Oracle
Monthly
Unauthenticated remote data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes the Endeca Application Controller to attackers who can create, delete, or modify critical commerce data over HTTP with no credentials required. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and Oracle's own characterization of the flaw as 'easily exploitable' confirm a low-barrier attack path with high integrity impact. No public exploit and no CISA KEV listing are identified at time of analysis, though the authentication bypass tag signals a fundamental access control failure in the controller interface.
The Workbench component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes a network-exploitable flaw that allows a low-privileged authenticated attacker to compromise confidentiality across a changed scope, affecting additional Oracle Commerce products beyond the directly targeted component. Successful exploitation yields unauthorized access to critical or complete Commerce-accessible data and limited write capability, contingent on a victim user interacting with attacker-controlled content. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle disclosed this via the August 2026 Critical Patch Update.
Unauthorized data access and partial data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a network-accessible, low-privileged authenticated attacker to compromise the Endeca Application Controller through HTTP, provided a victim user interacts with attacker-controlled content. The vulnerability carries a scope change, meaning successful exploitation can cascade to affect additional Oracle Commerce components beyond the directly targeted product, resulting in high confidentiality impact and limited integrity compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vendor-tagged 'Authentication Bypass' nature elevates practical concern for multi-tenant or externally accessible deployments.
Unauthorized data access and limited data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 is achievable by a low-privileged network attacker who can induce a victim user to interact with a crafted HTTP request targeting the Endeca Application Controller component. Successful exploitation causes a scope change, meaning the impact extends beyond the directly targeted application to additional Oracle Commerce products, enabling high-confidentiality data exposure and limited unauthorized data modification. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the combination of low attack complexity and scope change elevates the practical business risk.
Remote exploitation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Endeca Application Controller component) allows unauthenticated network attackers to achieve a scope change, compromising confidentiality of all data accessible to the Oracle Commerce platform and enabling limited unauthorized data modification. The attack requires victim interaction, suggesting a client-side exploitation vector such as cross-site scripting or cross-site request forgery that bypasses authentication controls per the advisory's Authentication Bypass tag. Disclosed under the Oracle August 2026 Critical Patch Update with a CVSS 8.2 High rating; no public exploit or active exploitation confirmed at time of analysis.
Unauthenticated remote attackers can compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via HTTP by exploiting an authentication bypass in the Endeca Application Controller component, with successful attacks requiring human interaction from a victim user. Exploitation yields complete read access to all data accessible by the Oracle Commerce application (C:H) and limited write capability (I:L), with a confirmed scope change meaning additional Oracle Commerce platform components beyond the targeted instance can be significantly impacted. Oracle characterizes this as easily exploitable in its August 2026 Critical Security Patch Update advisory; no public exploit has been identified at time of analysis.
Unauthorized data access and manipulation in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller component) lets a remote, unauthenticated attacker read, create, delete, or modify all data accessible to the product over HTTP. The Oracle advisory and 'Authentication Bypass' tag indicate the flaw sidesteps authentication entirely, and Oracle rates it 'easily exploitable' with CVSS 9.1 (high confidentiality and integrity impact, no availability impact). No public exploit has been identified at time of analysis, but the low attack complexity and network reachability make it a strong patching priority.
Unauthorized data read and write against Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via its Endeca Application Controller, which a remote unauthenticated attacker can reach over HTTP. The flaw, disclosed by Oracle and tagged as an authentication bypass, yields high confidentiality and integrity impact (CVSS 9.1) but no availability impact, meaning an attacker can create, delete, or modify critical Endeca data or read all accessible data without any credentials. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a strong patching priority.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes a network-accessible flaw allowing low-privileged authenticated attackers via HTTP to read critical or all accessible application data and cause partial availability disruption. The CVSS 3.1 score of 7.1 reflects high confidentiality impact combined with low availability impact, with no integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a local, unauthenticated attacker who can engineer human interaction from a legitimate user on the same infrastructure. Disclosed in Oracle's August 2026 Critical Security Patch Update, the vulnerability results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, and no proof-of-concept is known to exist.
Authentication bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 enables unauthenticated remote attackers to fully compromise data confidentiality and integrity over HTTP. The 'Authentication Bypass' tag and PR:N vector confirm that no credentials are required, though AC:H indicates exploitation demands specific conditions or non-trivial technique. Successful exploitation yields unauthorized read and write access to all data accessible by the application. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Commerce Experience Manager 11.4.0 exposes a network-accessible flaw in its Experience Manager component that permits low-privileged authenticated attackers to gain complete unauthorized access to all platform data and cause partial availability degradation via HTTP. The CVSS 3.1 score of 7.1 reflects high confidentiality impact with no integrity exposure, consistent with an authorization bypass or excessive data access pattern rather than code execution. No public exploit or CISA KEV listing exists at time of analysis; however, the intelligence tag 'Authentication Bypass' introduces a discrepancy with the PR:L metric that warrants verification against the full Oracle advisory.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 is affected by a network-exploitable vulnerability that allows low-privileged authenticated attackers to perform unauthorized creation, deletion, or modification of critical data and read a subset of accessible data. The vulnerability carries a scope change, meaning successful exploitation can significantly impact systems beyond the directly targeted component. Tagged as an authentication bypass, this flaw is exploitable over HTTP without user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data access and manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a low-privileged, network-based attacker who can induce a user interaction from another party - consistent with a stored injection or cross-session exploitation pattern. Successful exploitation produces a scope change, meaning impact propagates beyond the directly vulnerable component to additional Oracle Commerce subsystems, with both confidentiality and integrity fully compromised. No public exploit code has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update is the designated remediation vehicle.
Oracle Commerce Guided Search and Experience Manager 11.4.0 exposes a high-severity authorization bypass over HTTP that allows any low-privileged, network-accessible attacker to achieve full confidentiality and integrity compromise of commerce data. The 'Authentication Bypass' tag combined with a PR:L vector indicates that authenticated users with minimal permissions can escalate access to read or manipulate all data accessible to the application, including potentially sensitive customer, catalog, and configuration data. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle has released a fix through the August 2026 Critical Patch Update.
Unauthenticated authentication bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller), version 11.4.0, lets a remote attacker reach the application over HTTP without credentials and read critical data while also tampering with a subset of it. Because the flaw carries a scope change, successful exploitation can reach beyond the vulnerable component and affect additional products in the deployment. Oracle rates it CVSS 3.1 9.3; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote attacker read all data accessible to the Experience Manager component and force a repeatable crash or hang. The flaw is tagged as an authentication bypass, carries a CVSS 3.1 base score of 9.1, and is reachable over HTTP with no credentials or user interaction. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote information disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows network attackers to retrieve critical data or gain complete read access to all data accessible through the Endeca Application Controller via HTTP. The CVSS vector confirms a zero-complexity, no-privilege, no-interaction attack path with scope change, meaning successful exploitation cascades beyond the directly targeted component to affect additional Oracle Commerce products. No public exploit code or CISA KEV listing exists at time of analysis, though the authentication bypass classification and high-severity confidentiality impact make this a material risk for any internet-exposed deployment.
Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Controller, which is reachable over HTTP by unauthenticated network attackers. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, meaning a single crafted request can yield full control of the search/merchandising tier. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-authentication profile makes it a high-priority patch item disclosed in Oracle's August 2026 Critical Patch Update.
Unauthenticated remote compromise of Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller) lets a network attacker read all data accessible to the product and force a complete, repeatable denial of service over HTTP. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable with no authentication or user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and unauthenticated vector make it a high-priority patch.
Unauthenticated denial-of-service and partial data integrity compromise in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes the Content Acquisition System component to remote HTTP exploitation. An attacker with network access can repeatedly crash or hang the service and perform unauthorized data manipulation (insert, update, or delete) against accessible data stores. No public exploit code has been identified at time of analysis, and Oracle disclosed this in the August 2026 Critical Patch Update.
Full system takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a low-privileged local attacker through the Content Acquisition System component. Exploitation requires physical or logical access to the host infrastructure combined with high attack complexity, constraining the realistic threat to insider actors or adversaries who have already established a foothold on the target server. No public exploit code has been identified and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes complete confidentiality of application-accessible data to low-privileged, network-authenticated attackers via HTTP. The vulnerability resides in the Content Acquisition System component and carries a scope-change classification, meaning successful exploitation can extend impact beyond the directly targeted system to affect additional Oracle Commerce components. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad network accessibility make this a credible priority for organizations running the affected version.
Unauthenticated remote data exposure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows network-accessible attackers to obtain complete access to all data managed by the platform via HTTP, with no credentials or user interaction required. The vulnerability resides in the Content Acquisition System component and is tagged as an authentication bypass, meaning access controls protecting sensitive commerce data can be circumvented entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial CVSS attack complexity and zero prerequisite conditions make this a priority patch target for any exposed instance.
Unauthenticated remote access to all confidential data is possible in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via the Content Acquisition System (CAS) component over HTTP. The vulnerability, tagged as an authentication bypass, requires no privileges and no user interaction, making it easily exploitable by any network-adjacent attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and complete confidentiality impact make this a significant exposure for any deployment with CAS reachable from untrusted networks.
Unauthenticated data exposure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows remote attackers to access all data managed by the Content Acquisition System component over HTTP with no credentials required. Tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.5 (High) with a fully unauthenticated, low-complexity network attack vector, enabling complete confidentiality compromise of indexed and managed content. No public exploit code or active exploitation has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Content Acquisition System component) lets a remote attacker over HTTP create, modify, or delete all application-accessible data and force a complete, repeatable crash of the service. Oracle rates it CVSS 3.1 9.1 with High Integrity and High Availability impact and no confidentiality impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the low attack complexity (AC:L) and lack of authentication make it a high-priority patch despite no confirmed exploitation.
Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System component) lets a remote attacker over HTTP create, delete, or modify critical data and force a complete, repeatable crash of the platform. Rated CVSS 3.1 9.1 with no authentication or user interaction required, it affects the Endeca-derived search and merchandising layer of Oracle's commerce stack. No public exploit identified at time of analysis, and it is not listed in CISA KEV; confidentiality is explicitly unaffected (C:N), so the danger is integrity and availability rather than data theft.
Full system takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible by a remote, unauthenticated attacker reaching the Content Acquisition System (CAS) over HTTP, per Oracle's August 2026 Critical Patch Update. Successful exploitation yields complete loss of confidentiality, integrity, and availability and, because of a CVSS scope change, can significantly impact additional connected products beyond the vulnerable component itself. Oracle rates the flaw 9.0 but explicitly marks it difficult to exploit (AC:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering and complete denial-of-service in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach the Content Acquisition System over HTTP to create, delete, or modify all accessible data and to force a persistent hang or repeatable crash. Rated CVSS 3.1 9.1 (Integrity and Availability high, Confidentiality none), it is easily exploitable per Oracle with no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (the legacy Endeca-derived Content Acquisition System) lets a remote attacker read, create, modify, or delete all data accessible to the product over HTTP. The Oracle-supplied CVSS 3.1 base score is 9.1 (C:H/I:H, no availability impact), and the intelligence tag 'Authentication Bypass' aligns with the PR:N/UI:N vector. No public exploit code has been identified and it is not on CISA KEV, but the trivial exploitability (AC:L, no auth, no user interaction) makes it a high-priority patching target.
Data tampering and complete denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Content Acquisition System component) allow a remote, unauthenticated attacker with HTTP access to create, delete, or modify critical data and to hang or repeatedly crash the service. The CVSS 3.1 base score is 9.1 driven by high integrity and availability impact with no confidentiality loss, and the flaw is rated easily exploitable by Oracle. No public exploit was identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated data tampering and denial-of-service in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote attacker manipulate the Content Acquisition System over HTTP to create, delete, or modify all accessible application data and to force a complete, repeatable crash or hang. The flaw carries a CVSS 3.1 base score of 9.1 driven by High Integrity and High Availability impact with no privileges or user interaction required, and was disclosed via Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a low-privileged remote attacker over HTTP under difficult exploitation conditions. The vulnerability resides in the Installation and Configuration component and results in complete compromise of confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis; the August 2026 Oracle Critical Security Patch Update (CSPU) addresses this flaw.
Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes its Installation and Configuration component to network-based exploitation by low-privileged authenticated attackers over HTTP, enabling unauthorized access to critical EPM platform data and limited data manipulation. The vulnerability is tagged as an Authentication Bypass, suggesting that a user authenticated at low privilege can circumvent authorization controls to access data scoped to higher privilege levels - consistent with the CVSS C:H/I:L impact profile. No public exploit has been identified at time of analysis, and the issue was patched as part of Oracle's Critical Patch Update for August 2026.
Complete takeover of Oracle WebCenter Portal is possible by a remote, unauthenticated attacker sending crafted HTTP requests to the Runtime Tools component, affecting versions 12.2.1.4.0 and 14.1.2.0.0 of this Oracle Fusion Middleware product. The flaw yields full high-impact compromise of confidentiality, integrity, and availability (CVSS 9.8) with no user interaction or credentials required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable' language from Oracle and the pre-auth network vector make it a high-priority patch.
Local authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables a low-privileged OS-level attacker to gain full read and write access to all data accessible by the Hyperion platform. The flaw resides in the Installation and Configuration component, where access controls can be circumvented without requiring elevated system privileges or user interaction. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept code has been identified at time of analysis.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by any low-privileged attacker with network HTTP access, requiring no user interaction. The vulnerability resides in the Installation and Configuration component and yields complete compromise across confidentiality, integrity, and availability - Oracle's own advisory characterizes the outcome as a full product takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and low privilege bar make this a credible, high-priority remediation target for any organization running the affected release.
Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows full system takeover - complete compromise of confidentiality, integrity, and availability - via low-privileged, network-accessible HTTP requests targeting the Installation and Configuration component. The attack requires no user interaction and low complexity, placing exploitation within reach of any authenticated Hyperion user with HTTP connectivity to the affected service. Oracle's August 2026 Critical Security Patch Update (CPU) addresses this vulnerability; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data access and manipulation in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 is possible via an authentication bypass flaw in the Installation and Configuration component, exploitable by low-privileged network attackers over HTTP. Successful exploitation triggers a scope change, meaning compromise extends beyond the directly targeted component to additional Oracle Hyperion products, enabling full read access to critical data and unauthorized create, delete, or modify operations on critical Hyperion data. No public exploit code has been identified at time of analysis, though the CVSS 8.2 rating and scope-change designation elevate this above typical high-complexity findings.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a Security component flaw - tagged as an authentication bypass - that enables low-privileged authenticated attackers to gain complete read access to all data within the application and limited write access, with a confirmed scope change extending impact to additional Oracle Hyperion suite products. Exploitation requires human interaction from a victim but carries low attack complexity and is reachable over HTTP without elevated privileges. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes its Installation and Configuration component to unauthorized data manipulation and complete denial-of-service via HTTP by low-privileged authenticated network users. Exploitation allows an attacker to create, delete, or modify critical Hyperion EPM data and cause a full service hang or crash, directly threatening financial reporting and planning operations. No public exploit code has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.
Full takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible when a remote unauthenticated attacker over HTTP lures an authorized user into interacting with malicious content, exploiting a flaw in the Installation and Configuration component. Because the vulnerability carries a scope change, successful exploitation can extend beyond Hyperion to significantly impact other integrated products, yielding complete confidentiality, integrity, and availability compromise. Oracle rates it CVSS 9.6; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a high-severity flaw in its Installation and Configuration component that allows low-privileged authenticated attackers to achieve full confidentiality and integrity compromise over HTTP. The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects an easily exploitable network path requiring minimal attacker capability - classified by Oracle as 'easily exploitable.' No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the 'Authentication Bypass' tag in available intelligence suggests the low-privilege threshold may itself be circumventable.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by any low-privileged attacker with HTTP network access, affecting the Installation and Configuration component. Oracle's own CPU advisory characterizes this as 'easily exploitable,' with the CVSS 3.1 score of 8.8 reflecting complete confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the low attack complexity makes this a high-priority patching target.
Full platform takeover is possible in Oracle Commerce Platform 11.4.0 via the Dynamo Application Framework component, exploitable by an unauthenticated attacker who can reach the adjacent network segment hosting the server. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that successful exploitation yields complete compromise of confidentiality, integrity, and availability - consistent with Oracle's characterization of 'takeover.' No public exploit code has been identified at time of analysis, and this CVE does not appear on the CISA KEV catalog.
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with only HTTP network access to fully compromise the platform, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable' requiring no authentication or user interaction. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Remote takeover in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with only TCP network access to fully compromise the platform. Rated CVSS 9.8 with complete confidentiality, integrity and availability loss, the flaw requires no authentication or user interaction, making it a top-tier remediation priority. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and total-compromise impact warrant immediate patching via Oracle's August 2026 Critical Patch Update.
Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is possible via a network-accessible HTTP attack against the Security component. The CVSS vector confirms no authentication, no user interaction, and no special conditions are required, placing this squarely in the high-severity, easily exploitable category. Successful exploitation yields complete read access to all data accessible by the application and a partial denial of service, making this a critical risk for financial institutions running the affected build. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover is achievable in Oracle Siebel CRM End User versions 17.0 through 26.6 via the Document Management component over HTTP, exploitable by any low-privileged authenticated user without user interaction. The CVSS 8.8 score reflects complete confidentiality, integrity, and availability impact, consistent with the vendor's characterization of 'takeover' of the End User instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range make this a priority patching target for any organization running affected Siebel deployments.
Full system takeover of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by a network-accessible, high-privileged attacker exploiting a flaw in the Security component via HTTP. The vulnerability carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, amounting to effective product compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and complete CIA triad impact warrant prompt remediation attention.
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileged attacker with network HTTP access, affecting versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation is straightforward - no elevated privileges, no user interaction, and low complexity - resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation makes this a high-priority patching target for organizations running affected Siebel deployments.
Full takeover of Oracle Purchasing within Oracle E-Business Suite is achievable by any low-privileged, network-authenticated attacker exploiting this unspecified flaw in versions 12.2.3 through 12.2.15. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms exploitation requires no special conditions beyond a valid low-privilege account and HTTP access, with resulting impacts across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full-impact triad make this a credible priority for any Oracle EBS deployment.
Unauthenticated HTTP access to Oracle Purchasing (a component of Oracle E-Business Suite versions 12.2.3-12.2.15) enables remote attackers to read critical or complete procurement data with no credentials, user interaction, or elevated attack complexity. Tagged as an authentication bypass by EUVD (EUVD-2026-61894) and disclosed through Oracle's August 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.5, reflecting a fully network-exposed, zero-prerequisite attack path. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker targeting the Security component over HTTP, resulting in complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 7.5 (High) reflects this total impact, though high attack complexity (AC:H) constrains opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS data was supplied in the source intelligence.
Unauthorized data exposure in Oracle Payroll (E-Business Suite component: Internal Operations) allows a low-privileged, network-authenticated attacker to gain complete read access to all Oracle Payroll-accessible data via HTTP, with confirmed scope change that may cascade into impact on additional EBS components. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the currently supported 12.2.x release line. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is tagged as an authentication bypass and rated easily exploitable with low attack complexity.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker via TCP, with no user interaction required. The vulnerability resides in the Security component and results in complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible lateral-movement risk in enterprise financial environments.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 allows unauthenticated, network-adjacent attackers to fully read and manipulate sensitive financial consolidation data without any credentials. The affected component is HFM's Security subsystem, and exploitation requires only adjacency to the physical or logical network segment hosting the application - no user interaction or privileges needed. No public exploit code and no CISA KEV listing exist at time of analysis, though the low attack complexity makes this straightforward to exploit for any attacker achieving network adjacency.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged network attackers to bypass security controls and gain complete access to sensitive financial data via HTTP. Tagged as an Authentication Bypass in EUVD-2026-61889, the flaw carries a CVSS scope change indicator meaning successful exploitation can extend confidentiality impacts to additional Oracle Hyperion products sharing the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle's own designation of this as 'easily exploitable' and the low attack complexity are meaningful risk signals for organizations running this financial consolidation platform.
Local privilege escalation in Oracle Payroll (E-Business Suite 12.2.3 through 12.2.15) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the payroll application, achieving complete confidentiality, integrity, and availability impact including full takeover. The vulnerability carries a confirmed scope change (S:C), meaning successful exploitation can cascade to affect additional products co-hosted on the same infrastructure - a significant blast-radius amplifier in shared EBS environments. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is assessed as a targeted insider or post-breach scenario rather than opportunistic remote attack.
Full system takeover is achievable in Oracle Hyperion Financial Management 11.2.25.0.000 through a flaw in its Security component, exploitable over HTTP by any low-privileged attacker with network access and no required user interaction. The CVSS 3.1 score of 8.8 reflects complete high-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Hyperion Financial Management 11.2.25.0.000 contains a flaw in its Security component that allows a high-privileged, network-authenticated attacker to achieve full system takeover via HTTP, impacting confidentiality, integrity, and availability. Disclosed via Oracle's August 2026 Critical Security Patch Update (CSPU) and corroborated by EUVD-2026-61886, the attack requires no user interaction and has low complexity once privileged credentials are available. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, network-authenticated attacker exploiting a flaw in its Security component via HTTP. The vulnerability demands high attack complexity - indicating specific conditions must align - but successful exploitation yields complete compromise of confidentiality, integrity, and availability, consistent with a privilege escalation or security bypass in the access-control subsystem. No public exploit code or active exploitation has been identified at time of analysis; Oracle addressed this through the August 2026 Critical Patch Update.
Local authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged attacker with infrastructure logon to read and modify all application-accessible financial data. The CVSS 7.1 score reflects high confidentiality and integrity impact with no availability disruption, constrained entirely to the local attack surface. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data exfiltration and partial service disruption in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per the 'Authentication Bypass' tag, likely involves improper enforcement of access controls that permits a low-privileged user to read data far beyond their authorization level, achieving complete access to all Financial Management accessible data (C:H). No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to leverage for any authenticated user of the application.
Unauthorized data access and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 are achievable by any low-privileged, network-connected attacker via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per vendor-assigned tags, involves an authentication bypass mechanism that elevates effective access beyond the attacker's granted privileges, enabling exposure of critical financial data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog; however, the low attack complexity and broad network exposure make it a high-priority remediation target for organizations running the affected release.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all financial data accessible within the application and degrade service availability via HTTP. The 'Authentication Bypass' tag suggests the Security component vulnerability enables privilege escalation beyond the attacker's granted role, exposing sensitive financial consolidation data. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, network accessibility, and high confidentiality impact against enterprise financial data makes this a meaningful priority for affected organizations.
Oracle Order Management's Product Diagnostic Tools component exposes a local privilege-dependent flaw affecting versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, allowing a high-privileged local attacker to achieve unauthorized read and write access to critical data with scope impact extending beyond the Order Management module itself. The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) confirms that exploitation is constrained to infrastructure-level access, requiring both physical or logical logon to the host system and an elevated account, but successful exploitation yields complete confidentiality and integrity compromise. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed.
Oracle Workflow's Notification Mailer component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised by a low-privileged network attacker over HTTP, enabling unauthorized creation, deletion, or modification of critical workflow data and triggering a complete denial of service. The CVSS 3.1 score of 8.1 reflects high integrity and availability impacts with no confidentiality exposure, exploitable with low complexity and no user interaction. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Oracle Order Management's Product Diagnostic Tools component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 can be fully compromised by a low-privileged attacker over HTTP, resulting in complete system takeover with high confidentiality, integrity, and availability impact. The attack requires low privileges and high complexity to execute, reducing the immediacy of the threat but not its severity if conditions are met. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Hyperion Financial Management 11.2.25.0.000 contains an authentication bypass in its Security component that allows a low-privileged authenticated attacker to exceed their authorized access over HTTP, resulting in full confidentiality and integrity compromise of all application data. The flaw enables unauthorized read access to sensitive corporate financial records as well as creation, deletion, or modification of critical data across the entire HFM instance. No public exploit has been identified at time of analysis, and Oracle addressed this vulnerability in the Critical Patch Update for August 2026.
Full system takeover is possible in Oracle Hyperion Financial Management 11.2.25.0.000 through the Security component, exploitable via SQL by a low-privileged network attacker with no user interaction required. Oracle classifies this as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and full-takeover impact elevate real-world risk for any organization running the affected version.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an unauthenticated HTTP endpoint vulnerable to a complete denial-of-service condition. Attackers with network access can cause the Workflow service to hang or crash repeatedly with no authentication required and low attack complexity, as confirmed by Oracle's August 2026 CPU advisory. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Full compromise of Oracle Workflow (Workflow Notification Mailer component) in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by an unauthenticated attacker who can reach the product over SMTP, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) reflects an easily exploitable network flaw resulting in complete takeover of Oracle Workflow. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided.
SQL-layer exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged network attacker to fully compromise data confidentiality and integrity across all accessible financial data. The flaw resides in the Security component, and successful exploitation permits unauthorized read, creation, deletion, and modification of critical data - a particularly severe outcome for an EPM platform handling sensitive financial consolidation records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a high-priority patch target for any Oracle EPM deployment.
Full takeover of Oracle Web Services Manager is achievable by unauthenticated remote attackers via HTTPS in versions 12.2.1.4.0 and 14.1.2.0.0 of the Oracle Fusion Middleware product line. The vulnerability resides in the Web Services Security component and carries a CVSS 3.1 base score of 8.1, with complete confidentiality, integrity, and availability impacts confirmed by Oracle's August 2026 Critical Patch Update advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover of Oracle Financial Services Enterprise Case Management versions 8.0.8.2 and 8.1.2.11 is achievable by low-privileged, network-authenticated attackers targeting the Web UI component over HTTP. Oracle rates this as easily exploitable with a CVSS 3.1 score of 8.8, reflecting full confidentiality, integrity, and availability impact - consistent with complete application compromise. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthenticated attacker reach the application over TLS and read or alter all data the product can access, with a scope-changing blast radius into adjacent Oracle products. Rated CVSS 10.0, it is trivially exploitable (AV:N/AC:L/PR:N/UI:N) and delivers full confidentiality and integrity compromise while leaving availability untouched. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the perfect score and unauthenticated network reach make it a top-priority patch.
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a low-privileged attacker with network access, operating over the SQL layer, fully compromise the application and - because of a scope change - significantly impact other connected products. Oracle rates it CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact. No public exploit code has been identified and it is not on CISA KEV, but the low complexity and low privilege bar make it a top-priority patch item.
Oracle Product Hub versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes a full system takeover path via a network-accessible flaw in its Outbound Data component, exploitable by any low-privileged authenticated user over HTTP with no user interaction required. Oracle classifies this as 'easily exploitable' and confirms complete confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, but the low attack complexity warrants urgent remediation for all affected deployments.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local-access vulnerability in its Security component that allows an unauthenticated local attacker to achieve full system takeover - compromising confidentiality, integrity, and availability - when combined with required interaction from a separate legitimate user. The attack is constrained to actors with logon access to the infrastructure hosting HFM and requires high complexity to execute, limiting the realistic threat population to insiders or those who have already established a foothold on the target server. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Unauthenticated remote data exposure in Oracle Siebel CRM Integration's REST component allows network attackers to read all CRM-accessible data without credentials across versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable with no authentication and minimal attack complexity, yielding complete confidentiality loss. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Unauthenticated remote exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 exposes the Security component to authentication bypass via HTTP, enabling attackers to read critical or all accessible financial data and inflict a partial denial of service. The vulnerability is rated CVSS 8.2 (High) with a low-complexity, network-accessible attack vector requiring no privileges or user interaction. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the authentication bypass tag and unauthenticated attack surface make this a meaningful priority for any organization running the affected version.
Remote unauthenticated denial-of-service in Oracle Helidon 3.2.18 allows network-reachable attackers to trigger a hang or repeatably crash the Imperative Web Server component via crafted HTTP requests, fully disrupting availability. The vulnerability carries a CVSS 3.1 score of 7.5, is described by Oracle as easily exploitable, and requires no authentication, no user interaction, and only standard HTTP network access. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity makes opportunistic probing straightforward against any internet-exposed Helidon instance.
Remote denial-of-service in Oracle Java SE's 2D component allows unauthenticated network attackers to hang or crash the JVM across versions 25.0.4 and 26.0.2 via multiple protocols. The attack surface spans both server-side Java deployments exposing 2D-related APIs through web services and client-side environments running sandboxed Java Web Start applications or applets processing untrusted code. Oracle characterizes this as easily exploitable with no public exploit identified at time of analysis; no KEV listing is present.
SAML-based authentication bypass and full product takeover affects Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware's Agent infrastructure component. A remote attacker with no credentials can reach the SAML processing surface over the network and, per Oracle's own rating, easily compromise the identity broker outright - CVSS 9.8 with full confidentiality, integrity, and availability impact. Because Oracle Access Manager is a single-sign-on and access-enforcement gatekeeper, its takeover cascades to every downstream application it protects. No public exploit identified at time of analysis; not listed in CISA KEV.
Unauthenticated adjacent-network exploitation of Oracle Hyperion Data Relationship Management 11.2.25.0.000 enables complete read and write access to all master data managed by the platform. The vulnerability resides in the Access and Security component and is tagged as an authentication bypass, allowing an attacker positioned on the same physical communication segment to exfiltrate sensitive hierarchical reference data and silently manipulate or delete critical records without credentials or user interaction. No public exploit has been identified at time of analysis and no CISA KEV listing has been observed, but the low attack complexity and absence of any authentication requirement make this a meaningful priority for organizations co-locating DRM with other internal systems on shared network segments.
Oracle Hyperion Data Relationship Management (DRM) 11.2.25.0.000 exposes a high-severity access control flaw that allows a low-privileged, network-authenticated attacker to fully compromise confidentiality and integrity of critical DRM data, with scope change extending impact to additional Oracle Hyperion products. Exploitation requires human interaction from a victim user, consistent with a cross-site or cross-context attack pattern (the 'Authentication Bypass' tag suggests privilege escalation beyond the attacker's initial access tier). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access and integrity compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a local attacker holding low-privilege infrastructure credentials to fully circumvent application-level access controls, yielding complete read and write access to all DRM-managed master data. The vulnerability resides in the Access and security component and is tagged as an Authentication Bypass, suggesting internal authorization enforcement fails once basic OS-level access to the host is obtained. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes critical master data to unauthenticated remote attackers over HTTP. Exploitation requires human interaction from a victim user - consistent with a reflected or client-side attack vector - allowing an attacker to read or tamper with all data accessible within the DRM platform, including sensitive master data governance records. No public exploit or CISA KEV listing has been identified at time of analysis, though the Oracle August 2026 Critical Patch Update addresses this issue.
Unauthenticated remote data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes the Endeca Application Controller to attackers who can create, delete, or modify critical commerce data over HTTP with no credentials required. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and Oracle's own characterization of the flaw as 'easily exploitable' confirm a low-barrier attack path with high integrity impact. No public exploit and no CISA KEV listing are identified at time of analysis, though the authentication bypass tag signals a fundamental access control failure in the controller interface.
The Workbench component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes a network-exploitable flaw that allows a low-privileged authenticated attacker to compromise confidentiality across a changed scope, affecting additional Oracle Commerce products beyond the directly targeted component. Successful exploitation yields unauthorized access to critical or complete Commerce-accessible data and limited write capability, contingent on a victim user interacting with attacker-controlled content. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle disclosed this via the August 2026 Critical Patch Update.
Unauthorized data access and partial data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a network-accessible, low-privileged authenticated attacker to compromise the Endeca Application Controller through HTTP, provided a victim user interacts with attacker-controlled content. The vulnerability carries a scope change, meaning successful exploitation can cascade to affect additional Oracle Commerce components beyond the directly targeted product, resulting in high confidentiality impact and limited integrity compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vendor-tagged 'Authentication Bypass' nature elevates practical concern for multi-tenant or externally accessible deployments.
Unauthorized data access and limited data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 is achievable by a low-privileged network attacker who can induce a victim user to interact with a crafted HTTP request targeting the Endeca Application Controller component. Successful exploitation causes a scope change, meaning the impact extends beyond the directly targeted application to additional Oracle Commerce products, enabling high-confidentiality data exposure and limited unauthorized data modification. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the combination of low attack complexity and scope change elevates the practical business risk.
Remote exploitation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Endeca Application Controller component) allows unauthenticated network attackers to achieve a scope change, compromising confidentiality of all data accessible to the Oracle Commerce platform and enabling limited unauthorized data modification. The attack requires victim interaction, suggesting a client-side exploitation vector such as cross-site scripting or cross-site request forgery that bypasses authentication controls per the advisory's Authentication Bypass tag. Disclosed under the Oracle August 2026 Critical Patch Update with a CVSS 8.2 High rating; no public exploit or active exploitation confirmed at time of analysis.
Unauthenticated remote attackers can compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via HTTP by exploiting an authentication bypass in the Endeca Application Controller component, with successful attacks requiring human interaction from a victim user. Exploitation yields complete read access to all data accessible by the Oracle Commerce application (C:H) and limited write capability (I:L), with a confirmed scope change meaning additional Oracle Commerce platform components beyond the targeted instance can be significantly impacted. Oracle characterizes this as easily exploitable in its August 2026 Critical Security Patch Update advisory; no public exploit has been identified at time of analysis.
Unauthorized data access and manipulation in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller component) lets a remote, unauthenticated attacker read, create, delete, or modify all data accessible to the product over HTTP. The Oracle advisory and 'Authentication Bypass' tag indicate the flaw sidesteps authentication entirely, and Oracle rates it 'easily exploitable' with CVSS 9.1 (high confidentiality and integrity impact, no availability impact). No public exploit has been identified at time of analysis, but the low attack complexity and network reachability make it a strong patching priority.
Unauthorized data read and write against Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via its Endeca Application Controller, which a remote unauthenticated attacker can reach over HTTP. The flaw, disclosed by Oracle and tagged as an authentication bypass, yields high confidentiality and integrity impact (CVSS 9.1) but no availability impact, meaning an attacker can create, delete, or modify critical Endeca data or read all accessible data without any credentials. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a strong patching priority.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes a network-accessible flaw allowing low-privileged authenticated attackers via HTTP to read critical or all accessible application data and cause partial availability disruption. The CVSS 3.1 score of 7.1 reflects high confidentiality impact combined with low availability impact, with no integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a local, unauthenticated attacker who can engineer human interaction from a legitimate user on the same infrastructure. Disclosed in Oracle's August 2026 Critical Security Patch Update, the vulnerability results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, and no proof-of-concept is known to exist.
Authentication bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 enables unauthenticated remote attackers to fully compromise data confidentiality and integrity over HTTP. The 'Authentication Bypass' tag and PR:N vector confirm that no credentials are required, though AC:H indicates exploitation demands specific conditions or non-trivial technique. Successful exploitation yields unauthorized read and write access to all data accessible by the application. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Commerce Experience Manager 11.4.0 exposes a network-accessible flaw in its Experience Manager component that permits low-privileged authenticated attackers to gain complete unauthorized access to all platform data and cause partial availability degradation via HTTP. The CVSS 3.1 score of 7.1 reflects high confidentiality impact with no integrity exposure, consistent with an authorization bypass or excessive data access pattern rather than code execution. No public exploit or CISA KEV listing exists at time of analysis; however, the intelligence tag 'Authentication Bypass' introduces a discrepancy with the PR:L metric that warrants verification against the full Oracle advisory.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 is affected by a network-exploitable vulnerability that allows low-privileged authenticated attackers to perform unauthorized creation, deletion, or modification of critical data and read a subset of accessible data. The vulnerability carries a scope change, meaning successful exploitation can significantly impact systems beyond the directly targeted component. Tagged as an authentication bypass, this flaw is exploitable over HTTP without user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data access and manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a low-privileged, network-based attacker who can induce a user interaction from another party - consistent with a stored injection or cross-session exploitation pattern. Successful exploitation produces a scope change, meaning impact propagates beyond the directly vulnerable component to additional Oracle Commerce subsystems, with both confidentiality and integrity fully compromised. No public exploit code has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update is the designated remediation vehicle.
Oracle Commerce Guided Search and Experience Manager 11.4.0 exposes a high-severity authorization bypass over HTTP that allows any low-privileged, network-accessible attacker to achieve full confidentiality and integrity compromise of commerce data. The 'Authentication Bypass' tag combined with a PR:L vector indicates that authenticated users with minimal permissions can escalate access to read or manipulate all data accessible to the application, including potentially sensitive customer, catalog, and configuration data. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle has released a fix through the August 2026 Critical Patch Update.
Unauthenticated authentication bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Application Controller), version 11.4.0, lets a remote attacker reach the application over HTTP without credentials and read critical data while also tampering with a subset of it. Because the flaw carries a scope change, successful exploitation can reach beyond the vulnerable component and affect additional products in the deployment. Oracle rates it CVSS 3.1 9.3; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote attacker read all data accessible to the Experience Manager component and force a repeatable crash or hang. The flaw is tagged as an authentication bypass, carries a CVSS 3.1 base score of 9.1, and is reachable over HTTP with no credentials or user interaction. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote information disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows network attackers to retrieve critical data or gain complete read access to all data accessible through the Endeca Application Controller via HTTP. The CVSS vector confirms a zero-complexity, no-privilege, no-interaction attack path with scope change, meaning successful exploitation cascades beyond the directly targeted component to affect additional Oracle Commerce products. No public exploit code or CISA KEV listing exists at time of analysis, though the authentication bypass classification and high-severity confidentiality impact make this a material risk for any internet-exposed deployment.
Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Controller, which is reachable over HTTP by unauthenticated network attackers. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, meaning a single crafted request can yield full control of the search/merchandising tier. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-authentication profile makes it a high-priority patch item disclosed in Oracle's August 2026 Critical Patch Update.
Unauthenticated remote compromise of Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller) lets a network attacker read all data accessible to the product and force a complete, repeatable denial of service over HTTP. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable with no authentication or user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and unauthenticated vector make it a high-priority patch.
Unauthenticated denial-of-service and partial data integrity compromise in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes the Content Acquisition System component to remote HTTP exploitation. An attacker with network access can repeatedly crash or hang the service and perform unauthorized data manipulation (insert, update, or delete) against accessible data stores. No public exploit code has been identified at time of analysis, and Oracle disclosed this in the August 2026 Critical Patch Update.
Full system takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a low-privileged local attacker through the Content Acquisition System component. Exploitation requires physical or logical access to the host infrastructure combined with high attack complexity, constraining the realistic threat to insider actors or adversaries who have already established a foothold on the target server. No public exploit code has been identified and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes complete confidentiality of application-accessible data to low-privileged, network-authenticated attackers via HTTP. The vulnerability resides in the Content Acquisition System component and carries a scope-change classification, meaning successful exploitation can extend impact beyond the directly targeted system to affect additional Oracle Commerce components. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad network accessibility make this a credible priority for organizations running the affected version.
Unauthenticated remote data exposure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows network-accessible attackers to obtain complete access to all data managed by the platform via HTTP, with no credentials or user interaction required. The vulnerability resides in the Content Acquisition System component and is tagged as an authentication bypass, meaning access controls protecting sensitive commerce data can be circumvented entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial CVSS attack complexity and zero prerequisite conditions make this a priority patch target for any exposed instance.
Unauthenticated remote access to all confidential data is possible in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via the Content Acquisition System (CAS) component over HTTP. The vulnerability, tagged as an authentication bypass, requires no privileges and no user interaction, making it easily exploitable by any network-adjacent attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and complete confidentiality impact make this a significant exposure for any deployment with CAS reachable from untrusted networks.
Unauthenticated data exposure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows remote attackers to access all data managed by the Content Acquisition System component over HTTP with no credentials required. Tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.5 (High) with a fully unauthenticated, low-complexity network attack vector, enabling complete confidentiality compromise of indexed and managed content. No public exploit code or active exploitation has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Content Acquisition System component) lets a remote attacker over HTTP create, modify, or delete all application-accessible data and force a complete, repeatable crash of the service. Oracle rates it CVSS 3.1 9.1 with High Integrity and High Availability impact and no confidentiality impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the low attack complexity (AC:L) and lack of authentication make it a high-priority patch despite no confirmed exploitation.
Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System component) lets a remote attacker over HTTP create, delete, or modify critical data and force a complete, repeatable crash of the platform. Rated CVSS 3.1 9.1 with no authentication or user interaction required, it affects the Endeca-derived search and merchandising layer of Oracle's commerce stack. No public exploit identified at time of analysis, and it is not listed in CISA KEV; confidentiality is explicitly unaffected (C:N), so the danger is integrity and availability rather than data theft.
Full system takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible by a remote, unauthenticated attacker reaching the Content Acquisition System (CAS) over HTTP, per Oracle's August 2026 Critical Patch Update. Successful exploitation yields complete loss of confidentiality, integrity, and availability and, because of a CVSS scope change, can significantly impact additional connected products beyond the vulnerable component itself. Oracle rates the flaw 9.0 but explicitly marks it difficult to exploit (AC:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering and complete denial-of-service in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach the Content Acquisition System over HTTP to create, delete, or modify all accessible data and to force a persistent hang or repeatable crash. Rated CVSS 3.1 9.1 (Integrity and Availability high, Confidentiality none), it is easily exploitable per Oracle with no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (the legacy Endeca-derived Content Acquisition System) lets a remote attacker read, create, modify, or delete all data accessible to the product over HTTP. The Oracle-supplied CVSS 3.1 base score is 9.1 (C:H/I:H, no availability impact), and the intelligence tag 'Authentication Bypass' aligns with the PR:N/UI:N vector. No public exploit code has been identified and it is not on CISA KEV, but the trivial exploitability (AC:L, no auth, no user interaction) makes it a high-priority patching target.
Data tampering and complete denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Content Acquisition System component) allow a remote, unauthenticated attacker with HTTP access to create, delete, or modify critical data and to hang or repeatedly crash the service. The CVSS 3.1 base score is 9.1 driven by high integrity and availability impact with no confidentiality loss, and the flaw is rated easily exploitable by Oracle. No public exploit was identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated data tampering and denial-of-service in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote attacker manipulate the Content Acquisition System over HTTP to create, delete, or modify all accessible application data and to force a complete, repeatable crash or hang. The flaw carries a CVSS 3.1 base score of 9.1 driven by High Integrity and High Availability impact with no privileges or user interaction required, and was disclosed via Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a low-privileged remote attacker over HTTP under difficult exploitation conditions. The vulnerability resides in the Installation and Configuration component and results in complete compromise of confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis; the August 2026 Oracle Critical Security Patch Update (CSPU) addresses this flaw.
Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes its Installation and Configuration component to network-based exploitation by low-privileged authenticated attackers over HTTP, enabling unauthorized access to critical EPM platform data and limited data manipulation. The vulnerability is tagged as an Authentication Bypass, suggesting that a user authenticated at low privilege can circumvent authorization controls to access data scoped to higher privilege levels - consistent with the CVSS C:H/I:L impact profile. No public exploit has been identified at time of analysis, and the issue was patched as part of Oracle's Critical Patch Update for August 2026.
Complete takeover of Oracle WebCenter Portal is possible by a remote, unauthenticated attacker sending crafted HTTP requests to the Runtime Tools component, affecting versions 12.2.1.4.0 and 14.1.2.0.0 of this Oracle Fusion Middleware product. The flaw yields full high-impact compromise of confidentiality, integrity, and availability (CVSS 9.8) with no user interaction or credentials required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable' language from Oracle and the pre-auth network vector make it a high-priority patch.
Local authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables a low-privileged OS-level attacker to gain full read and write access to all data accessible by the Hyperion platform. The flaw resides in the Installation and Configuration component, where access controls can be circumvented without requiring elevated system privileges or user interaction. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept code has been identified at time of analysis.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by any low-privileged attacker with network HTTP access, requiring no user interaction. The vulnerability resides in the Installation and Configuration component and yields complete compromise across confidentiality, integrity, and availability - Oracle's own advisory characterizes the outcome as a full product takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and low privilege bar make this a credible, high-priority remediation target for any organization running the affected release.
Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows full system takeover - complete compromise of confidentiality, integrity, and availability - via low-privileged, network-accessible HTTP requests targeting the Installation and Configuration component. The attack requires no user interaction and low complexity, placing exploitation within reach of any authenticated Hyperion user with HTTP connectivity to the affected service. Oracle's August 2026 Critical Security Patch Update (CPU) addresses this vulnerability; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data access and manipulation in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 is possible via an authentication bypass flaw in the Installation and Configuration component, exploitable by low-privileged network attackers over HTTP. Successful exploitation triggers a scope change, meaning compromise extends beyond the directly targeted component to additional Oracle Hyperion products, enabling full read access to critical data and unauthorized create, delete, or modify operations on critical Hyperion data. No public exploit code has been identified at time of analysis, though the CVSS 8.2 rating and scope-change designation elevate this above typical high-complexity findings.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a Security component flaw - tagged as an authentication bypass - that enables low-privileged authenticated attackers to gain complete read access to all data within the application and limited write access, with a confirmed scope change extending impact to additional Oracle Hyperion suite products. Exploitation requires human interaction from a victim but carries low attack complexity and is reachable over HTTP without elevated privileges. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes its Installation and Configuration component to unauthorized data manipulation and complete denial-of-service via HTTP by low-privileged authenticated network users. Exploitation allows an attacker to create, delete, or modify critical Hyperion EPM data and cause a full service hang or crash, directly threatening financial reporting and planning operations. No public exploit code has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.
Full takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible when a remote unauthenticated attacker over HTTP lures an authorized user into interacting with malicious content, exploiting a flaw in the Installation and Configuration component. Because the vulnerability carries a scope change, successful exploitation can extend beyond Hyperion to significantly impact other integrated products, yielding complete confidentiality, integrity, and availability compromise. Oracle rates it CVSS 9.6; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a high-severity flaw in its Installation and Configuration component that allows low-privileged authenticated attackers to achieve full confidentiality and integrity compromise over HTTP. The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects an easily exploitable network path requiring minimal attacker capability - classified by Oracle as 'easily exploitable.' No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the 'Authentication Bypass' tag in available intelligence suggests the low-privilege threshold may itself be circumventable.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by any low-privileged attacker with HTTP network access, affecting the Installation and Configuration component. Oracle's own CPU advisory characterizes this as 'easily exploitable,' with the CVSS 3.1 score of 8.8 reflecting complete confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the low attack complexity makes this a high-priority patching target.
Full platform takeover is possible in Oracle Commerce Platform 11.4.0 via the Dynamo Application Framework component, exploitable by an unauthenticated attacker who can reach the adjacent network segment hosting the server. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that successful exploitation yields complete compromise of confidentiality, integrity, and availability - consistent with Oracle's characterization of 'takeover.' No public exploit code has been identified at time of analysis, and this CVE does not appear on the CISA KEV catalog.
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with only HTTP network access to fully compromise the platform, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable' requiring no authentication or user interaction. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Remote takeover in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with only TCP network access to fully compromise the platform. Rated CVSS 9.8 with complete confidentiality, integrity and availability loss, the flaw requires no authentication or user interaction, making it a top-tier remediation priority. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and total-compromise impact warrant immediate patching via Oracle's August 2026 Critical Patch Update.
Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is possible via a network-accessible HTTP attack against the Security component. The CVSS vector confirms no authentication, no user interaction, and no special conditions are required, placing this squarely in the high-severity, easily exploitable category. Successful exploitation yields complete read access to all data accessible by the application and a partial denial of service, making this a critical risk for financial institutions running the affected build. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover is achievable in Oracle Siebel CRM End User versions 17.0 through 26.6 via the Document Management component over HTTP, exploitable by any low-privileged authenticated user without user interaction. The CVSS 8.8 score reflects complete confidentiality, integrity, and availability impact, consistent with the vendor's characterization of 'takeover' of the End User instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range make this a priority patching target for any organization running affected Siebel deployments.
Full system takeover of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by a network-accessible, high-privileged attacker exploiting a flaw in the Security component via HTTP. The vulnerability carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, amounting to effective product compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and complete CIA triad impact warrant prompt remediation attention.
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileged attacker with network HTTP access, affecting versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation is straightforward - no elevated privileges, no user interaction, and low complexity - resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation makes this a high-priority patching target for organizations running affected Siebel deployments.
Full takeover of Oracle Purchasing within Oracle E-Business Suite is achievable by any low-privileged, network-authenticated attacker exploiting this unspecified flaw in versions 12.2.3 through 12.2.15. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms exploitation requires no special conditions beyond a valid low-privilege account and HTTP access, with resulting impacts across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full-impact triad make this a credible priority for any Oracle EBS deployment.
Unauthenticated HTTP access to Oracle Purchasing (a component of Oracle E-Business Suite versions 12.2.3-12.2.15) enables remote attackers to read critical or complete procurement data with no credentials, user interaction, or elevated attack complexity. Tagged as an authentication bypass by EUVD (EUVD-2026-61894) and disclosed through Oracle's August 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.5, reflecting a fully network-exposed, zero-prerequisite attack path. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker targeting the Security component over HTTP, resulting in complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 7.5 (High) reflects this total impact, though high attack complexity (AC:H) constrains opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS data was supplied in the source intelligence.
Unauthorized data exposure in Oracle Payroll (E-Business Suite component: Internal Operations) allows a low-privileged, network-authenticated attacker to gain complete read access to all Oracle Payroll-accessible data via HTTP, with confirmed scope change that may cascade into impact on additional EBS components. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the currently supported 12.2.x release line. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is tagged as an authentication bypass and rated easily exploitable with low attack complexity.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker via TCP, with no user interaction required. The vulnerability resides in the Security component and results in complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible lateral-movement risk in enterprise financial environments.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 allows unauthenticated, network-adjacent attackers to fully read and manipulate sensitive financial consolidation data without any credentials. The affected component is HFM's Security subsystem, and exploitation requires only adjacency to the physical or logical network segment hosting the application - no user interaction or privileges needed. No public exploit code and no CISA KEV listing exist at time of analysis, though the low attack complexity makes this straightforward to exploit for any attacker achieving network adjacency.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged network attackers to bypass security controls and gain complete access to sensitive financial data via HTTP. Tagged as an Authentication Bypass in EUVD-2026-61889, the flaw carries a CVSS scope change indicator meaning successful exploitation can extend confidentiality impacts to additional Oracle Hyperion products sharing the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle's own designation of this as 'easily exploitable' and the low attack complexity are meaningful risk signals for organizations running this financial consolidation platform.
Local privilege escalation in Oracle Payroll (E-Business Suite 12.2.3 through 12.2.15) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the payroll application, achieving complete confidentiality, integrity, and availability impact including full takeover. The vulnerability carries a confirmed scope change (S:C), meaning successful exploitation can cascade to affect additional products co-hosted on the same infrastructure - a significant blast-radius amplifier in shared EBS environments. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is assessed as a targeted insider or post-breach scenario rather than opportunistic remote attack.
Full system takeover is achievable in Oracle Hyperion Financial Management 11.2.25.0.000 through a flaw in its Security component, exploitable over HTTP by any low-privileged attacker with network access and no required user interaction. The CVSS 3.1 score of 8.8 reflects complete high-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Hyperion Financial Management 11.2.25.0.000 contains a flaw in its Security component that allows a high-privileged, network-authenticated attacker to achieve full system takeover via HTTP, impacting confidentiality, integrity, and availability. Disclosed via Oracle's August 2026 Critical Security Patch Update (CSPU) and corroborated by EUVD-2026-61886, the attack requires no user interaction and has low complexity once privileged credentials are available. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, network-authenticated attacker exploiting a flaw in its Security component via HTTP. The vulnerability demands high attack complexity - indicating specific conditions must align - but successful exploitation yields complete compromise of confidentiality, integrity, and availability, consistent with a privilege escalation or security bypass in the access-control subsystem. No public exploit code or active exploitation has been identified at time of analysis; Oracle addressed this through the August 2026 Critical Patch Update.
Local authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged attacker with infrastructure logon to read and modify all application-accessible financial data. The CVSS 7.1 score reflects high confidentiality and integrity impact with no availability disruption, constrained entirely to the local attack surface. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data exfiltration and partial service disruption in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per the 'Authentication Bypass' tag, likely involves improper enforcement of access controls that permits a low-privileged user to read data far beyond their authorization level, achieving complete access to all Financial Management accessible data (C:H). No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to leverage for any authenticated user of the application.
Unauthorized data access and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 are achievable by any low-privileged, network-connected attacker via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per vendor-assigned tags, involves an authentication bypass mechanism that elevates effective access beyond the attacker's granted privileges, enabling exposure of critical financial data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog; however, the low attack complexity and broad network exposure make it a high-priority remediation target for organizations running the affected release.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all financial data accessible within the application and degrade service availability via HTTP. The 'Authentication Bypass' tag suggests the Security component vulnerability enables privilege escalation beyond the attacker's granted role, exposing sensitive financial consolidation data. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, network accessibility, and high confidentiality impact against enterprise financial data makes this a meaningful priority for affected organizations.
Oracle Order Management's Product Diagnostic Tools component exposes a local privilege-dependent flaw affecting versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, allowing a high-privileged local attacker to achieve unauthorized read and write access to critical data with scope impact extending beyond the Order Management module itself. The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) confirms that exploitation is constrained to infrastructure-level access, requiring both physical or logical logon to the host system and an elevated account, but successful exploitation yields complete confidentiality and integrity compromise. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed.
Oracle Workflow's Notification Mailer component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised by a low-privileged network attacker over HTTP, enabling unauthorized creation, deletion, or modification of critical workflow data and triggering a complete denial of service. The CVSS 3.1 score of 8.1 reflects high integrity and availability impacts with no confidentiality exposure, exploitable with low complexity and no user interaction. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Oracle Order Management's Product Diagnostic Tools component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 can be fully compromised by a low-privileged attacker over HTTP, resulting in complete system takeover with high confidentiality, integrity, and availability impact. The attack requires low privileges and high complexity to execute, reducing the immediacy of the threat but not its severity if conditions are met. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Hyperion Financial Management 11.2.25.0.000 contains an authentication bypass in its Security component that allows a low-privileged authenticated attacker to exceed their authorized access over HTTP, resulting in full confidentiality and integrity compromise of all application data. The flaw enables unauthorized read access to sensitive corporate financial records as well as creation, deletion, or modification of critical data across the entire HFM instance. No public exploit has been identified at time of analysis, and Oracle addressed this vulnerability in the Critical Patch Update for August 2026.
Full system takeover is possible in Oracle Hyperion Financial Management 11.2.25.0.000 through the Security component, exploitable via SQL by a low-privileged network attacker with no user interaction required. Oracle classifies this as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and full-takeover impact elevate real-world risk for any organization running the affected version.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an unauthenticated HTTP endpoint vulnerable to a complete denial-of-service condition. Attackers with network access can cause the Workflow service to hang or crash repeatedly with no authentication required and low attack complexity, as confirmed by Oracle's August 2026 CPU advisory. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Full compromise of Oracle Workflow (Workflow Notification Mailer component) in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by an unauthenticated attacker who can reach the product over SMTP, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) reflects an easily exploitable network flaw resulting in complete takeover of Oracle Workflow. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided.
SQL-layer exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged network attacker to fully compromise data confidentiality and integrity across all accessible financial data. The flaw resides in the Security component, and successful exploitation permits unauthorized read, creation, deletion, and modification of critical data - a particularly severe outcome for an EPM platform handling sensitive financial consolidation records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a high-priority patch target for any Oracle EPM deployment.
Full takeover of Oracle Web Services Manager is achievable by unauthenticated remote attackers via HTTPS in versions 12.2.1.4.0 and 14.1.2.0.0 of the Oracle Fusion Middleware product line. The vulnerability resides in the Web Services Security component and carries a CVSS 3.1 base score of 8.1, with complete confidentiality, integrity, and availability impacts confirmed by Oracle's August 2026 Critical Patch Update advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover of Oracle Financial Services Enterprise Case Management versions 8.0.8.2 and 8.1.2.11 is achievable by low-privileged, network-authenticated attackers targeting the Web UI component over HTTP. Oracle rates this as easily exploitable with a CVSS 3.1 score of 8.8, reflecting full confidentiality, integrity, and availability impact - consistent with complete application compromise. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthenticated attacker reach the application over TLS and read or alter all data the product can access, with a scope-changing blast radius into adjacent Oracle products. Rated CVSS 10.0, it is trivially exploitable (AV:N/AC:L/PR:N/UI:N) and delivers full confidentiality and integrity compromise while leaving availability untouched. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the perfect score and unauthenticated network reach make it a top-priority patch.
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a low-privileged attacker with network access, operating over the SQL layer, fully compromise the application and - because of a scope change - significantly impact other connected products. Oracle rates it CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact. No public exploit code has been identified and it is not on CISA KEV, but the low complexity and low privilege bar make it a top-priority patch item.
Oracle Product Hub versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes a full system takeover path via a network-accessible flaw in its Outbound Data component, exploitable by any low-privileged authenticated user over HTTP with no user interaction required. Oracle classifies this as 'easily exploitable' and confirms complete confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, but the low attack complexity warrants urgent remediation for all affected deployments.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local-access vulnerability in its Security component that allows an unauthenticated local attacker to achieve full system takeover - compromising confidentiality, integrity, and availability - when combined with required interaction from a separate legitimate user. The attack is constrained to actors with logon access to the infrastructure hosting HFM and requires high complexity to execute, limiting the realistic threat population to insiders or those who have already established a foothold on the target server. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Unauthenticated remote data exposure in Oracle Siebel CRM Integration's REST component allows network attackers to read all CRM-accessible data without credentials across versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable with no authentication and minimal attack complexity, yielding complete confidentiality loss. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Unauthenticated remote exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 exposes the Security component to authentication bypass via HTTP, enabling attackers to read critical or all accessible financial data and inflict a partial denial of service. The vulnerability is rated CVSS 8.2 (High) with a low-complexity, network-accessible attack vector requiring no privileges or user interaction. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the authentication bypass tag and unauthenticated attack surface make this a meaningful priority for any organization running the affected version.
Remote unauthenticated denial-of-service in Oracle Helidon 3.2.18 allows network-reachable attackers to trigger a hang or repeatably crash the Imperative Web Server component via crafted HTTP requests, fully disrupting availability. The vulnerability carries a CVSS 3.1 score of 7.5, is described by Oracle as easily exploitable, and requires no authentication, no user interaction, and only standard HTTP network access. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity makes opportunistic probing straightforward against any internet-exposed Helidon instance.
Remote denial-of-service in Oracle Java SE's 2D component allows unauthenticated network attackers to hang or crash the JVM across versions 25.0.4 and 26.0.2 via multiple protocols. The attack surface spans both server-side Java deployments exposing 2D-related APIs through web services and client-side environments running sandboxed Java Web Start applications or applets processing untrusted code. Oracle characterizes this as easily exploitable with no public exploit identified at time of analysis; no KEV listing is present.
SAML-based authentication bypass and full product takeover affects Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware's Agent infrastructure component. A remote attacker with no credentials can reach the SAML processing surface over the network and, per Oracle's own rating, easily compromise the identity broker outright - CVSS 9.8 with full confidentiality, integrity, and availability impact. Because Oracle Access Manager is a single-sign-on and access-enforcement gatekeeper, its takeover cascades to every downstream application it protects. No public exploit identified at time of analysis; not listed in CISA KEV.
Unauthenticated adjacent-network exploitation of Oracle Hyperion Data Relationship Management 11.2.25.0.000 enables complete read and write access to all master data managed by the platform. The vulnerability resides in the Access and Security component and is tagged as an authentication bypass, allowing an attacker positioned on the same physical communication segment to exfiltrate sensitive hierarchical reference data and silently manipulate or delete critical records without credentials or user interaction. No public exploit has been identified at time of analysis and no CISA KEV listing has been observed, but the low attack complexity and absence of any authentication requirement make this a meaningful priority for organizations co-locating DRM with other internal systems on shared network segments.
Oracle Hyperion Data Relationship Management (DRM) 11.2.25.0.000 exposes a high-severity access control flaw that allows a low-privileged, network-authenticated attacker to fully compromise confidentiality and integrity of critical DRM data, with scope change extending impact to additional Oracle Hyperion products. Exploitation requires human interaction from a victim user, consistent with a cross-site or cross-context attack pattern (the 'Authentication Bypass' tag suggests privilege escalation beyond the attacker's initial access tier). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access and integrity compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a local attacker holding low-privilege infrastructure credentials to fully circumvent application-level access controls, yielding complete read and write access to all DRM-managed master data. The vulnerability resides in the Access and security component and is tagged as an Authentication Bypass, suggesting internal authorization enforcement fails once basic OS-level access to the host is obtained. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes critical master data to unauthenticated remote attackers over HTTP. Exploitation requires human interaction from a victim user - consistent with a reflected or client-side attack vector - allowing an attacker to read or tamper with all data accessible within the DRM platform, including sensitive master data governance records. No public exploit or CISA KEV listing has been identified at time of analysis, though the Oracle August 2026 Critical Patch Update addresses this issue.