demands precise conditions rather than a straightforward request. No public exploit code and no CISA KEV listing were identified at time of analysis, so exploitation currently appears to require attacker-specific research or favorable timing rather than off-the-shelf tooling.
Unauthenticated denial of service against Oracle Siebel CRM Deployment (Server Infrastructure component) lets network-reachable attackers hang or repeatedly crash the service, taking the deployment offline; affected releases span 17.0 through 26.7. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U, availability-only impact), meaning no credentials, no user interaction, and no special complexity are required — a low bar for automation. No public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis, so the immediate concern is exposure management rather than confirmed active exploitation.
Oracle Siebel CRM Integration (EAI component) versions 17.0 through 26.7 expose a network-reachable SOAP interface that fails to properly restrict operations for authenticated low-privileged users, letting an attacker read critical CRM data and perform limited unauthorized inserts, updates, or deletions. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N) and is rated 'easily exploitable' by the vendor, requiring only a valid low-privilege account and network reachability to the EAI endpoint. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
Oracle Siebel CRM Integration versions 23.6 through 26.7 expose the Event Publish and Subscribe component to unauthenticated attackers who can reach the server from the same network segment, allowing them to read, create, delete, or modify critical CRM data (CVSS 3.1 base 8.1, AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:N). Because the attack vector is adjacent network rather than internet-facing, exposure is gated by network topology rather than by credentials, and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis. Exploitation probability scoring (EPSS) was not supplied with the source data, so prioritization should rest on asset criticality and segment reachability.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.7, allows an attacker who already holds a low-privileged logon on the host where the deployment component runs to read, create, modify, and delete all data accessible to that deployment. The vulnerability is locally exploitable with low complexity and no user interaction, but it does not grant entry to the host itself — it escalates what an existing low-privileged account can reach across the Siebel deployment layer, producing high confidentiality and integrity impact (CVSS 3.1 base 7.1) with no availability impact. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score, CWE mapping, or confirmed fix version was supplied with the source data.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contain an authentication-related flaw that lets a remote, unauthenticated attacker over HTTP read, create, delete, or modify critical deployment data - CVSS 3.1 base 7.4 with high confidentiality and integrity impact. Exploitation is rated difficult (AC:H), presumably because the attacker must meet a hard-to-satisfy protocol or timing condition, but no privileges or user interaction are required if that condition is met. Oracle has published a fix via its Critical Security Patch Update advisory; active exploitation is not confirmed and no public exploit code was identified in the supplied intelligence.
Improper access control in the Open UI component of Oracle Siebel CRM (End User) versions 17.0 through 26.7 lets an authenticated low-privilege user issue crafted HTTP requests that expose and modify data beyond their authorized scope. Successful exploitation yields high confidentiality impact — unauthorized read of critical Siebel data — plus limited integrity impact via unauthorized insert, update or delete operations; availability is unaffected (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). No CISA KEV listing, public exploit code or EPSS signal is present in the supplied intelligence, so this is currently a patch-cycle priority rather than a confirmed actively exploited issue.
A local privilege-escalation flaw in the Siebel CRM Deployment component (Server Infrastructure) lets a low-privileged user who can log on to the host where Siebel CRM Deployment runs take full control of that deployment. All supported releases from 17.0 through 26.7 are affected, with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact). Oracle published the fix in its Critical Security Patch Update advisory; no public exploit code or CISA KEV entry was identified at time of analysis, so the practical threat is currently insider- or foothold-driven rather than mass-exploited.
Unauthenticated attackers with HTTP network reachability to the Siebel CRM Deployment component of Oracle Siebel CRM can bypass authentication and gain unauthorized access to critical data, plus limited ability to update, insert, or delete records. The flaw affects supported Siebel CRM versions 17.0 through 26.7 and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N). No public exploit code or active exploitation has been identified from the available intelligence at time of analysis.
Local privilege escalation in Oracle Siebel CRM Deployment (Server Infrastructure component) lets any low-privileged user who can log on to the host running the Deployment service take full control of that deployment. All supported releases from 17.0 through 26.7 are affected, and successful exploitation yields complete loss of confidentiality, integrity and availability of the Siebel environment (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and absence of user interaction mean any compromised service or operator account on a Siebel host is a viable stepping stone.