Privilege Escalation
Monthly
Improper privilege management in the GiveWP WordPress donation plugin (affected ranging from 4.16.6 up to but not including 4.16.8.1) lets unauthenticated remote attackers be mis-resolved as an arbitrary donor and then set the WordPress account password of any user linked to that donor record, up to and including an administrator. The root cause is CWE-269: the plugin does not consistently normalise donor e-mail addresses between the value it stores and the value it later uses for donor lookup, so a crafted e-mail string (case, whitespace, or alias/dot variations) can collide with a privileged donor identity. Exploitation is confirmed feasible - publicly available exploit code exists via WPScan and no authentication or user interaction is required - although the AC:H factor and low EPSS (0.18%, 8th percentile) indicate a targeted rather than mass-exploitation profile; there is no CISA KEV entry, so active exploitation is not confirmed. Vendor-released patch: 4.16.8.1.
Unauthenticated privilege escalation in JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress (versions up to and including 3.6.2) allows remote attackers to create administrator-level user accounts on affected sites. The flaw stems from missing validation that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback, enabling arbitrary user creation with maximum privileges. No public exploit code has been identified at time of analysis, but the CVSS 9.8 critical rating and lack of authentication or user interaction make this a top-priority risk for any site running the vulnerable plugin.
The user wants a JSON analysis for CVE-2026-87273, Oracle VM VirtualBox Core, CVSS 8.6, AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Let me construct fields carefully. Product name: "Oracle VM VirtualBox" (3 words... "Oracle VM VirtualBox" - that's 3 words). Good. Summary: Do not start with "A vulnerability". Start with impact verb + product. Something like: "Oracle VM VirtualBox 7.2.16 contains a Core component flaw that lets an attacker with logon access to the host... trigger memory corruption via a crafted guest/host interaction requiring user interaction, leading to full takeover of the VirtualBox process with scope change affecting additional products." Technical context: Hypervisor/core component, scope change S:C means the vulnerability in VirtualBox can impact other components (e.g., host OS or other VMs). AV:L means local access — attacker must have logon to infrastructure where VirtualBox executes — that's a common Oracle phrasing for AV:L (local logon, but not necessarily VM guest). CWE not provided, but Oracle typically assigns memory safety / sandbox escape classes. We shouldn't invent CWE. State that CWE was not assigned/provided and the root cause class is inferred from CVSS scope change and impacts — likely a flaw in the Core component enabling escape from intended privilege boundary. Risk assessment: CVSS 8.6 high, AV:L reduces, AC:L, PR:N but requires logon (authentication requirement nuance — description says "unauthenticated attacker with logon to the infrastructure"). PR:N in vector but "with logon" is ambiguous — Oracle's AV:L/PR:N means the attacker has a local account on the host but no elevated privileges. UI:R — requires victim user interaction. S:C — scope change. EPSS not provided, no KEV, no POC info. State explicitly that EPSS/KEV data absent. Affected products: Oracle VM VirtualBox 7.2.16 (per Oracle advisory cspusep2026). Note the advisory URL. CPE not provided. Remediation: patch — Oracle advisories reference fixes in CPUs; version f
Oracle VM VirtualBox 7.2.16 (Core component) can be fully compromised by a low-privileged attacker who already has an interactive logon on the host where VirtualBox executes, allowing takeover of the VirtualBox process and, by extension, the workload it manages. The flaw carries a CVSS 3.1 base score of 7.8 with complete loss of confidentiality, integrity and availability, and is rated by Oracle as 'easily exploitable' with no user interaction required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation requires local access rather than a remote network vector.
Oracle VM VirtualBox 7.2.16 on Windows hosts contains a flaw in the Core component that lets an attacker who already holds low-privileged interactive logon on the host machine take full control of VirtualBox itself, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8). The vulnerability is local-only (AV:L) and applies exclusively to Windows hosts — Linux and macOS installations are reported as unaffected. No public exploit code or CISA KEV listing is present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Local privilege escalation in Oracle VM VirtualBox 7.2.16 on Windows hosts allows a low-privileged user who can log on to the machine to take full control of the hypervisor, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). Oracle's advisory rates the flaw as easily exploitable, but no public exploit code has been identified at time of analysis. The vulnerability applies only to Windows hosts, so Linux and macOS installations of the same release are not in scope according to the vendor.
A local attacker who already holds a low-privileged logon on a Windows host running Oracle VM VirtualBox 7.2.16 can fully take over the VirtualBox product through a flaw in its Core component, achieving high confidentiality, integrity and availability impact within the VirtualBox context (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Only Windows hosts are affected per Oracle, and the vendor characterises the issue as easily exploitable with no user interaction required. No KEV listing, EPSS score or public exploit code was present in the supplied intelligence, so no public exploit is identified at time of analysis.
Full takeover of Oracle VM VirtualBox 7.2.16 on Windows hosts is possible for a low-privileged user who already has an interactive logon on the machine, giving complete loss of confidentiality, integrity, and availability for the VirtualBox process and the guest VMs it manages. The flaw is reached locally (AV:L) with low complexity and no user interaction beyond that initial logon (PR:L, UI:N), so it is a local privilege-escalation/containment-escape class issue rather than a remote one. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied in the source data.
Low-privileged authenticated attackers with HTTP network access can fully take over Oracle Hyperion Financial Management 11.2.26.0.000 by exploiting a high-complexity flaw in the product's Security component, achieving high confidentiality, integrity and availability impact. Oracle rates the issue CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting that exploitation is difficult but complete compromise results. No public exploit code and no CISA KEV listing were observed at time of analysis, and no EPSS score was supplied, so real-world exploitation activity is unconfirmed.
Full takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an authenticated attacker holding high privileges, who can send crafted HTTP requests to the Security component and gain complete control of confidentiality, integrity, and availability. The vulnerability is rated CVSS 7.2, and no public exploit code or active exploitation has been identified at time of analysis; EPSS data is unavailable. The high-privilege requirement limits exposure to already-compromised or insider accounts, but successful exploitation yields total application compromise.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a low-privileged account and sits on the same adjacent network segment as the HFM server take full control of the application. Exploitation is rated AV:A/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact, and Oracle's January 2026 Security Alert (cspusep2026) is the authoritative advisory. No public exploit code has been identified and there is no CISA KEV listing at the time of analysis, so risk is concentrated in environments where untrusted parties can reach the HFM host's network segment.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a high-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity and availability impact across a single security scope. Successful exploitation means takeover of the HFM platform rather than a narrow data leak — the attacker gains the ability to read, alter and disrupt the financial consolidation environment. The vulnerability is remotely reachable and low-complexity once the required privileged position is obtained, though no public exploit code and no CISA KEV entry have been reported at time of analysis; the fixed release is delivered through Oracle's Critical Security Patch Update channel.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an authenticated attacker who already holds a low-privileged logon on the host running the application seize full control of the HFM instance, with high confidentiality, integrity and availability impact. Oracle rates the attack as difficult (AC:H) and the vector is strictly local (AV:L) with no user interaction, so the exposure is limited to operators of the affected server rather than the network at large. No public exploit code has been identified at time of analysis, and the only supplied reference is Oracle's Critical Security Patch Update advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a high-privileged account reach the application over HTTP and fully take over the HFM instance, with high impact to confidentiality, integrity, and availability. Exploitation is rated as easy (AC:L, no user interaction) once the privileged foothold exists, so the practical barrier is obtaining or abusing an administrative credential rather than defeating any exploit mitigation. There is no public exploit code or CISA KEV entry at time of analysis, and no EPSS score was supplied, so the real-world risk is driven by internal admin-account hygiene and network exposure of the HFM web tier.
Authenticated low-privileged attackers who can reach the SQL-facing surface of Oracle Hyperion Financial Management 11.2.26.0.000 can achieve complete takeover of the application. Oracle's advisory rates this 8.8 with full confidentiality, integrity, and availability impact, and the flaw is described as easily exploitable with no user interaction required. At the time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS score in the supplied intelligence, so this should be treated as a high-severity, patch-now issue rather than a known active campaign.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged, network-connected user take full control of the application, with high impact to confidentiality, integrity and availability. Exploitation is rated difficult (AC:H) because it depends on a narrow timing or state precondition, but once met it requires only an authenticated low-privilege session over HTTP and no user interaction. No public exploit code or CISA KEV entry was provided at time of analysis, and no CWE classification or EPSS score accompanied the vendor disclosure.
Unauthenticated attackers with network access to the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to fully compromise the application, with high impact to confidentiality, integrity and availability (CVSS 8.1). Oracle rates the flaw as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control rather than on a trivially repeatable request. No CISA KEV listing, EPSS score or public exploit code was provided in the source data, so active exploitation and weaponization are not confirmed.
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an authenticated, low-privileged attacker who reaches the application over the network via HTTP and exploits a flaw in its Security component. Oracle's advisory rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), describing it as easily exploitable with complete loss of confidentiality, integrity and availability. No EPSS score, CISA KEV entry, or public proof-of-concept was supplied in the available intelligence, so active exploitation is unconfirmed; the only vendor reference is the Oracle Critical Security Patch Update advisory.
A low-privileged attacker with network access over HTTP can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000, achieving complete loss of confidentiality, integrity, and availability of the application (CVSS 3.1 base 8.8). The defect resides in the product's Security component and requires only a valid low-privileged account, with no user interaction, making it straightforward to automate once an attacker has a foothold. There is no public exploit identified at time of analysis and no CISA KEV listing, but Oracle's Critical Security Patch Update advisory is the authoritative source for the fix.
Low-privileged authenticated attackers with HTTP network access can exploit the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 to fully take over the application, with high impact to confidentiality, integrity and availability. Oracle scores the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is low-complexity once a valid low-privilege account exists, and a fix is published through Oracle's Critical Patch Update process. No public exploit code or CISA KEV entry has been identified at the time of analysis, and no EPSS score was supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker who can log on to the host running the application take full control of the product. Successful exploitation results in complete loss of confidentiality, integrity and availability of the financial consolidation environment (CVSS 3.1 base 7.8, AV:L/PR:L). No public exploit code or CISA KEV listing was identified in the supplied intelligence, and the only reference is Oracle's Critical Security Patch Update advisory, so patch status should be confirmed against that document.
Authenticated attackers who already hold high application privileges on Oracle Hyperion Financial Management 11.2.26.0.000 can fully take over the product over the network through its HTTP interface, with the impact extending beyond HFM itself due to a scope change. Oracle scores this 9.1 (CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), so while the technical exploit path is low-complexity and requires no user interaction, the high-privilege prerequisite means this is a post-compromise or malicious-insider escalation path rather than an anonymous remote attack. No public exploit code has been identified at time of analysis.
Full compromise of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through a SQL-based attack against the product's Security component, with High confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). The critical qualifier is privilege: exploitation requires an attacker who already holds a high-privileged account and network reachability to the affected component, so this is primarily an insider, credential-compromise, or laterally-moving-attacker risk rather than an unauthenticated perimeter threat. No EPSS score, CISA KEV listing, or public exploit code was supplied; the only reference is Oracle's Critical Patch Update advisory, and no exact patched build version is stated in the available data.
Authenticated low-privileged attackers with HTTP access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in the product's Security component, gaining complete control of confidentiality, integrity and availability (CVSS 8.8). The issue is easily exploitable once a valid account exists — low complexity, no user interaction — and results in takeover of the HFM application rather than a limited data leak. No EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed and no public exploit code was identified at time of analysis.
A low-privileged attacker who can reach the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can take over the application by exploiting a flaw in its Security component. Although rated CVSS 3.1 7.5, the vulnerability is explicitly difficult to exploit (AC:H) and requires valid low-privileged credentials (PR:L), but successful exploitation yields full confidentiality, integrity and availability impact. No public exploit code or confirmed active exploitation appears in the available intelligence, and no EPSS or CISA KEV data was supplied.
A flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged attacker who can reach the service over the network take full control of the application via SQL-based manipulation. Oracle's Critical Security Patch Update rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity and availability with no user interaction. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the immediate driver is the fully-compromised-outcome severity for any internet- or partner-exposed HFM deployment, not observed attacks.
Authenticated low-privileged attackers with HTTP access to Oracle Hyperion Financial Management 11.2.26.0.000 can fully compromise the application through a flaw in its Security component, gaining complete control over confidentiality, integrity and availability of the platform. Oracle rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and describes it as 'easily exploitable', meaning a valid low-privilege account is the main barrier rather than technical complexity. No public exploit code, EPSS score, or CISA KEV listing was provided in the intelligence feed, so exploitation status is 'no public exploit identified at time of analysis' — but the low attack complexity and the sensitivity of financial consolidation data make this a priority for internet- or intranet-exposed HFM deployments.
Full takeover of Oracle Hyperion Financial Management is achievable by a low-privileged, authenticated attacker who can reach the product's Security component over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity and availability (C:H/I:H/A:H). Only version 11.2.26.0.000 is listed as affected, and the CVSS 3.1 base score of 7.5 is capped by two meaningful limiters rather than by reduced impact: AC:H, meaning the vendor itself rates the attack 'difficult' and dependent on timing, configuration or state conditions outside the attacker's full control, and PR:L, meaning a valid low-privileged account is a hard prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied, so the practical near-term risk is driven by the severity of the post-exploitation outcome rather than by observed threat activity.
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privileged (administrative or operator-level) account on the target and who can reach it over Oracle Net rather than standard HTTP. The flaw sits in the product's Security component, requires no user interaction, and carries low attack complexity once privileged access and Oracle Net connectivity exist, with a scope change (S:C) indicating that a successful compromise can extend beyond HFM to other products in the deployment. The high-privilege prerequisite (PR:H) rules out anonymous internet attackers, so realistic exploitation depends on insider access, stolen credentials, or a prior compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied.
Unauthenticated attackers positioned on a network segment adjacent to an Oracle Hyperion Financial Management server can fully compromise the application, resulting in complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8). Only version 11.2.26.0.000 is identified as affected, and Oracle's September 2026 Critical Patch Update advisory is the sole reference. No public exploit code, EPSS score, or CISA KEV listing is present in the available data, so active exploitation is not confirmed.
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 server can exploit a flaw in the Security component to achieve full takeover of the application, with potential impact on other connected products due to scope change. The vulnerability requires adjacency (AV:A) rather than internet reachability, and no authentication or user interaction is needed, making it high risk for poorly segmented environments. No public exploit code has been identified at time of analysis, and CISA KEV does not list active exploitation.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an authenticated low-privileged attacker reach the application over HTTP and escalate to full takeover of the HFM instance, with high impact to confidentiality, integrity and availability. The vulnerability is trivially automatable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), meaning any valid low-rights account becomes a stepping stone to administrative control of the financial consolidation platform. Exploitation status at time of analysis: no public exploit identified and no CISA KEV listing; no EPSS score or CWE classification was supplied with the source data.
A locally exploitable flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a high-privileged logon on the host running the application take full control of the product, with potential follow-on impact to other connected Oracle components (scope change). Exploitation additionally requires a user other than the attacker to perform some interaction, making this a privileged-operator-plus-social-engineering attack rather than a remote unauthenticated one, although successful exploitation yields complete confidentiality, integrity and availability loss on the HFM instance. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied with the intelligence feed.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a valid low-privileged logon on the host running the application take over the product, with a scope change indicating the compromise can extend to interconnected systems. Successful exploitation yields full confidentiality, integrity and availability impact — this is a takeover-class flaw, not merely an information leak. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was provided with the record.
Low-privileged attackers with HTTP network access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in its Security component, achieving high impact to confidentiality, integrity, and availability (CVSS 8.8). The vulnerability is easily exploitable with no user interaction, and successful exploitation can result in complete takeover of the HFM application and the financial consolidation data it manages. At time of analysis there is no public exploit code identified and the issue is not listed in CISA KEV, though the low attack complexity means weaponization risk is meaningful; Oracle addressed it in its April 2026 Critical Patch Update advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 can be taken over by a low-privileged attacker who can reach the application's HTTP interface, because the Security component does not properly restrict what an authenticated but unprivileged session can do. Successful exploitation yields full compromise of confidentiality, integrity and availability of the HFM application, meaning an attacker could read, alter or destroy financial consolidation data and gain administrative control of the deployment. The flaw is rated 8.8 on CVSS 3.1; no public exploit code or CISA KEV listing was present in the source data at time of analysis, so this is currently a patch-now, monitor-for-exploitation issue rather than a confirmed actively exploited one.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security-component flaw that lets a low-privileged, network-connected user take full control of the application over HTTP. Per the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), exploitation requires only a valid low-privilege account and no user interaction, but delivers complete compromise of confidentiality, integrity and availability. There is no public exploit code or CISA KEV entry in the supplied intelligence at time of analysis; the only consolidated signal is Oracle's own security alert, and separate risk scores (EPSS) were not provided.
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a valid low-privilege application account and can reach the product's HTTP interface, because the Security component does not adequately enforce privilege boundaries (assessed CVSS 3.1 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). No user interaction is required, and the scope change (S:C) means a successful compromise can significantly impact additional integrated products that trust HFM, widening the blast radius well beyond the vulnerable host itself. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so the risk is driven by the trivial exploitation path available to anyone who can obtain a low-privilege login rather than by observed active exploitation.
Authenticated low-privileged attackers with HTTP access to Oracle Contract Lifecycle Management for Public Sector (part of Oracle E-Business Suite, V16) can escalate their privileges and achieve full takeover of the Contract Lifecycle Management application, affecting confidentiality, integrity and availability of contract data (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw sits in the "ECC For Award and IDV" component, which is exposed over the web and requires only an ordinary user account rather than administrative rights. At time of analysis there is no public exploit code identified and the issue has not been added to CISA KEV, but Oracle rates it "easily exploitable," so patching on the vendor's published patch-update timeline is the priority.
Oracle Banking Branch versions 14.5.0.0.0 through 14.9.0.0.0 contain an exploitable weakness in the Reports component that lets a low-privileged, network-connected user achieve full takeover of the application, with potential knock-on impact to other connected products (scope change). Exploitation is rated 8.0 by Oracle's CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), meaning the attacker must already hold a valid low-privilege account and must persuade a second person to perform an action, which raises attack complexity despite the high impact. No public exploit code and no CISA KEV listing were present in the supplied intelligence at time of analysis.
Low-privileged attackers holding a valid Oracle E-Business Suite account can take over the Oracle Purchasing module (versions 12.2.3 through 12.2.15) by sending crafted HTTP requests to the application's web interface, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). No user interaction or elevated privilege is needed beyond a basic authenticated session, making the flaw trivially automatable once credentials exist. At time of analysis there is no public exploit code identified and the issue is not listed in CISA KEV; no EPSS score was supplied in the source data. Oracle has published a Critical Security Patch Update advisory (September 2026) covering the affected releases.
Any low-privileged, authenticated user with HTTP access to the Oracle Contract Lifecycle Management for Public Sector module (Award/PO component) of Oracle E-Business Suite 12.2.13 through 12.2.15 can fully take over the application, with high impact to confidentiality, integrity and availability. The flaw is trivially reachable over the network with no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), meaning a compromised or malicious internal account is enough to reach contract and award data and to manipulate application state. At time of analysis there is no public exploit identified and no CISA KEV listing, so the immediate risk is driven by the large installed base of EBS and the low skill barrier implied by the vector; Oracle has published a Critical Security Patch Update advisory covering the fix.
Full takeover of Oracle Product Hub within Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker who can reach the module's HTTP interface, with CVSS 8.8 reflecting high confidentiality, integrity, and availability impact across the whole affected application. Exploitation requires only a valid low-privileged EBS session and network access to HTTP — no user interaction and no administrative privileges. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's Critical Security Patch Update at oracle.com/security-alerts/cspusep2026.html is the only patch reference provided.
Authenticated attackers holding a low-privileged Oracle E-Business Suite account can fully take over the Bills of Material module in versions 12.2.3 through 12.2.15, achieving high impact against confidentiality, integrity, and availability (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw lives in the module's Setup Workbench component and needs only HTTP reachability plus a valid low-privilege login — no victim interaction — making it a strong privilege-escalation stepping stone for anyone with a foothold in the EBS environment. Oracle documents the issue in its September 2026 Critical Security Patch Update advisory; no public exploit code, EPSS score, or CISA KEV entry accompanies this record, so active exploitation is unconfirmed and no public exploit was identified at time of analysis.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains a flaw in its Access and Security component that allows a low-privileged, authenticated user with HTTP network access to escalate privileges and take over the application, with high impact to confidentiality, integrity and availability. The vulnerability is rated 'difficult to exploit' by Oracle (AC:H), so successful abuse requires favorable conditions rather than a single trivial request, but the payoff is full compromise of the DRM instance. No public exploit code or CISA KEV listing has been identified at time of analysis, and Oracle has published a fix in its Critical Patch Update advisory.
Privilege escalation and full application takeover in Oracle Hyperion Data Relationship Management 11.2.26.0.000, where a low-privileged attacker with network access over HTTP can compromise the Access and Security component, resulting in complete loss of confidentiality, integrity, and availability of the product (CVSS 3.1 base 7.5). Exploitation is assessed as difficult (AC:H), consistent with a security-logic or state/timing-dependent flaw rather than a simple injection, and no public exploit code or CISA KEV entry was identified at time of analysis. The practical risk concentrates in large finance and EPM environments where DRM holds authoritative master-data hierarchies and is reachable by ordinary business users.
Oracle Banking Origination versions 14.5.0.0.0 through 14.9.0.0.0 contain a high-complexity flaw in the Onboarding Batch Processes component that lets a low-privileged, authenticated attacker reach the application over HTTP and achieve full takeover (high confidentiality, integrity and availability impact, CVSS 3.1 base 7.5). The attack vector is network-based but the vendor rates exploitation as difficult (AC:H), implying a race condition, state dependency or timing condition must be satisfied rather than a straightforward request. No public exploit code or CISA KEV listing was present in the supplied intelligence at time of analysis, so the immediate risk is driven by the severity of impact in banking environments rather than confirmed active exploitation; EPSS data was not provided.
Oracle Advanced Benefits, a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be fully taken over by a high-privileged attacker who reaches the Self-Service What-if Analysis component over HTTP. The vendor-assigned CVSS 3.1 score is 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting a hard-to-exploit but high-impact flaw that can also affect additional products beyond the vulnerable component (scope change). No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS probability was supplied with the source data.
A high-privileged attacker with network access to the Oracle Contracts module of Oracle E-Business Suite 12.2.14 or 12.2.15 can fully compromise that module, affecting confidentiality, integrity, and availability. The flaw sits in the Internal Operations component and requires an already-elevated application account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 7.2) - it is not reachable by unauthenticated or low-privileged users, and no user interaction is needed once the prerequisite access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical risk is therefore concentrated in environments where many users or service accounts already hold broad Contracts privileges.
Oracle Contracts, a module within Oracle E-Business Suite, can be fully taken over by a high-privileged attacker who can reach the application over HTTP in versions 12.2.14 and 12.2.15. Oracle's own advisory rates this 7.2 with complete confidentiality, integrity, and availability impact, and notes it is 'easily exploitable' once the attacker holds elevated privileges. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-priority issue rather than an observed campaign.
Oracle Contracts, a module within Oracle E-Business Suite 12.2.14-12.2.15, allows a low-privileged authenticated attacker with HTTP network access to take over the Contracts component, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw requires any valid low-privilege account but no user interaction or elevated rights, and it works against default configurations of the affected versions, so the primary limiting factor is obtaining an authenticated foothold on the EBS instance. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the combination of low privileges, network reach, and full component takeover places it in a high-priority tier rather than the pre-authentication maximum tier.
Unauthenticated attackers with network reach to the Mobile Application Server of Oracle E-Business Suite can fully take over the MWA Terminal Server component in supported 12.2.3 through 12.2.15 releases, gaining high impact across confidentiality, integrity and availability. Exploitation is rated high-complexity (AC:H) but requires no credentials and no user interaction, and Oracle scores it 8.1. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so the current real-world exploitation picture is unconfirmed.
Oracle E-Business Suite's Mobile Application Server (MWA Terminal Server component) in versions 12.2.3 through 12.2.15 can be fully taken over by an unauthenticated attacker who can reach the host over an adjacent network segment. The flaw is rated 7.5 with a CVSS vector of AV:A/AC:H/PR:N/UI:N and high confidentiality, integrity and availability impact, meaning an attacker positioned on the same physical communication segment as the Mobile Application Server hardware can compromise the service without credentials, though exploitation is complicated by conditions beyond the attacker's control (AC:H). Oracle has published the fix through its Critical Security Patch Update advisory; at the time of analysis there is no CISA KEV listing, no confirmed public exploit code and no EPSS score provided.
Component takeover in Oracle E-Business Suite's Demand Signal Repository (supported releases 12.2.3 through 12.2.15) lets an authenticated, low-privileged attacker reachable over HTTP (PR:L, network vector) seize control of the affected module, with full confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). The flaw sits in the Internal Operations component of the Demand Signal Repository and requires no user interaction, making it straightforward to trigger once a valid low-privilege session or role is obtained. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the Oracle Critical Security Patch Update advisory is the only authoritative reference and no EPSS score was supplied, so real-world exploitation likelihood is unquantified. Oracle E-Business Suite operators running the affected module should treat the corresponding Critical Patch Update as the remediation path.
Application takeover of the Document Management and Collaboration module in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by any authenticated low-privileged user with HTTP access, with high confidentiality, integrity and availability impact. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) because the attack is simple, needs no user interaction, and defeats the authorization boundary around the module's internal operations. No public exploit code or CISA KEV entry is identified at time of analysis, but the low privilege bar combined with broad enterprise EBS deployment makes this a patch-now item.
Oracle Document Management and Collaboration, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP. Successful exploitation grants complete control over the module's confidentiality, integrity, and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker can read, alter, or destroy managed documents and related business data. There is no CISA KEV listing, no public exploit code, and no EPSS data in the provided intelligence, so this is currently a patch-priority issue for Oracle E-Business Suite shops rather than a confirmed actively exploited threat.
Authenticated takeover of Oracle Product Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker reaching the application over HTTP, with the vendor scoring it 8.5 for high confidentiality, integrity and availability impact plus a scope change that extends damage onto other EBS products. Exploitation is rated difficult (AC:H) because the attacker must satisfy specific conditions inside the Internal Operations component, and no public exploit code or CISA KEV entry has been identified at time of analysis. No EPSS score was supplied, so real-world exploitation likelihood is not independently quantified and the flaw should be treated as a patch-cycle priority rather than a confirmed emergency.
High-privileged users who can already authenticate to Oracle E-Business Suite can trigger a hard-to-reach flaw in the Bills of Material Setup Workbench component of versions 12.2.3 through 12.2.15 and take full control of that module, with the potential to pivot into other connected EBS products because of the scope change. Oracle rates the issue CVSS 3.1 base 8.0 with high confidentiality, integrity and availability impact, but exploitation is described as difficult and requires an authenticated, privileged position plus network access over HTTP. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and the only reference available is Oracle's Critical Security Patch Update advisory.
Low-privileged attackers with HTTPS network access can fully compromise the Internal Operations component of Oracle Complex Maintenance, Repair and Overhaul (CMRO) in Oracle E-Business Suite versions 12.2.3 through 12.2.15, achieving complete confidentiality, integrity, and availability impact on the affected module. The flaw carries a CVSS 3.1 base score of 8.8 and requires only an authenticated network session (PR:L) with no user interaction, making it a straightforward lateral escalation for any user holding a valid low-privilege EBS account. At time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS data provided, so risk is driven by the exposed attack surface of internet- or intranet-reachable EBS deployments rather than confirmed active exploitation.
Oracle Product Hub, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged attacker with HTTP network access take over the Product Hub application. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields high confidentiality, integrity and availability impact across the module. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, though Oracle treats this class of flaw as remotely exploitable and easily abused, making prompt patching of internet- or intranet-exposed E-Business Suite deployments important.
Oracle Product Hub, the product master-data module of Oracle E-Business Suite, fails to properly enforce authorization in its Internal Operations component across supported releases 12.2.3 through 12.2.15, allowing an attacker who already holds a high-privileged account to achieve full takeover of the module over HTTP. Successful exploitation yields complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning master data, configuration and administrative functions can be read and altered. Oracle did not publish a CWE identifier with this record, no public exploit code has been identified at time of analysis, and neither CISA KEV nor EPSS data was supplied, so active exploitation cannot be confirmed.
Takeover of Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a highly privileged authenticated attacker with network HTTP access to the Internal Operations component, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). The flaw is rated easily exploitable (AC:L, UI:N) once the required credentials are held, and no public exploit has been identified at time of analysis. Because the CVSS vector specifies PR:H, anonymous or low-privileged internet attackers are ruled out, leaving the mandatory high-privilege account as the primary gating factor.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Fusion Middleware Security Framework component that lets a low-privileged attacker who can reach the IDE over HTTP achieve a full takeover of the product, with high confidentiality, integrity, and availability impact. Oracle rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation needs a valid low-privilege account but no user interaction or elevated privilege. There is no public exploit code identified and no CISA KEV listing at time of analysis, and no EPSS score was supplied, so the immediate operational risk is driven mainly by exposure of JDeveloper HTTP services rather than by observed exploitation.
Local low-privileged users who can log on to hosts running Oracle PeopleSoft Enterprise FIN Engineering Brazil 9.1 can fully take over the affected Engineering component, with high impact to confidentiality, integrity and availability. Oracle's advisory assigns a base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the flaw is trivially exploitable once any valid low-privilege logon on the infrastructure is obtained - no user interaction and no elevated privileges are required. There is no public exploit code or CISA KEV listing identified at time of analysis, so the immediate risk is concentrated in environments where untrusted or over-privileged users share the PeopleSoft application or database host.
Oracle Coherence (Core component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 can be fully taken over by a low-privileged attacker who can reach the HTTP interface, per Oracle's Critical Security Patch Update. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N, C/I/A all High) confirms a network-reachable but difficult-to-exploit flaw that yields complete compromise of the data grid rather than a limited data leak. No CISA KEV listing, public exploit code, or EPSS score is present in the supplied intelligence, so no public exploit identified at time of analysis and active exploitation is unconfirmed.
Full compromise of Oracle Coherence is achievable by low-privileged attackers who can reach the Coherence Core HTTP interface, affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 of the Oracle Fusion Middleware product. Successful exploitation gives complete loss of confidentiality, integrity and availability — Oracle describes the outcome as "takeover of Oracle Coherence" — with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was supplied with the source data, so the practical urgency currently rests on the size of the exposed Coherence estate rather than on observed exploitation.
Oracle Coherence, Oracle's in-memory data grid shipped as part of Fusion Middleware, can be fully taken over by a low-privileged attacker who can reach the cluster over the network in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The flaw sits in the Core component and is rated by Oracle as easily exploitable — CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — with confidentiality, integrity and availability all fully impacted, meaning compromise of the Coherence cluster rather than a narrow data leak. No EPSS score, CISA KEV entry or public exploit code was provided with this record; the only authoritative source is Oracle's Critical Security Patch Update advisory, so treat exploitation status as unconfirmed (no public exploit identified at time of analysis).
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 can be taken over by a low-privileged local attacker with logon access to the host infrastructure, allowing complete compromise of the Content Server component's confidentiality, integrity, and availability. The flaw is easily exploitable given local access and a valid account, but no public exploit or active exploitation has been identified at time of analysis. This is a locally-scoped critical-impact issue, not a remote-drive-by vulnerability.
Unauthenticated database takeover is possible in Oracle Database Server RDBMS releases 23.4.0 through 23.26.3 via crafted traffic sent to the Oracle Net listener. Per the Oracle-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), an attacker with network reachability can fully compromise confidentiality, integrity and availability of the RDBMS without credentials or user interaction, though Oracle characterizes the flaw as 'difficult to exploit' (AC:H). There is no public exploit code and no CISA KEV listing at time of analysis, so this is a patch-now enterprise hygiene issue rather than a confirmed active campaign.
Oracle Database Server's RDBMS engine can be fully compromised by any database account holding the CREATE DATABASE LINK privilege, affecting releases 19.3–19.32, 21.3–21.23 and 23.4.0–23.26.3. The flaw is reachable over Oracle Net with no user interaction and yields complete confidentiality, integrity and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N), i.e. full takeover of the RDBMS rather than a narrow data leak. Oracle has published a fix through its security advisory referenced by NVD; no public exploit code, EPSS score or CISA KEV entry was supplied, so there is no evidence of active exploitation at time of analysis.
Takeover of the Oracle Identity Manager Connector (component: Database Application Table) in Oracle Fusion Middleware is possible for a high-privileged attacker who can reach the affected HTTP interface, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Oracle rates the flaw 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker who already holds elevated privileges can fully compromise confidentiality, integrity and availability of the connector with no user interaction and low attack complexity. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV), though it was published within Oracle's scheduled Critical Patch Update cycle.
Local privilege escalation in Oracle Utilities Network Management System (NMS) allows any attacker holding a low-privileged logon on the host where the product executes to take over the affected application, with full loss of confidentiality, integrity and availability. The flaw spans the entire supported release line, from 2.4.0.1.0 through 2.4.0.1.33, 2.5.0.1.0-2.5.0.1.19, 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3, so virtually every deployed version is affected until the Vendor-released patch per the Oracle Critical Security Patch Update is applied. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and absence of user interaction make the flaw attractive once an attacker already has a foothold on the utility server.
Oracle Identity Manager (OIM) releases 12.2.1.4.0 and 14.1.2.1.0, shipped as part of Oracle Fusion Middleware, contain a flaw in the Security component that lets an attacker holding a low-privileged account reach the application over HTTP and take full control of the identity platform. Oracle rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting complete loss of confidentiality, integrity and availability with no user interaction required. No public exploit code or CISA KEV entry was available at time of analysis, so exploitation is assessed as plausible but not yet observed in the wild.
Authenticated, low-privileged network attackers can achieve full takeover of Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 through the Oracle Diagnostics Interfaces component, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is network-reachable over HTTP, requires only a low-privileged account and no user interaction, and is not pre-authentication, so exposure is greatest where many low-trust users can authenticate or where the EBS instance is internet-accessible. No public exploit code has been identified at time of analysis and EPSS is 0.45% (38th percentile); Oracle addresses the flaw in its September 2026 Critical Patch Update.
A locally exploitable privilege-escalation vulnerability in the Remote Diagnostic Agent component of Oracle Middleware Common Libraries and Tools (Oracle Fusion Middleware) allows any low-privileged user with a logon on the host to fully compromise the affected middleware installation. Successful exploitation results in complete loss of confidentiality, integrity, and availability — effectively a full takeover — across versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit code has been identified and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant or shared-host deployments where untrusted users already have accounts.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (Analytics Server component) lets any low-privileged user who can log on to the host where the service runs take full control of the BI platform. Both supported branches - 8.2.0.0.0 and 26.01.0.0.0.0 - are affected, with a CVSS 3.1 base score of 7.8 reflecting complete loss of confidentiality, integrity and availability. Oracle addressed it in its Critical Patch Update (cspusep2026); no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated low-privileged users can fully compromise Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 26.01.0.0.0 by sending crafted HTTP requests to the Analytics Server component, obtaining complete control over confidentiality, integrity, and availability of the platform. Oracle rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the only real prerequisite is a valid low-privilege account and network reachability to the HTTP interface. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so the immediate risk is driven by the severity of a successful takeover rather than confirmed in-the-wild activity.
Authenticated low-privileged users can fully compromise the Oracle Applications Framework (Personalization) component of Oracle E-Business Suite 12.2.9 through 12.2.15 by sending crafted HTTP requests, achieving complete loss of confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Oracle rates the flaw as easily exploitable with no user interaction, and the impact is described as full takeover of the Applications Framework rather than simple data exposure. No public exploit code or CISA KEV listing was identified at time of analysis, and remediation is available through Oracle's Critical Security Patch Update (cspusep2026).
Oracle E-Business Suite 12.2.9 through 12.2.15 contain a flaw in the Personalization component of the Oracle Applications Framework that lets a low-privileged user with HTTP network access take full control of the framework, with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). Exploitation is rated 'easily exploitable' by the vendor because it requires no user interaction and no special complexity — only a valid low-privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation status is currently unconfirmed. The vendor has published an out-of-band Critical Security Patch Update covering this issue; organizations running affected EBS releases should treat patching as urgent because the pre-authentication barrier is only a low-privilege login.
Authenticated high-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can fully take over the Oracle Applications Framework Personalization component, with high impact to confidentiality, integrity and availability. The flaw scores 7.2 on CVSS 3.1 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and low attack complexity once an attacker already holds a privileged EBS account. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so the practical risk is dominated by the credential-privilege precondition rather than by mass exploitation.
High-privileged users of Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) can exploit a flaw in the Platform Security component over HTTP to take complete control of the BI platform. The vendor rates this CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a highly privileged account but needs no user interaction and faces low attack complexity, with full confidentiality, integrity and availability impact. No public exploit code or CISA KEV entry is identified in the available data, and EPSS scoring was not supplied, so real-world exploitation activity is unconfirmed at time of analysis.
A hard-to-exploit local vulnerability in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 (Oracle Analytics, Platform Security component) lets a low-privileged user who can already log on to the host running the platform take full control of the BI service, with knock-on impact to connected products because the vulnerable component operates with changed scope. The attacker must additionally induce a separate legitimate user to perform an action (UI:R) and clear a high attack-complexity bar (AC:H), so exploitation is neither trivial nor remote. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; Oracle shipped the fix in its Critical Security Patch Update advisory (cspusep2026).
Attackers who already hold an elevated account on Oracle Business Intelligence Enterprise Edition can fully take over the platform by sending crafted HTTP requests to its Platform Security component, impacting confidentiality, integrity and availability of the whole deployment. Supported versions 8.2.0.0.0 and 26.01.0.0.0 are affected, and Oracle delivered the fix through its out-of-band critical security patch update. No public exploit code or CISA KEV entry has been identified at time of analysis, so the practical risk is driven by the high-privilege prerequisite rather than by active exploitation.
A difficult-to-exploit flaw in the Administration component of Oracle BI Publisher lets a low-privileged, authenticated attacker who can reach the server over HTTP take complete control of the platform, with high confidentiality, integrity and availability impact. Affected releases are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, as listed in Oracle's Critical Security Patch Update (cspusep2026). There is no CISA KEV listing, no referenced public exploit code and no EPSS score in the supplied data, so this reads as a patch-on-cadence item rather than an emergency — though the outcome is full platform takeover.
Local privilege escalation in the Installation component of Oracle Business Intelligence Enterprise Edition lets any low-privileged user who can log on to the host running the product take full control of the BI platform, affecting versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. With complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8), the flaw is attractive as a post-compromise escalation step, but it is not network-reachable and requires an existing OS-level account on the infrastructure. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and no EPSS data was supplied to gauge mass-exploitation likelihood.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 allows an attacker who already holds a low-privileged logon on the host running the platform to take full control of the BI EE deployment, with high confidentiality, integrity and availability impact across the Platform Security component. Oracle rates the flaw 7.0 (AV:L/AC:H/PR:L/UI:N), reflecting that exploitation is difficult and confined to the local host rather than reachable over the network. No public exploit code or evidence of active exploitation was identified in the supplied intelligence at time of analysis.
Oracle BI Publisher in Oracle Analytics (versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0) contains a flaw in the BI Platform Security component reachable over SOAP that allows a low-privileged, authenticated attacker with network access to fully take over the affected BI Publisher instance, with high confidentiality, integrity and availability impact (CVSS 8.8). Oracle characterizes the issue as easily exploitable, and the reference is the Oracle Critical Security Patch Update cspusep2026 advisory. No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis, and no EPSS score was provided.
An authenticated remote attacker with low privileges can fully take over Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 by sending crafted HTTP requests to the Resource Catalog Services component, which is part of Oracle Fusion Middleware. The flaw is rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning successful exploitation yields complete loss of confidentiality, integrity and availability of the affected JDeveloper instance. No CWE, EPSS score, KEV entry or public proof-of-concept was supplied in the source data, so active exploitation is not confirmed, but the low attack complexity and lack of user interaction make rapid patching advisable once the Oracle CPU fix is applied.
Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 contains an easily exploitable flaw in the Service Administration UI component that allows a low-privileged attacker with network access over HTTP to fully take over the platform, with high confidentiality, integrity, and availability impact (CVSS 8.8). Because exploitation only requires a valid low-privileged account rather than an administrator, any provisioned BI user could potentially escalate to full control of the BI deployment. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS data supplied; Oracle has published a Critical Security Patch Update advisory covering the issue.
Unauthenticated attackers with network reachability to the Analytics Web component of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can exploit a hard-to-trigger flaw to fully compromise the platform, achieving high confidentiality, integrity and availability impact consistent with a complete takeover. Oracle rates this CVSS 3.1 base 8.1 with attack complexity High, meaning exploitation depends on conditions outside the attacker's direct control rather than simply sending a request. No public exploit code has been identified and the issue is not listed in CISA KEV, so measured risk is driven by exposure of the Analytics Web HTTP interface rather than by observed in-the-wild activity.
Improper privilege management in the GiveWP WordPress donation plugin (affected ranging from 4.16.6 up to but not including 4.16.8.1) lets unauthenticated remote attackers be mis-resolved as an arbitrary donor and then set the WordPress account password of any user linked to that donor record, up to and including an administrator. The root cause is CWE-269: the plugin does not consistently normalise donor e-mail addresses between the value it stores and the value it later uses for donor lookup, so a crafted e-mail string (case, whitespace, or alias/dot variations) can collide with a privileged donor identity. Exploitation is confirmed feasible - publicly available exploit code exists via WPScan and no authentication or user interaction is required - although the AC:H factor and low EPSS (0.18%, 8th percentile) indicate a targeted rather than mass-exploitation profile; there is no CISA KEV entry, so active exploitation is not confirmed. Vendor-released patch: 4.16.8.1.
Unauthenticated privilege escalation in JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress (versions up to and including 3.6.2) allows remote attackers to create administrator-level user accounts on affected sites. The flaw stems from missing validation that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback, enabling arbitrary user creation with maximum privileges. No public exploit code has been identified at time of analysis, but the CVSS 9.8 critical rating and lack of authentication or user interaction make this a top-priority risk for any site running the vulnerable plugin.
The user wants a JSON analysis for CVE-2026-87273, Oracle VM VirtualBox Core, CVSS 8.6, AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Let me construct fields carefully. Product name: "Oracle VM VirtualBox" (3 words... "Oracle VM VirtualBox" - that's 3 words). Good. Summary: Do not start with "A vulnerability". Start with impact verb + product. Something like: "Oracle VM VirtualBox 7.2.16 contains a Core component flaw that lets an attacker with logon access to the host... trigger memory corruption via a crafted guest/host interaction requiring user interaction, leading to full takeover of the VirtualBox process with scope change affecting additional products." Technical context: Hypervisor/core component, scope change S:C means the vulnerability in VirtualBox can impact other components (e.g., host OS or other VMs). AV:L means local access — attacker must have logon to infrastructure where VirtualBox executes — that's a common Oracle phrasing for AV:L (local logon, but not necessarily VM guest). CWE not provided, but Oracle typically assigns memory safety / sandbox escape classes. We shouldn't invent CWE. State that CWE was not assigned/provided and the root cause class is inferred from CVSS scope change and impacts — likely a flaw in the Core component enabling escape from intended privilege boundary. Risk assessment: CVSS 8.6 high, AV:L reduces, AC:L, PR:N but requires logon (authentication requirement nuance — description says "unauthenticated attacker with logon to the infrastructure"). PR:N in vector but "with logon" is ambiguous — Oracle's AV:L/PR:N means the attacker has a local account on the host but no elevated privileges. UI:R — requires victim user interaction. S:C — scope change. EPSS not provided, no KEV, no POC info. State explicitly that EPSS/KEV data absent. Affected products: Oracle VM VirtualBox 7.2.16 (per Oracle advisory cspusep2026). Note the advisory URL. CPE not provided. Remediation: patch — Oracle advisories reference fixes in CPUs; version f
Oracle VM VirtualBox 7.2.16 (Core component) can be fully compromised by a low-privileged attacker who already has an interactive logon on the host where VirtualBox executes, allowing takeover of the VirtualBox process and, by extension, the workload it manages. The flaw carries a CVSS 3.1 base score of 7.8 with complete loss of confidentiality, integrity and availability, and is rated by Oracle as 'easily exploitable' with no user interaction required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation requires local access rather than a remote network vector.
Oracle VM VirtualBox 7.2.16 on Windows hosts contains a flaw in the Core component that lets an attacker who already holds low-privileged interactive logon on the host machine take full control of VirtualBox itself, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8). The vulnerability is local-only (AV:L) and applies exclusively to Windows hosts — Linux and macOS installations are reported as unaffected. No public exploit code or CISA KEV listing is present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Local privilege escalation in Oracle VM VirtualBox 7.2.16 on Windows hosts allows a low-privileged user who can log on to the machine to take full control of the hypervisor, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). Oracle's advisory rates the flaw as easily exploitable, but no public exploit code has been identified at time of analysis. The vulnerability applies only to Windows hosts, so Linux and macOS installations of the same release are not in scope according to the vendor.
A local attacker who already holds a low-privileged logon on a Windows host running Oracle VM VirtualBox 7.2.16 can fully take over the VirtualBox product through a flaw in its Core component, achieving high confidentiality, integrity and availability impact within the VirtualBox context (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Only Windows hosts are affected per Oracle, and the vendor characterises the issue as easily exploitable with no user interaction required. No KEV listing, EPSS score or public exploit code was present in the supplied intelligence, so no public exploit is identified at time of analysis.
Full takeover of Oracle VM VirtualBox 7.2.16 on Windows hosts is possible for a low-privileged user who already has an interactive logon on the machine, giving complete loss of confidentiality, integrity, and availability for the VirtualBox process and the guest VMs it manages. The flaw is reached locally (AV:L) with low complexity and no user interaction beyond that initial logon (PR:L, UI:N), so it is a local privilege-escalation/containment-escape class issue rather than a remote one. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied in the source data.
Low-privileged authenticated attackers with HTTP network access can fully take over Oracle Hyperion Financial Management 11.2.26.0.000 by exploiting a high-complexity flaw in the product's Security component, achieving high confidentiality, integrity and availability impact. Oracle rates the issue CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting that exploitation is difficult but complete compromise results. No public exploit code and no CISA KEV listing were observed at time of analysis, and no EPSS score was supplied, so real-world exploitation activity is unconfirmed.
Full takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an authenticated attacker holding high privileges, who can send crafted HTTP requests to the Security component and gain complete control of confidentiality, integrity, and availability. The vulnerability is rated CVSS 7.2, and no public exploit code or active exploitation has been identified at time of analysis; EPSS data is unavailable. The high-privilege requirement limits exposure to already-compromised or insider accounts, but successful exploitation yields total application compromise.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a low-privileged account and sits on the same adjacent network segment as the HFM server take full control of the application. Exploitation is rated AV:A/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact, and Oracle's January 2026 Security Alert (cspusep2026) is the authoritative advisory. No public exploit code has been identified and there is no CISA KEV listing at the time of analysis, so risk is concentrated in environments where untrusted parties can reach the HFM host's network segment.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a high-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity and availability impact across a single security scope. Successful exploitation means takeover of the HFM platform rather than a narrow data leak — the attacker gains the ability to read, alter and disrupt the financial consolidation environment. The vulnerability is remotely reachable and low-complexity once the required privileged position is obtained, though no public exploit code and no CISA KEV entry have been reported at time of analysis; the fixed release is delivered through Oracle's Critical Security Patch Update channel.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an authenticated attacker who already holds a low-privileged logon on the host running the application seize full control of the HFM instance, with high confidentiality, integrity and availability impact. Oracle rates the attack as difficult (AC:H) and the vector is strictly local (AV:L) with no user interaction, so the exposure is limited to operators of the affected server rather than the network at large. No public exploit code has been identified at time of analysis, and the only supplied reference is Oracle's Critical Security Patch Update advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a high-privileged account reach the application over HTTP and fully take over the HFM instance, with high impact to confidentiality, integrity, and availability. Exploitation is rated as easy (AC:L, no user interaction) once the privileged foothold exists, so the practical barrier is obtaining or abusing an administrative credential rather than defeating any exploit mitigation. There is no public exploit code or CISA KEV entry at time of analysis, and no EPSS score was supplied, so the real-world risk is driven by internal admin-account hygiene and network exposure of the HFM web tier.
Authenticated low-privileged attackers who can reach the SQL-facing surface of Oracle Hyperion Financial Management 11.2.26.0.000 can achieve complete takeover of the application. Oracle's advisory rates this 8.8 with full confidentiality, integrity, and availability impact, and the flaw is described as easily exploitable with no user interaction required. At the time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS score in the supplied intelligence, so this should be treated as a high-severity, patch-now issue rather than a known active campaign.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged, network-connected user take full control of the application, with high impact to confidentiality, integrity and availability. Exploitation is rated difficult (AC:H) because it depends on a narrow timing or state precondition, but once met it requires only an authenticated low-privilege session over HTTP and no user interaction. No public exploit code or CISA KEV entry was provided at time of analysis, and no CWE classification or EPSS score accompanied the vendor disclosure.
Unauthenticated attackers with network access to the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to fully compromise the application, with high impact to confidentiality, integrity and availability (CVSS 8.1). Oracle rates the flaw as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control rather than on a trivially repeatable request. No CISA KEV listing, EPSS score or public exploit code was provided in the source data, so active exploitation and weaponization are not confirmed.
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an authenticated, low-privileged attacker who reaches the application over the network via HTTP and exploits a flaw in its Security component. Oracle's advisory rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), describing it as easily exploitable with complete loss of confidentiality, integrity and availability. No EPSS score, CISA KEV entry, or public proof-of-concept was supplied in the available intelligence, so active exploitation is unconfirmed; the only vendor reference is the Oracle Critical Security Patch Update advisory.
A low-privileged attacker with network access over HTTP can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000, achieving complete loss of confidentiality, integrity, and availability of the application (CVSS 3.1 base 8.8). The defect resides in the product's Security component and requires only a valid low-privileged account, with no user interaction, making it straightforward to automate once an attacker has a foothold. There is no public exploit identified at time of analysis and no CISA KEV listing, but Oracle's Critical Security Patch Update advisory is the authoritative source for the fix.
Low-privileged authenticated attackers with HTTP network access can exploit the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 to fully take over the application, with high impact to confidentiality, integrity and availability. Oracle scores the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is low-complexity once a valid low-privilege account exists, and a fix is published through Oracle's Critical Patch Update process. No public exploit code or CISA KEV entry has been identified at the time of analysis, and no EPSS score was supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker who can log on to the host running the application take full control of the product. Successful exploitation results in complete loss of confidentiality, integrity and availability of the financial consolidation environment (CVSS 3.1 base 7.8, AV:L/PR:L). No public exploit code or CISA KEV listing was identified in the supplied intelligence, and the only reference is Oracle's Critical Security Patch Update advisory, so patch status should be confirmed against that document.
Authenticated attackers who already hold high application privileges on Oracle Hyperion Financial Management 11.2.26.0.000 can fully take over the product over the network through its HTTP interface, with the impact extending beyond HFM itself due to a scope change. Oracle scores this 9.1 (CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), so while the technical exploit path is low-complexity and requires no user interaction, the high-privilege prerequisite means this is a post-compromise or malicious-insider escalation path rather than an anonymous remote attack. No public exploit code has been identified at time of analysis.
Full compromise of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through a SQL-based attack against the product's Security component, with High confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). The critical qualifier is privilege: exploitation requires an attacker who already holds a high-privileged account and network reachability to the affected component, so this is primarily an insider, credential-compromise, or laterally-moving-attacker risk rather than an unauthenticated perimeter threat. No EPSS score, CISA KEV listing, or public exploit code was supplied; the only reference is Oracle's Critical Patch Update advisory, and no exact patched build version is stated in the available data.
Authenticated low-privileged attackers with HTTP access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in the product's Security component, gaining complete control of confidentiality, integrity and availability (CVSS 8.8). The issue is easily exploitable once a valid account exists — low complexity, no user interaction — and results in takeover of the HFM application rather than a limited data leak. No EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed and no public exploit code was identified at time of analysis.
A low-privileged attacker who can reach the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can take over the application by exploiting a flaw in its Security component. Although rated CVSS 3.1 7.5, the vulnerability is explicitly difficult to exploit (AC:H) and requires valid low-privileged credentials (PR:L), but successful exploitation yields full confidentiality, integrity and availability impact. No public exploit code or confirmed active exploitation appears in the available intelligence, and no EPSS or CISA KEV data was supplied.
A flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged attacker who can reach the service over the network take full control of the application via SQL-based manipulation. Oracle's Critical Security Patch Update rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity and availability with no user interaction. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the immediate driver is the fully-compromised-outcome severity for any internet- or partner-exposed HFM deployment, not observed attacks.
Authenticated low-privileged attackers with HTTP access to Oracle Hyperion Financial Management 11.2.26.0.000 can fully compromise the application through a flaw in its Security component, gaining complete control over confidentiality, integrity and availability of the platform. Oracle rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and describes it as 'easily exploitable', meaning a valid low-privilege account is the main barrier rather than technical complexity. No public exploit code, EPSS score, or CISA KEV listing was provided in the intelligence feed, so exploitation status is 'no public exploit identified at time of analysis' — but the low attack complexity and the sensitivity of financial consolidation data make this a priority for internet- or intranet-exposed HFM deployments.
Full takeover of Oracle Hyperion Financial Management is achievable by a low-privileged, authenticated attacker who can reach the product's Security component over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity and availability (C:H/I:H/A:H). Only version 11.2.26.0.000 is listed as affected, and the CVSS 3.1 base score of 7.5 is capped by two meaningful limiters rather than by reduced impact: AC:H, meaning the vendor itself rates the attack 'difficult' and dependent on timing, configuration or state conditions outside the attacker's full control, and PR:L, meaning a valid low-privileged account is a hard prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied, so the practical near-term risk is driven by the severity of the post-exploitation outcome rather than by observed threat activity.
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privileged (administrative or operator-level) account on the target and who can reach it over Oracle Net rather than standard HTTP. The flaw sits in the product's Security component, requires no user interaction, and carries low attack complexity once privileged access and Oracle Net connectivity exist, with a scope change (S:C) indicating that a successful compromise can extend beyond HFM to other products in the deployment. The high-privilege prerequisite (PR:H) rules out anonymous internet attackers, so realistic exploitation depends on insider access, stolen credentials, or a prior compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied.
Unauthenticated attackers positioned on a network segment adjacent to an Oracle Hyperion Financial Management server can fully compromise the application, resulting in complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8). Only version 11.2.26.0.000 is identified as affected, and Oracle's September 2026 Critical Patch Update advisory is the sole reference. No public exploit code, EPSS score, or CISA KEV listing is present in the available data, so active exploitation is not confirmed.
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 server can exploit a flaw in the Security component to achieve full takeover of the application, with potential impact on other connected products due to scope change. The vulnerability requires adjacency (AV:A) rather than internet reachability, and no authentication or user interaction is needed, making it high risk for poorly segmented environments. No public exploit code has been identified at time of analysis, and CISA KEV does not list active exploitation.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an authenticated low-privileged attacker reach the application over HTTP and escalate to full takeover of the HFM instance, with high impact to confidentiality, integrity and availability. The vulnerability is trivially automatable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), meaning any valid low-rights account becomes a stepping stone to administrative control of the financial consolidation platform. Exploitation status at time of analysis: no public exploit identified and no CISA KEV listing; no EPSS score or CWE classification was supplied with the source data.
A locally exploitable flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a high-privileged logon on the host running the application take full control of the product, with potential follow-on impact to other connected Oracle components (scope change). Exploitation additionally requires a user other than the attacker to perform some interaction, making this a privileged-operator-plus-social-engineering attack rather than a remote unauthenticated one, although successful exploitation yields complete confidentiality, integrity and availability loss on the HFM instance. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied with the intelligence feed.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a valid low-privileged logon on the host running the application take over the product, with a scope change indicating the compromise can extend to interconnected systems. Successful exploitation yields full confidentiality, integrity and availability impact — this is a takeover-class flaw, not merely an information leak. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was provided with the record.
Low-privileged attackers with HTTP network access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in its Security component, achieving high impact to confidentiality, integrity, and availability (CVSS 8.8). The vulnerability is easily exploitable with no user interaction, and successful exploitation can result in complete takeover of the HFM application and the financial consolidation data it manages. At time of analysis there is no public exploit code identified and the issue is not listed in CISA KEV, though the low attack complexity means weaponization risk is meaningful; Oracle addressed it in its April 2026 Critical Patch Update advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 can be taken over by a low-privileged attacker who can reach the application's HTTP interface, because the Security component does not properly restrict what an authenticated but unprivileged session can do. Successful exploitation yields full compromise of confidentiality, integrity and availability of the HFM application, meaning an attacker could read, alter or destroy financial consolidation data and gain administrative control of the deployment. The flaw is rated 8.8 on CVSS 3.1; no public exploit code or CISA KEV listing was present in the source data at time of analysis, so this is currently a patch-now, monitor-for-exploitation issue rather than a confirmed actively exploited one.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security-component flaw that lets a low-privileged, network-connected user take full control of the application over HTTP. Per the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), exploitation requires only a valid low-privilege account and no user interaction, but delivers complete compromise of confidentiality, integrity and availability. There is no public exploit code or CISA KEV entry in the supplied intelligence at time of analysis; the only consolidated signal is Oracle's own security alert, and separate risk scores (EPSS) were not provided.
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a valid low-privilege application account and can reach the product's HTTP interface, because the Security component does not adequately enforce privilege boundaries (assessed CVSS 3.1 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). No user interaction is required, and the scope change (S:C) means a successful compromise can significantly impact additional integrated products that trust HFM, widening the blast radius well beyond the vulnerable host itself. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so the risk is driven by the trivial exploitation path available to anyone who can obtain a low-privilege login rather than by observed active exploitation.
Authenticated low-privileged attackers with HTTP access to Oracle Contract Lifecycle Management for Public Sector (part of Oracle E-Business Suite, V16) can escalate their privileges and achieve full takeover of the Contract Lifecycle Management application, affecting confidentiality, integrity and availability of contract data (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw sits in the "ECC For Award and IDV" component, which is exposed over the web and requires only an ordinary user account rather than administrative rights. At time of analysis there is no public exploit code identified and the issue has not been added to CISA KEV, but Oracle rates it "easily exploitable," so patching on the vendor's published patch-update timeline is the priority.
Oracle Banking Branch versions 14.5.0.0.0 through 14.9.0.0.0 contain an exploitable weakness in the Reports component that lets a low-privileged, network-connected user achieve full takeover of the application, with potential knock-on impact to other connected products (scope change). Exploitation is rated 8.0 by Oracle's CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), meaning the attacker must already hold a valid low-privilege account and must persuade a second person to perform an action, which raises attack complexity despite the high impact. No public exploit code and no CISA KEV listing were present in the supplied intelligence at time of analysis.
Low-privileged attackers holding a valid Oracle E-Business Suite account can take over the Oracle Purchasing module (versions 12.2.3 through 12.2.15) by sending crafted HTTP requests to the application's web interface, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). No user interaction or elevated privilege is needed beyond a basic authenticated session, making the flaw trivially automatable once credentials exist. At time of analysis there is no public exploit code identified and the issue is not listed in CISA KEV; no EPSS score was supplied in the source data. Oracle has published a Critical Security Patch Update advisory (September 2026) covering the affected releases.
Any low-privileged, authenticated user with HTTP access to the Oracle Contract Lifecycle Management for Public Sector module (Award/PO component) of Oracle E-Business Suite 12.2.13 through 12.2.15 can fully take over the application, with high impact to confidentiality, integrity and availability. The flaw is trivially reachable over the network with no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), meaning a compromised or malicious internal account is enough to reach contract and award data and to manipulate application state. At time of analysis there is no public exploit identified and no CISA KEV listing, so the immediate risk is driven by the large installed base of EBS and the low skill barrier implied by the vector; Oracle has published a Critical Security Patch Update advisory covering the fix.
Full takeover of Oracle Product Hub within Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker who can reach the module's HTTP interface, with CVSS 8.8 reflecting high confidentiality, integrity, and availability impact across the whole affected application. Exploitation requires only a valid low-privileged EBS session and network access to HTTP — no user interaction and no administrative privileges. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's Critical Security Patch Update at oracle.com/security-alerts/cspusep2026.html is the only patch reference provided.
Authenticated attackers holding a low-privileged Oracle E-Business Suite account can fully take over the Bills of Material module in versions 12.2.3 through 12.2.15, achieving high impact against confidentiality, integrity, and availability (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw lives in the module's Setup Workbench component and needs only HTTP reachability plus a valid low-privilege login — no victim interaction — making it a strong privilege-escalation stepping stone for anyone with a foothold in the EBS environment. Oracle documents the issue in its September 2026 Critical Security Patch Update advisory; no public exploit code, EPSS score, or CISA KEV entry accompanies this record, so active exploitation is unconfirmed and no public exploit was identified at time of analysis.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains a flaw in its Access and Security component that allows a low-privileged, authenticated user with HTTP network access to escalate privileges and take over the application, with high impact to confidentiality, integrity and availability. The vulnerability is rated 'difficult to exploit' by Oracle (AC:H), so successful abuse requires favorable conditions rather than a single trivial request, but the payoff is full compromise of the DRM instance. No public exploit code or CISA KEV listing has been identified at time of analysis, and Oracle has published a fix in its Critical Patch Update advisory.
Privilege escalation and full application takeover in Oracle Hyperion Data Relationship Management 11.2.26.0.000, where a low-privileged attacker with network access over HTTP can compromise the Access and Security component, resulting in complete loss of confidentiality, integrity, and availability of the product (CVSS 3.1 base 7.5). Exploitation is assessed as difficult (AC:H), consistent with a security-logic or state/timing-dependent flaw rather than a simple injection, and no public exploit code or CISA KEV entry was identified at time of analysis. The practical risk concentrates in large finance and EPM environments where DRM holds authoritative master-data hierarchies and is reachable by ordinary business users.
Oracle Banking Origination versions 14.5.0.0.0 through 14.9.0.0.0 contain a high-complexity flaw in the Onboarding Batch Processes component that lets a low-privileged, authenticated attacker reach the application over HTTP and achieve full takeover (high confidentiality, integrity and availability impact, CVSS 3.1 base 7.5). The attack vector is network-based but the vendor rates exploitation as difficult (AC:H), implying a race condition, state dependency or timing condition must be satisfied rather than a straightforward request. No public exploit code or CISA KEV listing was present in the supplied intelligence at time of analysis, so the immediate risk is driven by the severity of impact in banking environments rather than confirmed active exploitation; EPSS data was not provided.
Oracle Advanced Benefits, a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be fully taken over by a high-privileged attacker who reaches the Self-Service What-if Analysis component over HTTP. The vendor-assigned CVSS 3.1 score is 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting a hard-to-exploit but high-impact flaw that can also affect additional products beyond the vulnerable component (scope change). No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS probability was supplied with the source data.
A high-privileged attacker with network access to the Oracle Contracts module of Oracle E-Business Suite 12.2.14 or 12.2.15 can fully compromise that module, affecting confidentiality, integrity, and availability. The flaw sits in the Internal Operations component and requires an already-elevated application account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 7.2) - it is not reachable by unauthenticated or low-privileged users, and no user interaction is needed once the prerequisite access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical risk is therefore concentrated in environments where many users or service accounts already hold broad Contracts privileges.
Oracle Contracts, a module within Oracle E-Business Suite, can be fully taken over by a high-privileged attacker who can reach the application over HTTP in versions 12.2.14 and 12.2.15. Oracle's own advisory rates this 7.2 with complete confidentiality, integrity, and availability impact, and notes it is 'easily exploitable' once the attacker holds elevated privileges. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-priority issue rather than an observed campaign.
Oracle Contracts, a module within Oracle E-Business Suite 12.2.14-12.2.15, allows a low-privileged authenticated attacker with HTTP network access to take over the Contracts component, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw requires any valid low-privilege account but no user interaction or elevated rights, and it works against default configurations of the affected versions, so the primary limiting factor is obtaining an authenticated foothold on the EBS instance. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the combination of low privileges, network reach, and full component takeover places it in a high-priority tier rather than the pre-authentication maximum tier.
Unauthenticated attackers with network reach to the Mobile Application Server of Oracle E-Business Suite can fully take over the MWA Terminal Server component in supported 12.2.3 through 12.2.15 releases, gaining high impact across confidentiality, integrity and availability. Exploitation is rated high-complexity (AC:H) but requires no credentials and no user interaction, and Oracle scores it 8.1. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so the current real-world exploitation picture is unconfirmed.
Oracle E-Business Suite's Mobile Application Server (MWA Terminal Server component) in versions 12.2.3 through 12.2.15 can be fully taken over by an unauthenticated attacker who can reach the host over an adjacent network segment. The flaw is rated 7.5 with a CVSS vector of AV:A/AC:H/PR:N/UI:N and high confidentiality, integrity and availability impact, meaning an attacker positioned on the same physical communication segment as the Mobile Application Server hardware can compromise the service without credentials, though exploitation is complicated by conditions beyond the attacker's control (AC:H). Oracle has published the fix through its Critical Security Patch Update advisory; at the time of analysis there is no CISA KEV listing, no confirmed public exploit code and no EPSS score provided.
Component takeover in Oracle E-Business Suite's Demand Signal Repository (supported releases 12.2.3 through 12.2.15) lets an authenticated, low-privileged attacker reachable over HTTP (PR:L, network vector) seize control of the affected module, with full confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). The flaw sits in the Internal Operations component of the Demand Signal Repository and requires no user interaction, making it straightforward to trigger once a valid low-privilege session or role is obtained. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the Oracle Critical Security Patch Update advisory is the only authoritative reference and no EPSS score was supplied, so real-world exploitation likelihood is unquantified. Oracle E-Business Suite operators running the affected module should treat the corresponding Critical Patch Update as the remediation path.
Application takeover of the Document Management and Collaboration module in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by any authenticated low-privileged user with HTTP access, with high confidentiality, integrity and availability impact. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) because the attack is simple, needs no user interaction, and defeats the authorization boundary around the module's internal operations. No public exploit code or CISA KEV entry is identified at time of analysis, but the low privilege bar combined with broad enterprise EBS deployment makes this a patch-now item.
Oracle Document Management and Collaboration, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP. Successful exploitation grants complete control over the module's confidentiality, integrity, and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker can read, alter, or destroy managed documents and related business data. There is no CISA KEV listing, no public exploit code, and no EPSS data in the provided intelligence, so this is currently a patch-priority issue for Oracle E-Business Suite shops rather than a confirmed actively exploited threat.
Authenticated takeover of Oracle Product Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker reaching the application over HTTP, with the vendor scoring it 8.5 for high confidentiality, integrity and availability impact plus a scope change that extends damage onto other EBS products. Exploitation is rated difficult (AC:H) because the attacker must satisfy specific conditions inside the Internal Operations component, and no public exploit code or CISA KEV entry has been identified at time of analysis. No EPSS score was supplied, so real-world exploitation likelihood is not independently quantified and the flaw should be treated as a patch-cycle priority rather than a confirmed emergency.
High-privileged users who can already authenticate to Oracle E-Business Suite can trigger a hard-to-reach flaw in the Bills of Material Setup Workbench component of versions 12.2.3 through 12.2.15 and take full control of that module, with the potential to pivot into other connected EBS products because of the scope change. Oracle rates the issue CVSS 3.1 base 8.0 with high confidentiality, integrity and availability impact, but exploitation is described as difficult and requires an authenticated, privileged position plus network access over HTTP. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and the only reference available is Oracle's Critical Security Patch Update advisory.
Low-privileged attackers with HTTPS network access can fully compromise the Internal Operations component of Oracle Complex Maintenance, Repair and Overhaul (CMRO) in Oracle E-Business Suite versions 12.2.3 through 12.2.15, achieving complete confidentiality, integrity, and availability impact on the affected module. The flaw carries a CVSS 3.1 base score of 8.8 and requires only an authenticated network session (PR:L) with no user interaction, making it a straightforward lateral escalation for any user holding a valid low-privilege EBS account. At time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS data provided, so risk is driven by the exposed attack surface of internet- or intranet-reachable EBS deployments rather than confirmed active exploitation.
Oracle Product Hub, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged attacker with HTTP network access take over the Product Hub application. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields high confidentiality, integrity and availability impact across the module. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, though Oracle treats this class of flaw as remotely exploitable and easily abused, making prompt patching of internet- or intranet-exposed E-Business Suite deployments important.
Oracle Product Hub, the product master-data module of Oracle E-Business Suite, fails to properly enforce authorization in its Internal Operations component across supported releases 12.2.3 through 12.2.15, allowing an attacker who already holds a high-privileged account to achieve full takeover of the module over HTTP. Successful exploitation yields complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning master data, configuration and administrative functions can be read and altered. Oracle did not publish a CWE identifier with this record, no public exploit code has been identified at time of analysis, and neither CISA KEV nor EPSS data was supplied, so active exploitation cannot be confirmed.
Takeover of Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a highly privileged authenticated attacker with network HTTP access to the Internal Operations component, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). The flaw is rated easily exploitable (AC:L, UI:N) once the required credentials are held, and no public exploit has been identified at time of analysis. Because the CVSS vector specifies PR:H, anonymous or low-privileged internet attackers are ruled out, leaving the mandatory high-privilege account as the primary gating factor.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Fusion Middleware Security Framework component that lets a low-privileged attacker who can reach the IDE over HTTP achieve a full takeover of the product, with high confidentiality, integrity, and availability impact. Oracle rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation needs a valid low-privilege account but no user interaction or elevated privilege. There is no public exploit code identified and no CISA KEV listing at time of analysis, and no EPSS score was supplied, so the immediate operational risk is driven mainly by exposure of JDeveloper HTTP services rather than by observed exploitation.
Local low-privileged users who can log on to hosts running Oracle PeopleSoft Enterprise FIN Engineering Brazil 9.1 can fully take over the affected Engineering component, with high impact to confidentiality, integrity and availability. Oracle's advisory assigns a base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the flaw is trivially exploitable once any valid low-privilege logon on the infrastructure is obtained - no user interaction and no elevated privileges are required. There is no public exploit code or CISA KEV listing identified at time of analysis, so the immediate risk is concentrated in environments where untrusted or over-privileged users share the PeopleSoft application or database host.
Oracle Coherence (Core component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 can be fully taken over by a low-privileged attacker who can reach the HTTP interface, per Oracle's Critical Security Patch Update. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N, C/I/A all High) confirms a network-reachable but difficult-to-exploit flaw that yields complete compromise of the data grid rather than a limited data leak. No CISA KEV listing, public exploit code, or EPSS score is present in the supplied intelligence, so no public exploit identified at time of analysis and active exploitation is unconfirmed.
Full compromise of Oracle Coherence is achievable by low-privileged attackers who can reach the Coherence Core HTTP interface, affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 of the Oracle Fusion Middleware product. Successful exploitation gives complete loss of confidentiality, integrity and availability — Oracle describes the outcome as "takeover of Oracle Coherence" — with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was supplied with the source data, so the practical urgency currently rests on the size of the exposed Coherence estate rather than on observed exploitation.
Oracle Coherence, Oracle's in-memory data grid shipped as part of Fusion Middleware, can be fully taken over by a low-privileged attacker who can reach the cluster over the network in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The flaw sits in the Core component and is rated by Oracle as easily exploitable — CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — with confidentiality, integrity and availability all fully impacted, meaning compromise of the Coherence cluster rather than a narrow data leak. No EPSS score, CISA KEV entry or public exploit code was provided with this record; the only authoritative source is Oracle's Critical Security Patch Update advisory, so treat exploitation status as unconfirmed (no public exploit identified at time of analysis).
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 can be taken over by a low-privileged local attacker with logon access to the host infrastructure, allowing complete compromise of the Content Server component's confidentiality, integrity, and availability. The flaw is easily exploitable given local access and a valid account, but no public exploit or active exploitation has been identified at time of analysis. This is a locally-scoped critical-impact issue, not a remote-drive-by vulnerability.
Unauthenticated database takeover is possible in Oracle Database Server RDBMS releases 23.4.0 through 23.26.3 via crafted traffic sent to the Oracle Net listener. Per the Oracle-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), an attacker with network reachability can fully compromise confidentiality, integrity and availability of the RDBMS without credentials or user interaction, though Oracle characterizes the flaw as 'difficult to exploit' (AC:H). There is no public exploit code and no CISA KEV listing at time of analysis, so this is a patch-now enterprise hygiene issue rather than a confirmed active campaign.
Oracle Database Server's RDBMS engine can be fully compromised by any database account holding the CREATE DATABASE LINK privilege, affecting releases 19.3–19.32, 21.3–21.23 and 23.4.0–23.26.3. The flaw is reachable over Oracle Net with no user interaction and yields complete confidentiality, integrity and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N), i.e. full takeover of the RDBMS rather than a narrow data leak. Oracle has published a fix through its security advisory referenced by NVD; no public exploit code, EPSS score or CISA KEV entry was supplied, so there is no evidence of active exploitation at time of analysis.
Takeover of the Oracle Identity Manager Connector (component: Database Application Table) in Oracle Fusion Middleware is possible for a high-privileged attacker who can reach the affected HTTP interface, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Oracle rates the flaw 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker who already holds elevated privileges can fully compromise confidentiality, integrity and availability of the connector with no user interaction and low attack complexity. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV), though it was published within Oracle's scheduled Critical Patch Update cycle.
Local privilege escalation in Oracle Utilities Network Management System (NMS) allows any attacker holding a low-privileged logon on the host where the product executes to take over the affected application, with full loss of confidentiality, integrity and availability. The flaw spans the entire supported release line, from 2.4.0.1.0 through 2.4.0.1.33, 2.5.0.1.0-2.5.0.1.19, 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3, so virtually every deployed version is affected until the Vendor-released patch per the Oracle Critical Security Patch Update is applied. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and absence of user interaction make the flaw attractive once an attacker already has a foothold on the utility server.
Oracle Identity Manager (OIM) releases 12.2.1.4.0 and 14.1.2.1.0, shipped as part of Oracle Fusion Middleware, contain a flaw in the Security component that lets an attacker holding a low-privileged account reach the application over HTTP and take full control of the identity platform. Oracle rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting complete loss of confidentiality, integrity and availability with no user interaction required. No public exploit code or CISA KEV entry was available at time of analysis, so exploitation is assessed as plausible but not yet observed in the wild.
Authenticated, low-privileged network attackers can achieve full takeover of Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 through the Oracle Diagnostics Interfaces component, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is network-reachable over HTTP, requires only a low-privileged account and no user interaction, and is not pre-authentication, so exposure is greatest where many low-trust users can authenticate or where the EBS instance is internet-accessible. No public exploit code has been identified at time of analysis and EPSS is 0.45% (38th percentile); Oracle addresses the flaw in its September 2026 Critical Patch Update.
A locally exploitable privilege-escalation vulnerability in the Remote Diagnostic Agent component of Oracle Middleware Common Libraries and Tools (Oracle Fusion Middleware) allows any low-privileged user with a logon on the host to fully compromise the affected middleware installation. Successful exploitation results in complete loss of confidentiality, integrity, and availability — effectively a full takeover — across versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit code has been identified and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant or shared-host deployments where untrusted users already have accounts.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (Analytics Server component) lets any low-privileged user who can log on to the host where the service runs take full control of the BI platform. Both supported branches - 8.2.0.0.0 and 26.01.0.0.0.0 - are affected, with a CVSS 3.1 base score of 7.8 reflecting complete loss of confidentiality, integrity and availability. Oracle addressed it in its Critical Patch Update (cspusep2026); no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated low-privileged users can fully compromise Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 26.01.0.0.0 by sending crafted HTTP requests to the Analytics Server component, obtaining complete control over confidentiality, integrity, and availability of the platform. Oracle rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the only real prerequisite is a valid low-privilege account and network reachability to the HTTP interface. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so the immediate risk is driven by the severity of a successful takeover rather than confirmed in-the-wild activity.
Authenticated low-privileged users can fully compromise the Oracle Applications Framework (Personalization) component of Oracle E-Business Suite 12.2.9 through 12.2.15 by sending crafted HTTP requests, achieving complete loss of confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Oracle rates the flaw as easily exploitable with no user interaction, and the impact is described as full takeover of the Applications Framework rather than simple data exposure. No public exploit code or CISA KEV listing was identified at time of analysis, and remediation is available through Oracle's Critical Security Patch Update (cspusep2026).
Oracle E-Business Suite 12.2.9 through 12.2.15 contain a flaw in the Personalization component of the Oracle Applications Framework that lets a low-privileged user with HTTP network access take full control of the framework, with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). Exploitation is rated 'easily exploitable' by the vendor because it requires no user interaction and no special complexity — only a valid low-privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation status is currently unconfirmed. The vendor has published an out-of-band Critical Security Patch Update covering this issue; organizations running affected EBS releases should treat patching as urgent because the pre-authentication barrier is only a low-privilege login.
Authenticated high-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can fully take over the Oracle Applications Framework Personalization component, with high impact to confidentiality, integrity and availability. The flaw scores 7.2 on CVSS 3.1 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and low attack complexity once an attacker already holds a privileged EBS account. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so the practical risk is dominated by the credential-privilege precondition rather than by mass exploitation.
High-privileged users of Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) can exploit a flaw in the Platform Security component over HTTP to take complete control of the BI platform. The vendor rates this CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a highly privileged account but needs no user interaction and faces low attack complexity, with full confidentiality, integrity and availability impact. No public exploit code or CISA KEV entry is identified in the available data, and EPSS scoring was not supplied, so real-world exploitation activity is unconfirmed at time of analysis.
A hard-to-exploit local vulnerability in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 (Oracle Analytics, Platform Security component) lets a low-privileged user who can already log on to the host running the platform take full control of the BI service, with knock-on impact to connected products because the vulnerable component operates with changed scope. The attacker must additionally induce a separate legitimate user to perform an action (UI:R) and clear a high attack-complexity bar (AC:H), so exploitation is neither trivial nor remote. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; Oracle shipped the fix in its Critical Security Patch Update advisory (cspusep2026).
Attackers who already hold an elevated account on Oracle Business Intelligence Enterprise Edition can fully take over the platform by sending crafted HTTP requests to its Platform Security component, impacting confidentiality, integrity and availability of the whole deployment. Supported versions 8.2.0.0.0 and 26.01.0.0.0 are affected, and Oracle delivered the fix through its out-of-band critical security patch update. No public exploit code or CISA KEV entry has been identified at time of analysis, so the practical risk is driven by the high-privilege prerequisite rather than by active exploitation.
A difficult-to-exploit flaw in the Administration component of Oracle BI Publisher lets a low-privileged, authenticated attacker who can reach the server over HTTP take complete control of the platform, with high confidentiality, integrity and availability impact. Affected releases are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, as listed in Oracle's Critical Security Patch Update (cspusep2026). There is no CISA KEV listing, no referenced public exploit code and no EPSS score in the supplied data, so this reads as a patch-on-cadence item rather than an emergency — though the outcome is full platform takeover.
Local privilege escalation in the Installation component of Oracle Business Intelligence Enterprise Edition lets any low-privileged user who can log on to the host running the product take full control of the BI platform, affecting versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. With complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8), the flaw is attractive as a post-compromise escalation step, but it is not network-reachable and requires an existing OS-level account on the infrastructure. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and no EPSS data was supplied to gauge mass-exploitation likelihood.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 allows an attacker who already holds a low-privileged logon on the host running the platform to take full control of the BI EE deployment, with high confidentiality, integrity and availability impact across the Platform Security component. Oracle rates the flaw 7.0 (AV:L/AC:H/PR:L/UI:N), reflecting that exploitation is difficult and confined to the local host rather than reachable over the network. No public exploit code or evidence of active exploitation was identified in the supplied intelligence at time of analysis.
Oracle BI Publisher in Oracle Analytics (versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0) contains a flaw in the BI Platform Security component reachable over SOAP that allows a low-privileged, authenticated attacker with network access to fully take over the affected BI Publisher instance, with high confidentiality, integrity and availability impact (CVSS 8.8). Oracle characterizes the issue as easily exploitable, and the reference is the Oracle Critical Security Patch Update cspusep2026 advisory. No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis, and no EPSS score was provided.
An authenticated remote attacker with low privileges can fully take over Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 by sending crafted HTTP requests to the Resource Catalog Services component, which is part of Oracle Fusion Middleware. The flaw is rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning successful exploitation yields complete loss of confidentiality, integrity and availability of the affected JDeveloper instance. No CWE, EPSS score, KEV entry or public proof-of-concept was supplied in the source data, so active exploitation is not confirmed, but the low attack complexity and lack of user interaction make rapid patching advisable once the Oracle CPU fix is applied.
Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 contains an easily exploitable flaw in the Service Administration UI component that allows a low-privileged attacker with network access over HTTP to fully take over the platform, with high confidentiality, integrity, and availability impact (CVSS 8.8). Because exploitation only requires a valid low-privileged account rather than an administrator, any provisioned BI user could potentially escalate to full control of the BI deployment. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS data supplied; Oracle has published a Critical Security Patch Update advisory covering the issue.
Unauthenticated attackers with network reachability to the Analytics Web component of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can exploit a hard-to-trigger flaw to fully compromise the platform, achieving high confidentiality, integrity and availability impact consistent with a complete takeover. Oracle rates this CVSS 3.1 base 8.1 with attack complexity High, meaning exploitation depends on conditions outside the attacker's direct control rather than simply sending a request. No public exploit code has been identified and the issue is not listed in CISA KEV, so measured risk is driven by exposure of the Analytics Web HTTP interface rather than by observed in-the-wild activity.