Privilege Escalation
Monthly
Oracle BI Publisher 12.2.1.4.0 can be fully taken over by an attacker who already holds a high-privileged account and can reach the product's HTTP interface, with complete loss of confidentiality, integrity and availability (CVSS 3.1 base 7.2). The defect resides in the BI Platform Security component of Oracle Analytics and is rated low-complexity with no user interaction required, so a single crafted request from a privileged session is sufficient. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied with the source data.
Low-privileged users with HTTP access to Oracle Business Intelligence Enterprise Edition can exploit a hard-to-trigger flaw in the BI Search component to gain full control of the platform, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected supported versions are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. At the time of analysis there is no CISA KEV entry and no public exploit identified; the 7.5 score reflects the vendor's own assessment and exploitation is gated by a high attack-complexity condition.
Oracle Business Intelligence Enterprise Edition (Analytics) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 contain a hard-to-exploit but high-impact flaw in the Presentation Services component that a low-privileged, network-positioned attacker can reach over SOAP to fully take over the BI platform. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a valid low-privilege account and defeat the non-trivial attack complexity. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a patch-priority issue for exposed BI deployments rather than a confirmed active campaign.
Full takeover of Oracle Business Intelligence Enterprise Edition is achievable when an attacker who already holds logon access to the host running the platform induces a different user to perform one interaction, letting them compromise the Platform Security component and gain control over confidentiality, integrity and availability. Supported releases 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are affected; Oracle scores the issue 7.8 with a local access vector and required user interaction. No public exploit code has been identified and the flaw is not listed in CISA KEV, so practical exploitation is currently limited to parties who already have host-level access; no EPSS data was supplied with the intelligence.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 lets any user who already holds a low-privileged logon to the infrastructure hosting the BI server take full control of the platform, with complete loss of confidentiality, integrity and availability. The flaw sits in the FNDN (foundation) component and is rated 7.8 by Oracle, but it is a local vector (AV:L/PR:L) rather than a network-reachable bug, so exploitation requires prior host access as an ordinary user. No public exploit code or active exploitation is identified in the available data, and no EPSS score, KEV entry or CWE classification was supplied.
Complete takeover of Oracle Business Intelligence Enterprise Edition is achievable by a low-privileged attacker who can reach the product's HTTP interface in versions 8.2.0.0.0 and 26.01.0.0.0, through a flaw in the Platform Security component. Oracle rates it 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning confidentiality, integrity and availability of the BI platform are all fully at risk, but exploitation is difficult and requires an existing low-privileged account. At time of analysis there is no CISA KEV listing, no public exploit code, and no EPSS score in the supplied intelligence.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (Platform Security component) lets a low-privileged user who can log on to the host running the BI software take full control of the deployment. Affected releases are 8.2.0.0.0 and 26.01.0.0.0, which receive complete confidentiality, integrity and availability impact on successful exploitation. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the practical barrier is that the attacker must already hold some form of logon/execution capability on the infrastructure where OBIEE runs.
A locally exploitable privilege-escalation flaw in the Platform Security component of Oracle Business Intelligence Enterprise Edition (Oracle Analytics) lets any user who can log on to the operating-system host running the product take full control of the BI platform. Affected supported releases are 8.2.0.0.0 and 26.01.0.0.0. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), the exploit is trivial once host access exists, and no public exploit code or CISA KEV listing was identified at time of analysis, so risk is concentrated in environments where untrusted or over-privileged local accounts exist on BI servers.
Oracle Business Intelligence Enterprise Edition (BI EE, part of Oracle Analytics) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 can be fully taken over by a low-privileged attacker who already holds a valid account and can reach the product's SOAP interface over the network. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity and availability of the Analytics platform, but the vendor also classifies it as 'difficult to exploit', so successful attacks likely require significant timing, sequencing or state knowledge rather than a simple request. No CISA KEV listing, EPSS score or public exploit code was included in the reporting data, and no CWE was assigned, so the precise root-cause class remains undocumented by the vendor.
Local privilege escalation to full instance takeover in Oracle Business Intelligence Enterprise Edition (component: BI Search) affects versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. An attacker who can log on to the host running the BI EE service with only low-privileged credentials can exploit the BI Search component to gain complete control of the platform, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8). No public exploit code or CISA KEV entry is identified in the available data, so this is treated as a patch-now hardening issue rather than an observed campaign.
Unauthenticated network attackers can achieve complete takeover of Oracle Business Intelligence Enterprise Edition (Analytics) by exploiting a flaw in the Platform Security component of versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Oracle describes the flaw as 'difficult to exploit' but rates it 8.1 with full confidentiality, integrity and availability impact, so a successful attack means total loss of control over the BI platform and the analytical data it exposes. No EPSS score, KEV listing or public exploit code is present in the input, so there is no public exploit identified at time of analysis, though the unauthenticated network vector makes patching urgent for internet- or intranet-exposed deployments.
Authenticated takeover of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 is achievable through the Platform Security component by a low-privileged attacker with network HTTP access, producing high confidentiality, integrity and availability impact (CVSS 9.9, scope change). Exploitation is straightforward once any valid low-privilege credential or session is held - attack complexity is low and no user interaction is required - and the scope change means a successful compromise can extend beyond BI EE into other products integrated with the platform. No public exploit code has been identified at time of analysis, and Oracle classifies the flaw as easily exploitable in its Critical Security Patch Update advisory.
Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 contains a flaw in its Platform Security component that allows a high-privileged, authenticated attacker with HTTP network access to fully take over the BI platform, with high confidentiality, integrity and availability impact. Oracle rates it CVSS 7.2 (AV:N/AC:L/PR:H/UI:N) and the affected version is limited to 26.01.0.0.0. No public exploit code or CISA KEV entry was supplied with the available intelligence, so exploitation is not confirmed to be occurring in the wild.
Oracle Text, the full-text indexing subsystem bundled with Oracle Database Server, contains a scope-escalating flaw that lets a low-privileged database account holding the Create Index privilege take over Oracle Text when reached over Oracle Net. Affected builds are 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3; successful exploitation yields high confidentiality, integrity, and availability impact and, per Oracle's own scope-change rating, can spill over to other database components. Exploitation is rated difficult (AC:H) and no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Oracle Database Server's RDBMS component (19c 19.3–19.32, 21c 21.3–21.23, and 23ai 23.4.0–23.26.3) can be fully compromised by a low-privileged database account that holds EXECUTE on the DBMS_REDEFINITION package. An attacker reaching the database over Oracle Net can abuse that package to achieve takeover of the RDBMS, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV listing were identified in the supplied intelligence at the time of analysis; the vulnerability is addressed by Oracle's Critical Security Patch Update referenced at oracle.com/security-alerts/cspusep2026.html.
High-privileged takeover of Oracle BI Publisher is possible through the BI Platform Security component in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, where an attacker who already holds administrative access on the instance can exploit the flaw over HTTP with a Critical CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), taking over the application with full confidentiality, integrity and availability impact. Because the CVSS scope metric is changed (S:C), a successful compromise can extend beyond BI Publisher into additional integrated products rather than being contained by the BI Publisher trust boundary. Exploitation is authenticated and privilege-gated (PR:H) with no user interaction required, so realistic risk is concentrated in deployments where administrative accounts are shared, over-provisioned or reachable from untrusted networks; no public exploit identified at time of analysis.
Authenticated takeover of Oracle Product Lifecycle Analytics 3.6.1: an attacker holding a low-privileged account can reach the application over HTTP and, through a hard-to-trigger installation-related flaw in the Oracle Supply Chain component, gain full control of the service with complete confidentiality, integrity and availability impact. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), explicitly noting it is difficult to exploit, and no public exploit code or CISA KEV entry has been identified at the time of analysis. Realistic exposure is therefore concentrated in deployments where low-trust users can already authenticate to the product over the network.
Application takeover in Oracle Product Lifecycle Analytics 3.6.1 is reachable over HTTP by an attacker holding a low-privileged account, who can leverage a flaw in the installation-related component to seize full control of the application; Oracle rates it 7.5 with high confidentiality, integrity and availability impact. Exploitation is gated by high attack complexity and prior authentication, and no public exploit code or CISA KEV entry has been identified for this issue at time of analysis, leaving EPSS unquantified in the supplied data.
Takeover of Oracle Agile PLM 9.3.6 is achievable through the Event Java PX component, where an attacker with high privileges and network reachability over T3 or IIOP can fully compromise confidentiality, integrity, and availability while the scope change (S:C) allows significant impact on additional products. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), and the dominant real-world limiter is the PR:H requirement - the attacker must already hold an elevated, authenticated role, so realistic exploitation is confined to insiders or adversaries who have already compromised a privileged account. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (the CVE is not in CISA KEV).
Unauthenticated remote takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is possible through the Forge component, which an attacker reachable over HTTP can abuse to gain full control of the platform (confidentiality, integrity and availability all rated High). Oracle scores it 8.1 with a High attack complexity, meaning the attack is feasible but requires favorable timing or a specific internal state rather than a trivial one-shot request. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a patch-now risk rather than an observed campaign.
Full compromise of Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 is possible through a flaw in the Forge component that lets a low-privileged attacker with network access over HTTP take over the affected system, with high confidentiality, integrity and availability impact. Oracle rates exploitation as difficult (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5), meaning an authenticated but unprivileged foothold plus conditions outside the attacker's direct control are required. No public exploit code, EPSS score, or CISA KEV listing was provided with this record, so at time of analysis there is no public exploit identified and no confirmed active exploitation.
Unauthenticated attackers with network access to the Forge indexing component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can achieve complete takeover of the platform, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.1). Oracle rates the flaw as difficult to exploit (AC:H), so it likely requires precise protocol knowledge, timing, or a race condition rather than a simple one-shot request. No public exploit code or CISA KEV listing is present in the available intelligence, and no EPSS score was supplied, so the practical exploitation likelihood remains unquantified.
Unauthenticated network attackers can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 through the Forge component, causing complete loss of confidentiality, integrity and availability of the platform. Oracle's own rating (CVSS 8.1, AV:N/AC:H/PR:N/UI:N) concedes the flaw is 'difficult to exploit', meaning a non-trivial timing or state precondition must be satisfied before the crafted TCP traffic succeeds, which materially lowers real-world urgency versus a typical 8.1. Exploitation status at time of analysis: no public exploit identified — there is no CISA KEV listing and no POC reference in the supplied intelligence, and no EPSS score was provided to quantify likelihood.
Full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by an unauthenticated remote attacker who can reach the Forge component over TCP, with successful exploitation yielding complete confidentiality, integrity, and availability impact (C:H/I:H/A:H) per Oracle's advisory and the corroborating ENISA EUVD-2026-79606 record. Oracle explicitly characterises the flaw as 'Difficult to exploit' (CVSS AC:H), meaning a condition outside the attacker's direct control - such as a timing window, race condition, or a specific data-processing state - must be satisfied before exploitation becomes reliable, so mass opportunistic scanning is unlikely. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data; practical exposure is bounded to installations where Forge is network-reachable, which for most deployments is an internal data-pipeline interface rather than an internet-facing default service.
Local attackers who already hold a logon on the host running Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can
Local privilege escalation in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a low-privileged user who can log on to the underlying host to fully take over the platform, with the attack scope extending to additional products. Exploitation is rated difficult (high attack complexity) and requires prior local logon, so this is primarily an insider/co-tenancy and post-compromise escalation risk rather than a remotely reachable flaw. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; EPSS data was not supplied. Oracle released the fix as part of its Critical Patch Update advisory (cspusep2026.html), though the input does not state an exact patched build number.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can be fully taken over through a flaw in its Forge component. The vulnerability requires an attacker to already have a logon on the infrastructure hosting the product (local attack vector) but needs no privileges, and it only triggers when a person other than the attacker performs some interactive action, making it a local-vector, user-assisted code-execution class issue rated 7.8 by Oracle. Per the reference, the fix ships in Oracle's Critical Security Patch Update cspusep2026; no public exploit code and no CISA KEV listing were identified at time of analysis.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a vulnerability in the Forge component that lets an unauthenticated attacker reachable over HTTP take over the affected instance, with full confidentiality, integrity, and availability impact. Oracle rates the flaw 8.1 but notes it is difficult to exploit (AC:H), which suggests a race condition, timing dependency, or narrow parsing precondition rather than a straightforward request-and-execute path. No public exploit code has been identified and the issue is not listed in CISA KEV, so current exposure is driven by the value of an internet-facing commerce platform rather than by observed mass exploitation.
Unauthenticated remote attackers can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 by exploiting a difficult-to-trigger flaw in the Forge component that is reachable over HTTP. Oracle rates the issue CVSS 8.1 (AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity and availability impact) while explicitly describing it as hard to exploit. No public exploit code or CISA KEV entry has been identified, and no EPSS score was supplied with the advisory data, so active exploitation is not evidenced at time of analysis.
Unauthenticated attackers with network access can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 through a flaw in the Forge component, but only if a legitimate user is first induced to interact with attacker-supplied content delivered over HTTP. The vendor rates this CVSS 3.1 base 7.5 (AV:N/AC:H/PR:N/UI:R, C/I/A all High), reflecting high impact gated behind a difficult, interaction-dependent exploit path. No public exploit code and no CISA KEV listing were present in the supplied intelligence at time of analysis, and no EPSS score was provided, so the practical risk profile rests primarily on the vendor advisory and the internal exposure of the affected Forge endpoints.
Local privilege escalation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Endeca Application Controller component) allows an attacker who already holds a low-privileged logon on the host to fully compromise the application, affecting confidentiality, integrity, and availability. Oracle rates it 7.0 with CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attack requires local access and high complexity rather than remote reachability. No public exploit code has been identified, the CVE is not listed in CISA KEV, and no EPSS score was provided in the source data.
A local privilege-escalation flaw in the Siebel CRM Deployment component (Server Infrastructure) lets a low-privileged user who can log on to the host where Siebel CRM Deployment runs take full control of that deployment. All supported releases from 17.0 through 26.7 are affected, with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact). Oracle published the fix in its Critical Security Patch Update advisory; no public exploit code or CISA KEV entry was identified at time of analysis, so the practical threat is currently insider- or foothold-driven rather than mass-exploited.
Local privilege escalation in Oracle Siebel CRM Deployment (Server Infrastructure component) lets any low-privileged user who can log on to the host running the Deployment service take full control of that deployment. All supported releases from 17.0 through 26.7 are affected, and successful exploitation yields complete loss of confidentiality, integrity and availability of the Siebel environment (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and absence of user interaction mean any compromised service or operator account on a Siebel host is a viable stepping stone.
Application takeover in Oracle Siebel CRM's Self Service module (Helpdesk/Training component) affects versions 17.0 through 26.7 and lets a low-privileged, network-positioned attacker who holds an ordinary Self Service account fully compromise the application. Because the flaw is reachable over HTTP with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), an authenticated but unprivileged user can escalate to control over confidentiality, integrity and availability of the whole Self Service deployment. No public exploit code or active exploitation is identified at time of analysis, and neither EPSS nor CISA KEV data was supplied with this report.
A privilege-escalation flaw in the Server Infrastructure component of Oracle Siebel CRM Deployment lets an attacker who already holds a low-privileged logon on the host where Siebel Deployment runs take full control of that deployment. Affected releases span Siebel CRM 17.0 through 26.7, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact). Exploitation status is currently unconfirmed: no public exploit code and no CISA KEV listing were provided at time of analysis, and Oracle does not publish PoC details with its Critical Patch Update advisories.
Privileged compromise of the Server Infrastructure component in Oracle Siebel CRM Deployment (versions 17.0 through 26.7) allows an attacker who already holds administrative-level access to escalate into a full takeover of the Deployment environment over HTTP. Oracle scores it CVSS 3.1 9.1 with a scope change (S:C), meaning a successful attack can significantly impact additional products reachable from the affected deployment, with high confidentiality, integrity and availability impact. Because the vector requires high privileges (PR:H), this is a post-authentication escalation and lateral-movement risk rather than an anonymous remote compromise; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Full takeover of Oracle Siebel CRM Deployment is achievable by attackers who already hold high-privileged accounts and can reach the deployment server's TCP interface, affecting Siebel CRM Deployment versions 17.0 through 26.7. Oracle rates the flaw CVSS 7.2 with complete loss of confidentiality, integrity and availability, but the PR:H metric means a valid privileged account is a prerequisite, keeping this out of the unauthenticated mass-exploitation class. No public exploit code or CISA KEV entry appears in the supplied intelligence, and no EPSS score was provided.
Any authenticated low-privileged user who can reach the Oracle Depot Repair module over HTTP can fully compromise it in Oracle E-Business Suite versions 12.2.10 through 12.2.15, gaining read, modify and delete access across the module. Oracle rates the issue 8.8 with a network vector, low complexity, low privileges required and no user interaction, and has published a Critical Security Patch Update addressing it. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Low-privileged attackers who already hold a logon to the infrastructure hosting Oracle Siebel CRM's Life Sciences module (versions 17.0 through 26.7) can achieve full takeover of that module, with high confidentiality, integrity, and availability impact. Exploitation is not remote: it requires local interactive access plus a separate human user to perform some action (CVSS:3.1/AV:L/AC:L/PR:L/UI:R, base 7.3). No public exploit code or CISA KEV listing was present in the supplied intelligence, so this is assessed as a patch-now enterprise hardening issue rather than an actively exploited threat.
Oracle Siebel CRM End User (Open UI component) versions 17.0 through 26.7 can be taken over by an unauthenticated, network-positioned attacker who reaches the Open UI HTTP interface, and who manages to satisfy the high-complexity conditions of the flaw. Oracle's own CVSS 3.1 rating is 8.1 with high confidentiality, integrity and availability impact, reflecting full application compromise rather than a narrow data leak. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so the practical urgency stems from the breadth of the affected version range and the criticality of CRM data rather than from observed attacks.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.7, can be fully taken over by an unauthenticated network attacker who reaches the deployment's TCP service and successfully exploits a difficult-to-trigger flaw. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H, score 8.1) confirms no credentials or user interaction are required, but the high attack complexity means the attacker must satisfy a narrow, non-trivial condition to succeed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was supplied; Oracle published the fix in its Critical Security Patch Update advisory referenced below.
Full takeover of the Siebel CRM Deployment component (Oracle Siebel CRM Server Infrastructure, supported versions 17.0 through 26.7) is possible for a low-privileged user who can log on to the host where the deployment service runs, provided a person other than the attacker can be induced to perform an interaction. Oracle rates it 7.3 under CVSS 3.1 (AV:L/AC:L/PR:L/
A broken authorization flaw in the Proxy User Delegation component of Oracle User Management (Oracle E-Business Suite 12.2.3 through 12.2.15) lets an authenticated, low-privileged user reach the application over HTTP and fully take over the module, with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Because delegation features inherently exercise impersonation logic, a bypass here can translate directly into acting as a higher-privileged user across the suite. No CISA KEV listing, no public exploit code and no EPSS score were supplied with the input; exploitation status is therefore 'no public exploit identified at time of analysis'.
Oracle E-Business Suite's Common Applications module (CRM User Management Framework component) in supported releases 12.2.3 through 12.2.15 can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP, resulting in complete loss of confidentiality, integrity and availability of that component. Oracle rates it CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so the network attack path is simple but the privilege bar is high. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied in the input data.
An adjacent-network attacker holding a low-privileged Oracle E-Business Suite account can fully take over the Oracle One-to-One Fulfillment module (Documents component) in EBS releases 12.2.3 through 12.2.15, with high confidentiality, integrity and availability impact. Exploitation requires the attacker to sit on the physical communication segment serving the host where One-to-One Fulfillment runs, but needs no user interaction and no elevated privileges once there, making a single craftable request sufficient for complete compromise of the module. No public exploit code and no CISA KEV listing were present in the available intelligence at time of analysis, and no EPSS score was supplied to quantify real-world exploitation likelihood.
Unauthenticated attackers who can reach the One-to-One Fulfillment module of Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP can achieve complete takeover of that component, with high confidentiality, integrity, and availability impact (CVSS 8.1). Oracle characterizes the flaw as difficult to exploit (AC:H), which tempers the unauthenticated network attack vector, and the issue resides in the module's Java Server layer. No public exploit code and no CISA KEV listing were identified at time of analysis, and Oracle published the fix as part of its September 2026 Critical Security Patch Update.
Oracle Applications Manager, the web-based management console shipped with Oracle E-Business Suite 12.2.3 through 12.2.15, contains an easily exploitable flaw in its Oracle Diagnostics Interfaces component that lets a low-privileged attacker with network access over HTTPS seize control of the console. Successful exploitation yields full compromise of confidentiality, integrity and availability (CVSS 8.8) and effectively hands over the EBS management plane to the attacker. No public exploit code or CISA KEV listing was present in the available intelligence at the time of analysis, so exploitation status remains unconfirmed.
Local attackers who can log on to a host running Oracle Application Testing Suite 13.3.0.1 can achieve full takeover of the application, with high impact to confidentiality, integrity and availability. The flaw requires human interaction from someone other than the attacker and is rated high complexity, meaning a foothold on the machine plus a successful social-engineering or timing condition is needed rather than a simple remote request. There is no confirmed CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the source data, so current risk is driven by the local-access precondition and Oracle's own assessment rather than evidence of active exploitation.
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by an attacker who already controls a low-privileged account holding the 'Test Manager for Web Apps' role: a crafted HTTP request traverses a privilege boundary and grants control of the platform with high confidentiality, integrity and availability impact (CVSS 8.8). Because the vector is AV:N/AC:L/PR:L/UI:N, exploitation is network-reachable and needs no user interaction but does require valid low-privilege credentials, so credential theft or reuse is the practical entry point. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied with this record.
Local privilege escalation and full takeover in Oracle PeopleSoft Enterprise FIN Inventory Brazil 9.1, where any attacker holding a valid low-privileged logon to the host running the application can compromise confidentiality, integrity and availability of the Inventory component entirely. Because the flaw is reached via local access (AV:L, PR:L, UI:N) with low attack complexity, it is most relevant to insider threat, shared-host environments and post-compromise lateral movement on PeopleSoft infrastructure rather than to internet-facing attackers. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied.
Oracle Marketing, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), contains an easily exploitable flaw in its Audience component that lets a low-privileged attacker with HTTP network access fully compromise the application, resulting in complete loss of confidentiality, integrity, and availability. Oracle's own advisory classifies the issue as takeover-level, and because the attack requires only an authenticated low-privilege account with no user interaction, any tenant with self-service or limited marketing roles should treat it as a priority. No public exploit code or CISA KEV entry was provided in the source data, so active exploitation is not confirmed at time of analysis.
Oracle Alert, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be taken over by an attacker holding only a low-privileged account with HTTP access to the application. Because the flaw sits in the Internal Operations component and requires no user interaction, any valid low-privilege EBS user can reach it and obtain full read/write control over Alert data and functionality, with high confidentiality, integrity and availability impact (CVSS 8.8). There is currently no public exploit code or confirmed in-the-wild exploitation (no CISA KEV listing), but Oracle's out-of-band Critical Security Patch Update is the only authoritative fix, and internet-exposed EBS deployments should treat the missing authentication boundary as the primary risk.
A low-privileged, network-reachable flaw in the Internal Operations component of Oracle User Management (part of Oracle E-Business Suite 12.2.6 through 12.2.15) lets an attacker who already holds a valid low-privileged account take full control of the User Management module. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N), effectively amounting to a takeover of the user-provisioning and authorization layer of the ERP. No public exploit code and no CISA KEV listing were identified at time of analysis, so this should be treated as a patch-now, high-severity issue rather than a confirmed active campaign.
Local privilege escalation in Oracle E-Business Suite's Applications DBA (AD Utilities) lets any attacker holding a valid low-privileged logon on the tier where AD Utilities executes take complete control of the component, with full confidentiality, integrity and availability impact on the affected schemas and utilities. Only versions 12.2.3 through 12.2.15 are affected, and exploitation requires prior host access rather than reachability over the network, so the realistic threat is an insider, a compromised application-tier service account, or a post-exploitation escalation step. No public exploit code was identified and the flaw is not listed as confirmed actively exploited (CISA KEV), so risk is driven by the value of the EBS environment and who already holds a login on that infrastructure.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Applications DBA (AD Utilities) component that lets a high-privileged attacker with network access over HTTP take full control of the Applications DBA subsystem. According to Oracle's advisory language the issue is 'easily exploitable,' meaning low attack complexity once the required privileges are held, and successful exploitation delivers high confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). No public exploit code or CISA KEV entry is present in the supplied intelligence, so exploitation appears limited to attackers who already hold an Applications DBA-level account rather than remote unauthenticated adversaries.
Oracle Quality, a module of Oracle E-Business Suite, contains a difficult-to-exploit flaw in its Internal Operations component affecting versions 12.2.3 through 12.2.15, allowing a low-privileged attacker with network access via HTTP to take over the module with full confidentiality, integrity and availability impact. Oracle's own advisory rates it CVSS 7.5 with attack complexity High and privileges required Low, meaning an attacker must already hold a valid low-privilege account but can reach the vulnerable code remotely over HTTP. No public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not supplied in the intelligence feed, so real-world exploitation likelihood cannot be quantified from that signal.
Oracle Lease and Finance Management, a finance module within Oracle E-Business Suite, can be fully taken over by a high-privileged user who sends crafted HTTP requests to its Internal Operations component in versions 12.2.7 through 12.2.15. Successful exploitation yields complete loss of confidentiality, integrity and availability for the module (CVSS 3.1 base 7.2), meaning an attacker could read and alter lease, financing and contract data and disrupt related business processes. The attack is rated easy to perform once the required privileged account and network path exist, but exploitation is gated behind high privileges, and no public exploit code or CISA KEV listing was identified at the time of analysis.
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API lets an attacker who already holds a low-privilege account elevate to root and run arbitrary operating-system commands on the appliance. The flaw is remotely reachable (AV:N) but requires authentication plus a high-complexity exploitation path per the assigned CVSS vector (7.5, AC:H, PR:L). No public exploit code or CISA KEV entry was present in the supplied intelligence, so this is currently a post-authentication hardening priority rather than an actively exploited zero-day.
Low-privilege authenticated attackers can escalate to root on HPE Networking EdgeConnect SD-WAN Gateways by abusing an API endpoint, gaining the ability to run arbitrary operating-system commands. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N), meaning the attacker needs only valid low-privileged credentials and network reachability to the management API — no user interaction is required. Affected branches span EdgeConnect SD-WAN Gateways 9.4.x through 9.7.0.0; no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.
Privilege escalation in the EdgeConnect SD-WAN Gateway API lets a remote, authenticated low-privileged user gain administrative rights on the web-management interface, resulting in complete compromise of the gateway (CVSS 8.8, AV:N/PR:L). Affected branches are 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1, and 9.7.0.0. No public exploit code, EPSS score, or CISA KEV listing was provided at time of analysis; exploitation requires a valid low-privileged account and reachability of the management API.
Privilege escalation in HPE Networking EdgeConnect SD-WAN Orchestrator (builds 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0) allows an authenticated, low-privileged user of the Orchestrator API to elevate themselves to an administrative role and take full control of the SD-WAN management plane. The issue is network-reachable, low complexity, and needs no user interaction (CVSS 3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact), but it is not exploitable before authentication, so the realistic attack surface is limited to deployments that hand out Orchestrator accounts - multi-tenant, self-service, or otherwise heavily populated role models, and far less so to single-admin environments. No public exploit code has been identified at time of analysis and the issue is not listed as actively exploited (no CISA KEV entry); the vendor rates it 9.9 with a scope change, while our independent assessment agrees on the impact metrics but scores it without a scope change.
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API allows a remote, low-privileged but authenticated user to raise their permissions to administrative level, resulting in complete compromise of the management plane. Only holders of a valid low-privilege API account with network reachability to the API can trigger it (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), so the practical risk depends on how API accounts are provisioned and whether the management interface is segmented away from untrusted networks. Our assessment scores the issue as scope-unchanged (S:U) rather than the 9.9 / S:C vendor figure, which makes this a genuine high-priority issue rather than a CVSS-inflated one; no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV. Note that the affected version data names EdgeConnect SD-WAN Gateways while the description names the Orchestrator, so the exact affected component should be confirmed against the HPE advisory.
Privilege escalation in Webkul Bagisto 2.4.9 lets an authenticated backend user who holds only the settings.users.edit permission promote their own account to the Administrator role, gaining every admin-panel capability including store configuration, payment-gateway credentials and customer PII. Exploitation needs a valid low-privileged admin-panel credential but no user interaction and no non-default configuration; the admin.settings.users.update endpoint (UserController::update()) simply fails to verify who may grant a role, whether a user may change their own role, or whether the granted role's permissions are a subset of the actor's own. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.15% (5th percentile), but a successful self-promotion delivers full confidentiality, integrity and availability impact (CVSS 8.8, PR:L, no UI).
Local privilege escalation in the Android kernel's Arm SMMUv3 driver (arm-smmu-v3.c) allows an attacker holding a low-privileged local context to subvert the IOMMU's protection mechanism and reach kernel-level access on a vulnerable device. The flaw is a logic error affecting multiple functions of the driver, rated CVSS 7.8 with a local attack vector, low privileges, and no user interaction required. Google ships the fix in the September 2026 Pixel/Android security bulletin; no CISA KEV listing and no public exploit code were identified at the time of analysis.
Improper input validation in multiple locations of the Android kernel allows a locally installed application to escalate privileges on affected Pixel and Android devices, with no additional execution privileges or user interaction required. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a local attacker who already holds low-privileged code execution but can reach high-integrity kernel operations. It is addressed in the September 2026 Android/Pixel security bulletin; at time of analysis there is no CISA KEV listing, no confirmed public exploit code, and no EPSS signal was supplied with the source data.
An out-of-bounds write reachable through a race condition in google_mba_recv_msg() in google_mba_poll.c allows a locally installed low-privilege application on an affected Android device to corrupt kernel memory and escalate to system/kernel privileges. Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N), the flaw requires no user interaction but does need the attacker to already run code on the device and to win a timing window, which keeps it materially below a remote, unauthenticated severity. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; no EPSS score was supplied in the source data.
Memory corruption in the ARM64 TLB-invalidation path of the Android kernel allows a local attacker holding low privileges to win a race condition and escalate to kernel/root privileges, with no user interaction and no additional execution privileges required. Affected builds are Google Android (CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:*), specifically ARM64 devices; Google's September 2026 Pixel security bulletin is the vendor reference for the fix. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so active exploitation is unconfirmed and no public exploit code has been identified at time of analysis.
Let me build the JSON. CVE-2026-58724: Android kernel use-after-free due to race condition, local EoP requiring System execution privileges, no UI. CVSS 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Reported by Google Devices. CPE: google:android. Tags: Privilege Escalation, Google, Race Condition. Reference: Android security bulletin September 2026 Pixel. Note: "System execution privileges needed" — this is Android bulletin phrasing meaning the attacker needs System-level privileges already... Actually in Android bulletins, "System execution privileges needed" means the vulnerability requires the attacker to already have System privileges? Hmm, actually Android bulletin says "This could lead to local escalation of privilege with System execution privileges needed" — meaning the attacker needs System execution privileges? Historically it means exploitation requires the attacker to run code with System privileges already... Actually it means the vulnerability can lead to local escalation of privilege with System execution privileges needed — i.e., it requires System-level privileges to exploit. That means privilege escalation from System to... hmm, in Android, "System" is a UID (system uid 1000). So it escalates to kernel. Actually "with System execution privileges needed" means the attacker must already have System privileges. CVSS PR:L is consistent-ish. Actually PR:L. Hmm but if System privileges needed, PR:H might be more apt. Given CVSS says PR:L, I'll assess PR:L... Hmm. My own assessment: AV:L/AC:H/PR:H? Let me think. The Android phrasing "System execution privileges needed" — needed to exploit — implies significant privileges already (system UID, not just any app). That's PR:H arguably. But CVSS gives PR:L. I'll go with PR:H? Let's be careful — I should ground my assessment in the description. The description says "with System execution privileges needed" — this means the exploit requires system-level privileges. So PR:H is honest. But the vendor's own CVSS says
Permission bypass in the cellular modem firmware of Google Android/Pixel devices allows a nearby unauthenticated attacker to escalate privileges without user interaction, achieving total technical impact (C:H/I:H/A:H) via crafted radio signaling. This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, though exploitation requires radio/RF proximity to the target baseband (adjacent, not Internet-remote) and SSVC deems it non-automatable. EPSS is low at 0.11% (2nd percentile).
A race condition in the trusty_dputc() debug output path of generic-arm64-smcall.c in the Android kernel allows an out-of-bounds write that can be leveraged for local privilege escalation. The flaw is only reachable by a process already running with System execution privileges, and exploitation requires winning a timing window (AC:H, PR:L), with no user interaction. Impact is high across confidentiality, integrity and availability because the corrupted memory is kernel/secure-monitor adjacent, but no public exploit code or in-the-wild exploitation is known from the available intelligence.
An out-of-bounds read in the Android hardware VP9 decode path (Vp9DecEndOfStream in vp9hwd_output.cc) permits a locally installed app that can feed a crafted VP9 bitstream to the platform decoder to read memory beyond the intended buffer, leaking process data. Exploitation requires a local foothold (AV:L) - an app already running on the device - but no additional privileges (PR:N) and no user interaction (UI:N); the flaw is confined to devices using Google/Tensor's hardware VP9 decode implementation and is not remotely exploitable. Independent reassessment of the impact narrows this to information disclosure (C:H/I:N/A:L) rather than the vendor's code-execution framing, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is 0.11% (2nd percentile), indicating very low predicted real-world exploitation activity.
Local privilege escalation in the Pixel-specific kernel PHY power driver, specifically the gmc_phy_lp3_exit_restore_registers routine in phy_power.c, where a missing bounds check permits an out-of-bounds memory write (CWE-120). Reaching the vulnerable code path requires code already executing at Android System privilege level on an affected Pixel device, and no user interaction is needed once that context is held; per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) this is an authenticated/high-privilege local issue rather than an unprivileged-app primitive, making it most useful as a later stage in an exploit chain. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; a vendor fix is available through the September 2026 Pixel security bulletin.
Local privilege escalation in the Android kernel's FsmReleaseKey routine allows a malicious or compromised app already running on a Pixel device to bypass permission checks and gain kernel-level access, affecting confidentiality, integrity, and availability. Exploitation requires no credentials, no elevated privileges, and no user interaction (CVSS 8.4, AV:L/PR:N/UI:N), so any unpatched build predating the 2026-09-01 Pixel security patch level is exposed. No public exploit identified at time of analysis and EPSS is low at 0.12% (2nd percentile), so this is a genuine but non-urgent patching priority rather than an active threat.
Local privilege escalation in Google Android allows an unprivileged app already running on the device to trigger a heap buffer overflow in the gf_ta_test_set_config routine of gf_ta_test.c, potentially gaining elevated code execution within the affected component. The flaw carries CVSS 8.4 (AV:L/AC:L/PR:N/UI:N, C/I/A High), requires on-device execution but no elevated privileges or user interaction, and affects Android builds where the vulnerable fingerprint/trusted-application test/config code is present. EPSS is very low at 0.12% (2nd percentile), no public exploit identified at time of analysis, and the issue is fixed in the 2026-09-01 Pixel security patch level.
Privilege escalation in the Android Bootloader allows a local attacker who already holds System execution privileges to bypass an intended permission check and obtain higher-privileged code execution on affected devices. The root cause is a logic error in bootloader permission enforcement (CWE-693, protection mechanism failure) that requires no user interaction and is reachable only through local access, making it a privilege-escalation link inside a larger exploit chain rather than a standalone remote threat; the affected scope appears limited to Google Pixel devices addressed by the 2026-09-01 Pixel security bulletin. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data accompanied the available reporting.
An out-of-bounds write in the NXP NFC hardware abstraction layer (phNxpNciHal_ext_process_nfc_init_rsp in phNxpNciHal_ext.cc) lets a local attacker corrupt memory beyond the intended buffer while the HAL processes an NFC initialization response. Affected are Android devices that ship the NXP NFC HAL, which the Android CPE lists without a version bound; the flaw requires no user interaction and, per Google's bulletin wording, no additional execution privileges, so a typical app-level foothold is enough to attempt escalation. There is no CISA KEV listing and no public exploit code reported in the supplied intelligence, so exploitation is assessed as feasible but not yet observed.
Privilege escalation in the Android Setup Wizard (Google Android, fixed in the September 2026 Pixel bulletin) lets a locally-running, low-privilege app trigger a package installation because the Setup Wizard's install code path performs a missing permission check. Per the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, exploitation requires code already executing on the device under a low-privileged context, needs no user interaction and no additional execution privileges, and yields high confidentiality and integrity impact in a local attack. Despite the advisory's 'remote package install' phrasing, the CVSS vector confirms this is not a network-reachable attack, and no public exploit has been identified at time of analysis.
An out-of-bounds write in Av1DecodeFrameTag (vp9hwd_headers.cc) in the Android media decoding stack allows crafted AV1/VP9 media content to corrupt memory and potentially achieve remote code execution in the codec process, which runs with elevated system privileges relative to a normal app. Google's Pixel security bulletin dated 2026-09-01 lists the fix, and no user interaction is required, though the provided CVSS vector (PR:L) implies the attacker must already be able to route content into the decoder path. No EPSS score, CISA KEV entry, or public exploit code was supplied with this record, so active exploitation is unconfirmed.
Local privilege escalation in Google Android affects Pixel builds addressed by the 2026-09-01 Android/Pixel security bulletin, where an unprivileged app already running on the device can trigger an out-of-bounds read caused by type confusion and potentially gain elevated code execution. The issue is locally reachable with no user interaction and no prior privileges (CVSS:3.1/AV:L/AC:L/PR:N/UI:N), but an attacker must first get malicious code onto the device, so exposure is largely limited to users who sideload apps or run compromised applications. There is no CISA KEV listing and no public exploit code identified at time of analysis, and exploitation risk is low per EPSS at 0.11% (2nd percentile). The flaw was reported by Google Devices and tracked in the EU as EUVD-2026-78985.
Local privilege escalation in Google Android and Pixel builds lets an already-installed, unprivileged app leverage a type-confusion flaw in multiple system files to obtain signature data it should not be able to reach, escalating to a higher-privileged context. The attack is purely local: per the CVSS vector (AV:L/PR:N/UI:N) no credentials, elevated privileges, or user interaction are required beyond getting a malicious app running on the device, though the attacker must first sideload or distribute that app through a store listing. Exploitation is not confirmed as active, no public exploit code has been identified, and the EPSS score is very low (0.11%, 2nd percentile), making this a genuine but moderate-priority local privilege-escalation issue rather than a mass-exploitation threat; vendor patches are addressed in the 2026-09-01 Pixel security bulletin.
Local privilege escalation in the Android VPU (Video Processing Unit) component lets an attacker who already holds low-privilege code execution - such as a malicious or compromised app running on the device - bypass a missing permission check and elevate to System-level execution privileges, with no user interaction required. The flaw is assessed at CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) and was reported by Google Devices against the Pixel security bulletin, so real-world exposure centers on Pixel hardware that exposes the affected VPU subsystem rather than all devices matching the broad google:android CPE. EPSS is only 0.12% (2nd percentile) and no public exploit identified at time of analysis; impact is bounded to System privileges, not full kernel or root.
Out-of-bounds read in the Android kernel's configuration accessor get_global_config_item_addr() in gc.c allows a local attacker to read memory past the end of an allocation because the routine never validates the requested item index against the bounds of the config region. Google assigns the issue High severity (CVSS 8.4, vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting that it can be reached with no additional execution privileges and no user interaction and can be leveraged toward local escalation of privilege on the affected device. Current intelligence does not indicate active exploitation: EPSS is only 0.11% (2nd percentile), no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV; fixes shipped in the September 2026 Android/Pixel security bulletin (2026-09-01), making this a genuine but not urgent local privilege-escalation issue.
Local privilege escalation in the Android kernel allows an unprivileged app already running on a Pixel or other affected Android device to bypass a missing permission check and gain elevated privileges, resulting in full compromise of confidentiality, integrity, and availability (CVSS 8.4, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the vector is local-only and requires the attacker to already execute code on the device, the exposure is limited to post-compromise or malicious-app scenarios rather than remote attacks, and no user interaction is needed once that foothold exists. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable); EPSS is low at 0.12% (2nd percentile), and the September 2026 Android/Pixel security patch level (2026-09-01) contains the fix. Vendor-assigned severity is High, driven by the complete loss of C/I/A from a low-privilege starting point.
Use-after-free (CWE-416) in the Android kernel allows a remote attacker to escalate privileges to kernel level on affected Pixel and Android devices, with no authentication, no user interaction, and no additional execution privileges required per the CVSS vector. Google rates this 9.8 (AV:N/AC:L/PR:N/UI:N) in its September 2026 Pixel security bulletin, while independent assessment lowers the practical rating to 8.1 (AC:H) because successful exploitation must first reach the vulnerable kernel code path and then defeat Android kernel memory-corruption mitigations such as KASLR, allocator hardening, and CFI. EPSS is only 0.16% (5th percentile) and there is no CISA KEV entry and no public exploit identified at time of analysis, so exploitation is currently considered possible but not observed.
Local privilege escalation in Google Android's VPU (Video Processing Unit) driver lets an unprivileged app trigger an out-of-bounds write through a confused-deputy path, corrupting kernel memory and gaining root-level code execution on the device. Per the CVSS vector, the attacker must already hold local code execution (PR:L) but needs no user interaction, and the September 2026 Pixel/Android Security Bulletin confirms a vendor fix. No public exploit code or CISA KEV activity has been identified at time of analysis.
An out-of-bounds write in ReadTileInfo of vp9hwd_headers.cc lets a crafted VP9 bitstream corrupt memory inside Android's VP9 hardware-decoder header parser, which Google rates as remote escalation of privilege with no additional execution privileges and no user interaction required. Affected builds are those tracked under the Google Android CPE and addressed by the Android/Pixel security bulletin dated 2026-09-01. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-window issue rather than a confirmed in-the-wild campaign.
Local privilege escalation in Google Android's fingerprint TEE HAL allows an unprivileged app already running on an affected Pixel/Android device to trigger a use-after-free in fpc_tee_hal.c and gain elevated code execution. Exploitation requires local code execution as a prerequisite, no user interaction, and no additional execution privileges; it is not remotely triggerable. No public exploit code has been identified at time of analysis, and EPSS is 0.12% (2nd percentile), indicating low predicted exploitation activity despite the 8.4 CVSS score. Devices are affected if they include the Fingerprint Cards TEE HAL and have not been updated to the 2026-09-01 Android/Pixel security patch level.
Local privilege escalation in the Android kernel affecting Google/Pixel devices lets an unprivileged app already running on the device trigger a use-after-free and gain elevated privileges. The flaw stems from improper locking in a kernel code path (CWE-416), and no user interaction is required; however, an attacker must first have local code execution on the device and must win a locking race to corrupt kernel memory, which adds real-world reliability constraints. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is low at 0.11% (2nd percentile), so this is a genuine but not urgent local privilege-escalation issue confined to devices running kernel builds older than the 2026-09-01 patch level.
Local privilege escalation in the Android kernel's remap.c enable_segment path allows an unprivileged app to bypass segment permissions and gain elevated privileges on affected Pixel and Android devices (CVSS 8.4, High). Exploitation requires only an app-level foothold with no user interaction, and no public exploit code has been identified at time of analysis; EPSS is low at 0.13% (3rd percentile). Devices at a pre-2026-09-01 patch level remain at risk and are fixed by the Android Security Bulletin dated 2026-09-01.
Authentication bypass in Android's IP Multimedia Subsystem (IMS) telephony stack lets an attacker who can reach a device's IMS/SIP signaling path escalate privileges remotely, with no user interaction and no prior authentication required per the vendor vector (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is a logic error (CWE-693, Protection Mechanism Failure) affecting unpatched Android builds - the CPE entry covers all Android versions until the 2026-09-01 security patch level is applied. Exploitation in practice most plausibly requires an adjacent or carrier-network foothold, such as a compromised or malicious IMS core or a rogue base station, because the vulnerable path is the telephony signaling channel rather than an arbitrary Internet-facing service; no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low (0.20%, 10th percentile), so the high severity stems from the potential impact if reachable rather than from observed exploitation.
Oracle BI Publisher 12.2.1.4.0 can be fully taken over by an attacker who already holds a high-privileged account and can reach the product's HTTP interface, with complete loss of confidentiality, integrity and availability (CVSS 3.1 base 7.2). The defect resides in the BI Platform Security component of Oracle Analytics and is rated low-complexity with no user interaction required, so a single crafted request from a privileged session is sufficient. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied with the source data.
Low-privileged users with HTTP access to Oracle Business Intelligence Enterprise Edition can exploit a hard-to-trigger flaw in the BI Search component to gain full control of the platform, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected supported versions are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. At the time of analysis there is no CISA KEV entry and no public exploit identified; the 7.5 score reflects the vendor's own assessment and exploitation is gated by a high attack-complexity condition.
Oracle Business Intelligence Enterprise Edition (Analytics) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 contain a hard-to-exploit but high-impact flaw in the Presentation Services component that a low-privileged, network-positioned attacker can reach over SOAP to fully take over the BI platform. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a valid low-privilege account and defeat the non-trivial attack complexity. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a patch-priority issue for exposed BI deployments rather than a confirmed active campaign.
Full takeover of Oracle Business Intelligence Enterprise Edition is achievable when an attacker who already holds logon access to the host running the platform induces a different user to perform one interaction, letting them compromise the Platform Security component and gain control over confidentiality, integrity and availability. Supported releases 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are affected; Oracle scores the issue 7.8 with a local access vector and required user interaction. No public exploit code has been identified and the flaw is not listed in CISA KEV, so practical exploitation is currently limited to parties who already have host-level access; no EPSS data was supplied with the intelligence.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 lets any user who already holds a low-privileged logon to the infrastructure hosting the BI server take full control of the platform, with complete loss of confidentiality, integrity and availability. The flaw sits in the FNDN (foundation) component and is rated 7.8 by Oracle, but it is a local vector (AV:L/PR:L) rather than a network-reachable bug, so exploitation requires prior host access as an ordinary user. No public exploit code or active exploitation is identified in the available data, and no EPSS score, KEV entry or CWE classification was supplied.
Complete takeover of Oracle Business Intelligence Enterprise Edition is achievable by a low-privileged attacker who can reach the product's HTTP interface in versions 8.2.0.0.0 and 26.01.0.0.0, through a flaw in the Platform Security component. Oracle rates it 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning confidentiality, integrity and availability of the BI platform are all fully at risk, but exploitation is difficult and requires an existing low-privileged account. At time of analysis there is no CISA KEV listing, no public exploit code, and no EPSS score in the supplied intelligence.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (Platform Security component) lets a low-privileged user who can log on to the host running the BI software take full control of the deployment. Affected releases are 8.2.0.0.0 and 26.01.0.0.0, which receive complete confidentiality, integrity and availability impact on successful exploitation. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the practical barrier is that the attacker must already hold some form of logon/execution capability on the infrastructure where OBIEE runs.
A locally exploitable privilege-escalation flaw in the Platform Security component of Oracle Business Intelligence Enterprise Edition (Oracle Analytics) lets any user who can log on to the operating-system host running the product take full control of the BI platform. Affected supported releases are 8.2.0.0.0 and 26.01.0.0.0. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), the exploit is trivial once host access exists, and no public exploit code or CISA KEV listing was identified at time of analysis, so risk is concentrated in environments where untrusted or over-privileged local accounts exist on BI servers.
Oracle Business Intelligence Enterprise Edition (BI EE, part of Oracle Analytics) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 can be fully taken over by a low-privileged attacker who already holds a valid account and can reach the product's SOAP interface over the network. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity and availability of the Analytics platform, but the vendor also classifies it as 'difficult to exploit', so successful attacks likely require significant timing, sequencing or state knowledge rather than a simple request. No CISA KEV listing, EPSS score or public exploit code was included in the reporting data, and no CWE was assigned, so the precise root-cause class remains undocumented by the vendor.
Local privilege escalation to full instance takeover in Oracle Business Intelligence Enterprise Edition (component: BI Search) affects versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. An attacker who can log on to the host running the BI EE service with only low-privileged credentials can exploit the BI Search component to gain complete control of the platform, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8). No public exploit code or CISA KEV entry is identified in the available data, so this is treated as a patch-now hardening issue rather than an observed campaign.
Unauthenticated network attackers can achieve complete takeover of Oracle Business Intelligence Enterprise Edition (Analytics) by exploiting a flaw in the Platform Security component of versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Oracle describes the flaw as 'difficult to exploit' but rates it 8.1 with full confidentiality, integrity and availability impact, so a successful attack means total loss of control over the BI platform and the analytical data it exposes. No EPSS score, KEV listing or public exploit code is present in the input, so there is no public exploit identified at time of analysis, though the unauthenticated network vector makes patching urgent for internet- or intranet-exposed deployments.
Authenticated takeover of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 is achievable through the Platform Security component by a low-privileged attacker with network HTTP access, producing high confidentiality, integrity and availability impact (CVSS 9.9, scope change). Exploitation is straightforward once any valid low-privilege credential or session is held - attack complexity is low and no user interaction is required - and the scope change means a successful compromise can extend beyond BI EE into other products integrated with the platform. No public exploit code has been identified at time of analysis, and Oracle classifies the flaw as easily exploitable in its Critical Security Patch Update advisory.
Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 contains a flaw in its Platform Security component that allows a high-privileged, authenticated attacker with HTTP network access to fully take over the BI platform, with high confidentiality, integrity and availability impact. Oracle rates it CVSS 7.2 (AV:N/AC:L/PR:H/UI:N) and the affected version is limited to 26.01.0.0.0. No public exploit code or CISA KEV entry was supplied with the available intelligence, so exploitation is not confirmed to be occurring in the wild.
Oracle Text, the full-text indexing subsystem bundled with Oracle Database Server, contains a scope-escalating flaw that lets a low-privileged database account holding the Create Index privilege take over Oracle Text when reached over Oracle Net. Affected builds are 19.3 through 19.32, 21.3 through 21.23, and 23.4.0 through 23.26.3; successful exploitation yields high confidentiality, integrity, and availability impact and, per Oracle's own scope-change rating, can spill over to other database components. Exploitation is rated difficult (AC:H) and no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Oracle Database Server's RDBMS component (19c 19.3–19.32, 21c 21.3–21.23, and 23ai 23.4.0–23.26.3) can be fully compromised by a low-privileged database account that holds EXECUTE on the DBMS_REDEFINITION package. An attacker reaching the database over Oracle Net can abuse that package to achieve takeover of the RDBMS, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV listing were identified in the supplied intelligence at the time of analysis; the vulnerability is addressed by Oracle's Critical Security Patch Update referenced at oracle.com/security-alerts/cspusep2026.html.
High-privileged takeover of Oracle BI Publisher is possible through the BI Platform Security component in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, where an attacker who already holds administrative access on the instance can exploit the flaw over HTTP with a Critical CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), taking over the application with full confidentiality, integrity and availability impact. Because the CVSS scope metric is changed (S:C), a successful compromise can extend beyond BI Publisher into additional integrated products rather than being contained by the BI Publisher trust boundary. Exploitation is authenticated and privilege-gated (PR:H) with no user interaction required, so realistic risk is concentrated in deployments where administrative accounts are shared, over-provisioned or reachable from untrusted networks; no public exploit identified at time of analysis.
Authenticated takeover of Oracle Product Lifecycle Analytics 3.6.1: an attacker holding a low-privileged account can reach the application over HTTP and, through a hard-to-trigger installation-related flaw in the Oracle Supply Chain component, gain full control of the service with complete confidentiality, integrity and availability impact. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), explicitly noting it is difficult to exploit, and no public exploit code or CISA KEV entry has been identified at the time of analysis. Realistic exposure is therefore concentrated in deployments where low-trust users can already authenticate to the product over the network.
Application takeover in Oracle Product Lifecycle Analytics 3.6.1 is reachable over HTTP by an attacker holding a low-privileged account, who can leverage a flaw in the installation-related component to seize full control of the application; Oracle rates it 7.5 with high confidentiality, integrity and availability impact. Exploitation is gated by high attack complexity and prior authentication, and no public exploit code or CISA KEV entry has been identified for this issue at time of analysis, leaving EPSS unquantified in the supplied data.
Takeover of Oracle Agile PLM 9.3.6 is achievable through the Event Java PX component, where an attacker with high privileges and network reachability over T3 or IIOP can fully compromise confidentiality, integrity, and availability while the scope change (S:C) allows significant impact on additional products. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), and the dominant real-world limiter is the PR:H requirement - the attacker must already hold an elevated, authenticated role, so realistic exploitation is confined to insiders or adversaries who have already compromised a privileged account. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (the CVE is not in CISA KEV).
Unauthenticated remote takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is possible through the Forge component, which an attacker reachable over HTTP can abuse to gain full control of the platform (confidentiality, integrity and availability all rated High). Oracle scores it 8.1 with a High attack complexity, meaning the attack is feasible but requires favorable timing or a specific internal state rather than a trivial one-shot request. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a patch-now risk rather than an observed campaign.
Full compromise of Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 is possible through a flaw in the Forge component that lets a low-privileged attacker with network access over HTTP take over the affected system, with high confidentiality, integrity and availability impact. Oracle rates exploitation as difficult (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5), meaning an authenticated but unprivileged foothold plus conditions outside the attacker's direct control are required. No public exploit code, EPSS score, or CISA KEV listing was provided with this record, so at time of analysis there is no public exploit identified and no confirmed active exploitation.
Unauthenticated attackers with network access to the Forge indexing component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can achieve complete takeover of the platform, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.1). Oracle rates the flaw as difficult to exploit (AC:H), so it likely requires precise protocol knowledge, timing, or a race condition rather than a simple one-shot request. No public exploit code or CISA KEV listing is present in the available intelligence, and no EPSS score was supplied, so the practical exploitation likelihood remains unquantified.
Unauthenticated network attackers can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 through the Forge component, causing complete loss of confidentiality, integrity and availability of the platform. Oracle's own rating (CVSS 8.1, AV:N/AC:H/PR:N/UI:N) concedes the flaw is 'difficult to exploit', meaning a non-trivial timing or state precondition must be satisfied before the crafted TCP traffic succeeds, which materially lowers real-world urgency versus a typical 8.1. Exploitation status at time of analysis: no public exploit identified — there is no CISA KEV listing and no POC reference in the supplied intelligence, and no EPSS score was provided to quantify likelihood.
Full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by an unauthenticated remote attacker who can reach the Forge component over TCP, with successful exploitation yielding complete confidentiality, integrity, and availability impact (C:H/I:H/A:H) per Oracle's advisory and the corroborating ENISA EUVD-2026-79606 record. Oracle explicitly characterises the flaw as 'Difficult to exploit' (CVSS AC:H), meaning a condition outside the attacker's direct control - such as a timing window, race condition, or a specific data-processing state - must be satisfied before exploitation becomes reliable, so mass opportunistic scanning is unlikely. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data; practical exposure is bounded to installations where Forge is network-reachable, which for most deployments is an internal data-pipeline interface rather than an internet-facing default service.
Local attackers who already hold a logon on the host running Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can
Local privilege escalation in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a low-privileged user who can log on to the underlying host to fully take over the platform, with the attack scope extending to additional products. Exploitation is rated difficult (high attack complexity) and requires prior local logon, so this is primarily an insider/co-tenancy and post-compromise escalation risk rather than a remotely reachable flaw. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; EPSS data was not supplied. Oracle released the fix as part of its Critical Patch Update advisory (cspusep2026.html), though the input does not state an exact patched build number.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can be fully taken over through a flaw in its Forge component. The vulnerability requires an attacker to already have a logon on the infrastructure hosting the product (local attack vector) but needs no privileges, and it only triggers when a person other than the attacker performs some interactive action, making it a local-vector, user-assisted code-execution class issue rated 7.8 by Oracle. Per the reference, the fix ships in Oracle's Critical Security Patch Update cspusep2026; no public exploit code and no CISA KEV listing were identified at time of analysis.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a vulnerability in the Forge component that lets an unauthenticated attacker reachable over HTTP take over the affected instance, with full confidentiality, integrity, and availability impact. Oracle rates the flaw 8.1 but notes it is difficult to exploit (AC:H), which suggests a race condition, timing dependency, or narrow parsing precondition rather than a straightforward request-and-execute path. No public exploit code has been identified and the issue is not listed in CISA KEV, so current exposure is driven by the value of an internet-facing commerce platform rather than by observed mass exploitation.
Unauthenticated remote attackers can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 by exploiting a difficult-to-trigger flaw in the Forge component that is reachable over HTTP. Oracle rates the issue CVSS 8.1 (AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity and availability impact) while explicitly describing it as hard to exploit. No public exploit code or CISA KEV entry has been identified, and no EPSS score was supplied with the advisory data, so active exploitation is not evidenced at time of analysis.
Unauthenticated attackers with network access can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 through a flaw in the Forge component, but only if a legitimate user is first induced to interact with attacker-supplied content delivered over HTTP. The vendor rates this CVSS 3.1 base 7.5 (AV:N/AC:H/PR:N/UI:R, C/I/A all High), reflecting high impact gated behind a difficult, interaction-dependent exploit path. No public exploit code and no CISA KEV listing were present in the supplied intelligence at time of analysis, and no EPSS score was provided, so the practical risk profile rests primarily on the vendor advisory and the internal exposure of the affected Forge endpoints.
Local privilege escalation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Endeca Application Controller component) allows an attacker who already holds a low-privileged logon on the host to fully compromise the application, affecting confidentiality, integrity, and availability. Oracle rates it 7.0 with CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the attack requires local access and high complexity rather than remote reachability. No public exploit code has been identified, the CVE is not listed in CISA KEV, and no EPSS score was provided in the source data.
A local privilege-escalation flaw in the Siebel CRM Deployment component (Server Infrastructure) lets a low-privileged user who can log on to the host where Siebel CRM Deployment runs take full control of that deployment. All supported releases from 17.0 through 26.7 are affected, with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact). Oracle published the fix in its Critical Security Patch Update advisory; no public exploit code or CISA KEV entry was identified at time of analysis, so the practical threat is currently insider- or foothold-driven rather than mass-exploited.
Local privilege escalation in Oracle Siebel CRM Deployment (Server Infrastructure component) lets any low-privileged user who can log on to the host running the Deployment service take full control of that deployment. All supported releases from 17.0 through 26.7 are affected, and successful exploitation yields complete loss of confidentiality, integrity and availability of the Siebel environment (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and absence of user interaction mean any compromised service or operator account on a Siebel host is a viable stepping stone.
Application takeover in Oracle Siebel CRM's Self Service module (Helpdesk/Training component) affects versions 17.0 through 26.7 and lets a low-privileged, network-positioned attacker who holds an ordinary Self Service account fully compromise the application. Because the flaw is reachable over HTTP with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), an authenticated but unprivileged user can escalate to control over confidentiality, integrity and availability of the whole Self Service deployment. No public exploit code or active exploitation is identified at time of analysis, and neither EPSS nor CISA KEV data was supplied with this report.
A privilege-escalation flaw in the Server Infrastructure component of Oracle Siebel CRM Deployment lets an attacker who already holds a low-privileged logon on the host where Siebel Deployment runs take full control of that deployment. Affected releases span Siebel CRM 17.0 through 26.7, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact). Exploitation status is currently unconfirmed: no public exploit code and no CISA KEV listing were provided at time of analysis, and Oracle does not publish PoC details with its Critical Patch Update advisories.
Privileged compromise of the Server Infrastructure component in Oracle Siebel CRM Deployment (versions 17.0 through 26.7) allows an attacker who already holds administrative-level access to escalate into a full takeover of the Deployment environment over HTTP. Oracle scores it CVSS 3.1 9.1 with a scope change (S:C), meaning a successful attack can significantly impact additional products reachable from the affected deployment, with high confidentiality, integrity and availability impact. Because the vector requires high privileges (PR:H), this is a post-authentication escalation and lateral-movement risk rather than an anonymous remote compromise; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Full takeover of Oracle Siebel CRM Deployment is achievable by attackers who already hold high-privileged accounts and can reach the deployment server's TCP interface, affecting Siebel CRM Deployment versions 17.0 through 26.7. Oracle rates the flaw CVSS 7.2 with complete loss of confidentiality, integrity and availability, but the PR:H metric means a valid privileged account is a prerequisite, keeping this out of the unauthenticated mass-exploitation class. No public exploit code or CISA KEV entry appears in the supplied intelligence, and no EPSS score was provided.
Any authenticated low-privileged user who can reach the Oracle Depot Repair module over HTTP can fully compromise it in Oracle E-Business Suite versions 12.2.10 through 12.2.15, gaining read, modify and delete access across the module. Oracle rates the issue 8.8 with a network vector, low complexity, low privileges required and no user interaction, and has published a Critical Security Patch Update addressing it. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Low-privileged attackers who already hold a logon to the infrastructure hosting Oracle Siebel CRM's Life Sciences module (versions 17.0 through 26.7) can achieve full takeover of that module, with high confidentiality, integrity, and availability impact. Exploitation is not remote: it requires local interactive access plus a separate human user to perform some action (CVSS:3.1/AV:L/AC:L/PR:L/UI:R, base 7.3). No public exploit code or CISA KEV listing was present in the supplied intelligence, so this is assessed as a patch-now enterprise hardening issue rather than an actively exploited threat.
Oracle Siebel CRM End User (Open UI component) versions 17.0 through 26.7 can be taken over by an unauthenticated, network-positioned attacker who reaches the Open UI HTTP interface, and who manages to satisfy the high-complexity conditions of the flaw. Oracle's own CVSS 3.1 rating is 8.1 with high confidentiality, integrity and availability impact, reflecting full application compromise rather than a narrow data leak. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so the practical urgency stems from the breadth of the affected version range and the criticality of CRM data rather than from observed attacks.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.7, can be fully taken over by an unauthenticated network attacker who reaches the deployment's TCP service and successfully exploits a difficult-to-trigger flaw. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H, score 8.1) confirms no credentials or user interaction are required, but the high attack complexity means the attacker must satisfy a narrow, non-trivial condition to succeed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was supplied; Oracle published the fix in its Critical Security Patch Update advisory referenced below.
Full takeover of the Siebel CRM Deployment component (Oracle Siebel CRM Server Infrastructure, supported versions 17.0 through 26.7) is possible for a low-privileged user who can log on to the host where the deployment service runs, provided a person other than the attacker can be induced to perform an interaction. Oracle rates it 7.3 under CVSS 3.1 (AV:L/AC:L/PR:L/
A broken authorization flaw in the Proxy User Delegation component of Oracle User Management (Oracle E-Business Suite 12.2.3 through 12.2.15) lets an authenticated, low-privileged user reach the application over HTTP and fully take over the module, with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Because delegation features inherently exercise impersonation logic, a bypass here can translate directly into acting as a higher-privileged user across the suite. No CISA KEV listing, no public exploit code and no EPSS score were supplied with the input; exploitation status is therefore 'no public exploit identified at time of analysis'.
Oracle E-Business Suite's Common Applications module (CRM User Management Framework component) in supported releases 12.2.3 through 12.2.15 can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP, resulting in complete loss of confidentiality, integrity and availability of that component. Oracle rates it CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so the network attack path is simple but the privilege bar is high. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied in the input data.
An adjacent-network attacker holding a low-privileged Oracle E-Business Suite account can fully take over the Oracle One-to-One Fulfillment module (Documents component) in EBS releases 12.2.3 through 12.2.15, with high confidentiality, integrity and availability impact. Exploitation requires the attacker to sit on the physical communication segment serving the host where One-to-One Fulfillment runs, but needs no user interaction and no elevated privileges once there, making a single craftable request sufficient for complete compromise of the module. No public exploit code and no CISA KEV listing were present in the available intelligence at time of analysis, and no EPSS score was supplied to quantify real-world exploitation likelihood.
Unauthenticated attackers who can reach the One-to-One Fulfillment module of Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP can achieve complete takeover of that component, with high confidentiality, integrity, and availability impact (CVSS 8.1). Oracle characterizes the flaw as difficult to exploit (AC:H), which tempers the unauthenticated network attack vector, and the issue resides in the module's Java Server layer. No public exploit code and no CISA KEV listing were identified at time of analysis, and Oracle published the fix as part of its September 2026 Critical Security Patch Update.
Oracle Applications Manager, the web-based management console shipped with Oracle E-Business Suite 12.2.3 through 12.2.15, contains an easily exploitable flaw in its Oracle Diagnostics Interfaces component that lets a low-privileged attacker with network access over HTTPS seize control of the console. Successful exploitation yields full compromise of confidentiality, integrity and availability (CVSS 8.8) and effectively hands over the EBS management plane to the attacker. No public exploit code or CISA KEV listing was present in the available intelligence at the time of analysis, so exploitation status remains unconfirmed.
Local attackers who can log on to a host running Oracle Application Testing Suite 13.3.0.1 can achieve full takeover of the application, with high impact to confidentiality, integrity and availability. The flaw requires human interaction from someone other than the attacker and is rated high complexity, meaning a foothold on the machine plus a successful social-engineering or timing condition is needed rather than a simple remote request. There is no confirmed CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the source data, so current risk is driven by the local-access precondition and Oracle's own assessment rather than evidence of active exploitation.
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by an attacker who already controls a low-privileged account holding the 'Test Manager for Web Apps' role: a crafted HTTP request traverses a privilege boundary and grants control of the platform with high confidentiality, integrity and availability impact (CVSS 8.8). Because the vector is AV:N/AC:L/PR:L/UI:N, exploitation is network-reachable and needs no user interaction but does require valid low-privilege credentials, so credential theft or reuse is the practical entry point. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied with this record.
Local privilege escalation and full takeover in Oracle PeopleSoft Enterprise FIN Inventory Brazil 9.1, where any attacker holding a valid low-privileged logon to the host running the application can compromise confidentiality, integrity and availability of the Inventory component entirely. Because the flaw is reached via local access (AV:L, PR:L, UI:N) with low attack complexity, it is most relevant to insider threat, shared-host environments and post-compromise lateral movement on PeopleSoft infrastructure rather than to internet-facing attackers. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied.
Oracle Marketing, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), contains an easily exploitable flaw in its Audience component that lets a low-privileged attacker with HTTP network access fully compromise the application, resulting in complete loss of confidentiality, integrity, and availability. Oracle's own advisory classifies the issue as takeover-level, and because the attack requires only an authenticated low-privilege account with no user interaction, any tenant with self-service or limited marketing roles should treat it as a priority. No public exploit code or CISA KEV entry was provided in the source data, so active exploitation is not confirmed at time of analysis.
Oracle Alert, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be taken over by an attacker holding only a low-privileged account with HTTP access to the application. Because the flaw sits in the Internal Operations component and requires no user interaction, any valid low-privilege EBS user can reach it and obtain full read/write control over Alert data and functionality, with high confidentiality, integrity and availability impact (CVSS 8.8). There is currently no public exploit code or confirmed in-the-wild exploitation (no CISA KEV listing), but Oracle's out-of-band Critical Security Patch Update is the only authoritative fix, and internet-exposed EBS deployments should treat the missing authentication boundary as the primary risk.
A low-privileged, network-reachable flaw in the Internal Operations component of Oracle User Management (part of Oracle E-Business Suite 12.2.6 through 12.2.15) lets an attacker who already holds a valid low-privileged account take full control of the User Management module. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N), effectively amounting to a takeover of the user-provisioning and authorization layer of the ERP. No public exploit code and no CISA KEV listing were identified at time of analysis, so this should be treated as a patch-now, high-severity issue rather than a confirmed active campaign.
Local privilege escalation in Oracle E-Business Suite's Applications DBA (AD Utilities) lets any attacker holding a valid low-privileged logon on the tier where AD Utilities executes take complete control of the component, with full confidentiality, integrity and availability impact on the affected schemas and utilities. Only versions 12.2.3 through 12.2.15 are affected, and exploitation requires prior host access rather than reachability over the network, so the realistic threat is an insider, a compromised application-tier service account, or a post-exploitation escalation step. No public exploit code was identified and the flaw is not listed as confirmed actively exploited (CISA KEV), so risk is driven by the value of the EBS environment and who already holds a login on that infrastructure.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Applications DBA (AD Utilities) component that lets a high-privileged attacker with network access over HTTP take full control of the Applications DBA subsystem. According to Oracle's advisory language the issue is 'easily exploitable,' meaning low attack complexity once the required privileges are held, and successful exploitation delivers high confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). No public exploit code or CISA KEV entry is present in the supplied intelligence, so exploitation appears limited to attackers who already hold an Applications DBA-level account rather than remote unauthenticated adversaries.
Oracle Quality, a module of Oracle E-Business Suite, contains a difficult-to-exploit flaw in its Internal Operations component affecting versions 12.2.3 through 12.2.15, allowing a low-privileged attacker with network access via HTTP to take over the module with full confidentiality, integrity and availability impact. Oracle's own advisory rates it CVSS 7.5 with attack complexity High and privileges required Low, meaning an attacker must already hold a valid low-privilege account but can reach the vulnerable code remotely over HTTP. No public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not supplied in the intelligence feed, so real-world exploitation likelihood cannot be quantified from that signal.
Oracle Lease and Finance Management, a finance module within Oracle E-Business Suite, can be fully taken over by a high-privileged user who sends crafted HTTP requests to its Internal Operations component in versions 12.2.7 through 12.2.15. Successful exploitation yields complete loss of confidentiality, integrity and availability for the module (CVSS 3.1 base 7.2), meaning an attacker could read and alter lease, financing and contract data and disrupt related business processes. The attack is rated easy to perform once the required privileged account and network path exist, but exploitation is gated behind high privileges, and no public exploit code or CISA KEV listing was identified at the time of analysis.
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API lets an attacker who already holds a low-privilege account elevate to root and run arbitrary operating-system commands on the appliance. The flaw is remotely reachable (AV:N) but requires authentication plus a high-complexity exploitation path per the assigned CVSS vector (7.5, AC:H, PR:L). No public exploit code or CISA KEV entry was present in the supplied intelligence, so this is currently a post-authentication hardening priority rather than an actively exploited zero-day.
Low-privilege authenticated attackers can escalate to root on HPE Networking EdgeConnect SD-WAN Gateways by abusing an API endpoint, gaining the ability to run arbitrary operating-system commands. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N), meaning the attacker needs only valid low-privileged credentials and network reachability to the management API — no user interaction is required. Affected branches span EdgeConnect SD-WAN Gateways 9.4.x through 9.7.0.0; no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.
Privilege escalation in the EdgeConnect SD-WAN Gateway API lets a remote, authenticated low-privileged user gain administrative rights on the web-management interface, resulting in complete compromise of the gateway (CVSS 8.8, AV:N/PR:L). Affected branches are 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1, and 9.7.0.0. No public exploit code, EPSS score, or CISA KEV listing was provided at time of analysis; exploitation requires a valid low-privileged account and reachability of the management API.
Privilege escalation in HPE Networking EdgeConnect SD-WAN Orchestrator (builds 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0) allows an authenticated, low-privileged user of the Orchestrator API to elevate themselves to an administrative role and take full control of the SD-WAN management plane. The issue is network-reachable, low complexity, and needs no user interaction (CVSS 3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact), but it is not exploitable before authentication, so the realistic attack surface is limited to deployments that hand out Orchestrator accounts - multi-tenant, self-service, or otherwise heavily populated role models, and far less so to single-admin environments. No public exploit code has been identified at time of analysis and the issue is not listed as actively exploited (no CISA KEV entry); the vendor rates it 9.9 with a scope change, while our independent assessment agrees on the impact metrics but scores it without a scope change.
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API allows a remote, low-privileged but authenticated user to raise their permissions to administrative level, resulting in complete compromise of the management plane. Only holders of a valid low-privilege API account with network reachability to the API can trigger it (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), so the practical risk depends on how API accounts are provisioned and whether the management interface is segmented away from untrusted networks. Our assessment scores the issue as scope-unchanged (S:U) rather than the 9.9 / S:C vendor figure, which makes this a genuine high-priority issue rather than a CVSS-inflated one; no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV. Note that the affected version data names EdgeConnect SD-WAN Gateways while the description names the Orchestrator, so the exact affected component should be confirmed against the HPE advisory.
Privilege escalation in Webkul Bagisto 2.4.9 lets an authenticated backend user who holds only the settings.users.edit permission promote their own account to the Administrator role, gaining every admin-panel capability including store configuration, payment-gateway credentials and customer PII. Exploitation needs a valid low-privileged admin-panel credential but no user interaction and no non-default configuration; the admin.settings.users.update endpoint (UserController::update()) simply fails to verify who may grant a role, whether a user may change their own role, or whether the granted role's permissions are a subset of the actor's own. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.15% (5th percentile), but a successful self-promotion delivers full confidentiality, integrity and availability impact (CVSS 8.8, PR:L, no UI).
Local privilege escalation in the Android kernel's Arm SMMUv3 driver (arm-smmu-v3.c) allows an attacker holding a low-privileged local context to subvert the IOMMU's protection mechanism and reach kernel-level access on a vulnerable device. The flaw is a logic error affecting multiple functions of the driver, rated CVSS 7.8 with a local attack vector, low privileges, and no user interaction required. Google ships the fix in the September 2026 Pixel/Android security bulletin; no CISA KEV listing and no public exploit code were identified at the time of analysis.
Improper input validation in multiple locations of the Android kernel allows a locally installed application to escalate privileges on affected Pixel and Android devices, with no additional execution privileges or user interaction required. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a local attacker who already holds low-privileged code execution but can reach high-integrity kernel operations. It is addressed in the September 2026 Android/Pixel security bulletin; at time of analysis there is no CISA KEV listing, no confirmed public exploit code, and no EPSS signal was supplied with the source data.
An out-of-bounds write reachable through a race condition in google_mba_recv_msg() in google_mba_poll.c allows a locally installed low-privilege application on an affected Android device to corrupt kernel memory and escalate to system/kernel privileges. Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N), the flaw requires no user interaction but does need the attacker to already run code on the device and to win a timing window, which keeps it materially below a remote, unauthenticated severity. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; no EPSS score was supplied in the source data.
Memory corruption in the ARM64 TLB-invalidation path of the Android kernel allows a local attacker holding low privileges to win a race condition and escalate to kernel/root privileges, with no user interaction and no additional execution privileges required. Affected builds are Google Android (CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:*), specifically ARM64 devices; Google's September 2026 Pixel security bulletin is the vendor reference for the fix. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so active exploitation is unconfirmed and no public exploit code has been identified at time of analysis.
Let me build the JSON. CVE-2026-58724: Android kernel use-after-free due to race condition, local EoP requiring System execution privileges, no UI. CVSS 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Reported by Google Devices. CPE: google:android. Tags: Privilege Escalation, Google, Race Condition. Reference: Android security bulletin September 2026 Pixel. Note: "System execution privileges needed" — this is Android bulletin phrasing meaning the attacker needs System-level privileges already... Actually in Android bulletins, "System execution privileges needed" means the vulnerability requires the attacker to already have System privileges? Hmm, actually Android bulletin says "This could lead to local escalation of privilege with System execution privileges needed" — meaning the attacker needs System execution privileges? Historically it means exploitation requires the attacker to run code with System privileges already... Actually it means the vulnerability can lead to local escalation of privilege with System execution privileges needed — i.e., it requires System-level privileges to exploit. That means privilege escalation from System to... hmm, in Android, "System" is a UID (system uid 1000). So it escalates to kernel. Actually "with System execution privileges needed" means the attacker must already have System privileges. CVSS PR:L is consistent-ish. Actually PR:L. Hmm but if System privileges needed, PR:H might be more apt. Given CVSS says PR:L, I'll assess PR:L... Hmm. My own assessment: AV:L/AC:H/PR:H? Let me think. The Android phrasing "System execution privileges needed" — needed to exploit — implies significant privileges already (system UID, not just any app). That's PR:H arguably. But CVSS gives PR:L. I'll go with PR:H? Let's be careful — I should ground my assessment in the description. The description says "with System execution privileges needed" — this means the exploit requires system-level privileges. So PR:H is honest. But the vendor's own CVSS says
Permission bypass in the cellular modem firmware of Google Android/Pixel devices allows a nearby unauthenticated attacker to escalate privileges without user interaction, achieving total technical impact (C:H/I:H/A:H) via crafted radio signaling. This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, though exploitation requires radio/RF proximity to the target baseband (adjacent, not Internet-remote) and SSVC deems it non-automatable. EPSS is low at 0.11% (2nd percentile).
A race condition in the trusty_dputc() debug output path of generic-arm64-smcall.c in the Android kernel allows an out-of-bounds write that can be leveraged for local privilege escalation. The flaw is only reachable by a process already running with System execution privileges, and exploitation requires winning a timing window (AC:H, PR:L), with no user interaction. Impact is high across confidentiality, integrity and availability because the corrupted memory is kernel/secure-monitor adjacent, but no public exploit code or in-the-wild exploitation is known from the available intelligence.
An out-of-bounds read in the Android hardware VP9 decode path (Vp9DecEndOfStream in vp9hwd_output.cc) permits a locally installed app that can feed a crafted VP9 bitstream to the platform decoder to read memory beyond the intended buffer, leaking process data. Exploitation requires a local foothold (AV:L) - an app already running on the device - but no additional privileges (PR:N) and no user interaction (UI:N); the flaw is confined to devices using Google/Tensor's hardware VP9 decode implementation and is not remotely exploitable. Independent reassessment of the impact narrows this to information disclosure (C:H/I:N/A:L) rather than the vendor's code-execution framing, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is 0.11% (2nd percentile), indicating very low predicted real-world exploitation activity.
Local privilege escalation in the Pixel-specific kernel PHY power driver, specifically the gmc_phy_lp3_exit_restore_registers routine in phy_power.c, where a missing bounds check permits an out-of-bounds memory write (CWE-120). Reaching the vulnerable code path requires code already executing at Android System privilege level on an affected Pixel device, and no user interaction is needed once that context is held; per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) this is an authenticated/high-privilege local issue rather than an unprivileged-app primitive, making it most useful as a later stage in an exploit chain. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; a vendor fix is available through the September 2026 Pixel security bulletin.
Local privilege escalation in the Android kernel's FsmReleaseKey routine allows a malicious or compromised app already running on a Pixel device to bypass permission checks and gain kernel-level access, affecting confidentiality, integrity, and availability. Exploitation requires no credentials, no elevated privileges, and no user interaction (CVSS 8.4, AV:L/PR:N/UI:N), so any unpatched build predating the 2026-09-01 Pixel security patch level is exposed. No public exploit identified at time of analysis and EPSS is low at 0.12% (2nd percentile), so this is a genuine but non-urgent patching priority rather than an active threat.
Local privilege escalation in Google Android allows an unprivileged app already running on the device to trigger a heap buffer overflow in the gf_ta_test_set_config routine of gf_ta_test.c, potentially gaining elevated code execution within the affected component. The flaw carries CVSS 8.4 (AV:L/AC:L/PR:N/UI:N, C/I/A High), requires on-device execution but no elevated privileges or user interaction, and affects Android builds where the vulnerable fingerprint/trusted-application test/config code is present. EPSS is very low at 0.12% (2nd percentile), no public exploit identified at time of analysis, and the issue is fixed in the 2026-09-01 Pixel security patch level.
Privilege escalation in the Android Bootloader allows a local attacker who already holds System execution privileges to bypass an intended permission check and obtain higher-privileged code execution on affected devices. The root cause is a logic error in bootloader permission enforcement (CWE-693, protection mechanism failure) that requires no user interaction and is reachable only through local access, making it a privilege-escalation link inside a larger exploit chain rather than a standalone remote threat; the affected scope appears limited to Google Pixel devices addressed by the 2026-09-01 Pixel security bulletin. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data accompanied the available reporting.
An out-of-bounds write in the NXP NFC hardware abstraction layer (phNxpNciHal_ext_process_nfc_init_rsp in phNxpNciHal_ext.cc) lets a local attacker corrupt memory beyond the intended buffer while the HAL processes an NFC initialization response. Affected are Android devices that ship the NXP NFC HAL, which the Android CPE lists without a version bound; the flaw requires no user interaction and, per Google's bulletin wording, no additional execution privileges, so a typical app-level foothold is enough to attempt escalation. There is no CISA KEV listing and no public exploit code reported in the supplied intelligence, so exploitation is assessed as feasible but not yet observed.
Privilege escalation in the Android Setup Wizard (Google Android, fixed in the September 2026 Pixel bulletin) lets a locally-running, low-privilege app trigger a package installation because the Setup Wizard's install code path performs a missing permission check. Per the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, exploitation requires code already executing on the device under a low-privileged context, needs no user interaction and no additional execution privileges, and yields high confidentiality and integrity impact in a local attack. Despite the advisory's 'remote package install' phrasing, the CVSS vector confirms this is not a network-reachable attack, and no public exploit has been identified at time of analysis.
An out-of-bounds write in Av1DecodeFrameTag (vp9hwd_headers.cc) in the Android media decoding stack allows crafted AV1/VP9 media content to corrupt memory and potentially achieve remote code execution in the codec process, which runs with elevated system privileges relative to a normal app. Google's Pixel security bulletin dated 2026-09-01 lists the fix, and no user interaction is required, though the provided CVSS vector (PR:L) implies the attacker must already be able to route content into the decoder path. No EPSS score, CISA KEV entry, or public exploit code was supplied with this record, so active exploitation is unconfirmed.
Local privilege escalation in Google Android affects Pixel builds addressed by the 2026-09-01 Android/Pixel security bulletin, where an unprivileged app already running on the device can trigger an out-of-bounds read caused by type confusion and potentially gain elevated code execution. The issue is locally reachable with no user interaction and no prior privileges (CVSS:3.1/AV:L/AC:L/PR:N/UI:N), but an attacker must first get malicious code onto the device, so exposure is largely limited to users who sideload apps or run compromised applications. There is no CISA KEV listing and no public exploit code identified at time of analysis, and exploitation risk is low per EPSS at 0.11% (2nd percentile). The flaw was reported by Google Devices and tracked in the EU as EUVD-2026-78985.
Local privilege escalation in Google Android and Pixel builds lets an already-installed, unprivileged app leverage a type-confusion flaw in multiple system files to obtain signature data it should not be able to reach, escalating to a higher-privileged context. The attack is purely local: per the CVSS vector (AV:L/PR:N/UI:N) no credentials, elevated privileges, or user interaction are required beyond getting a malicious app running on the device, though the attacker must first sideload or distribute that app through a store listing. Exploitation is not confirmed as active, no public exploit code has been identified, and the EPSS score is very low (0.11%, 2nd percentile), making this a genuine but moderate-priority local privilege-escalation issue rather than a mass-exploitation threat; vendor patches are addressed in the 2026-09-01 Pixel security bulletin.
Local privilege escalation in the Android VPU (Video Processing Unit) component lets an attacker who already holds low-privilege code execution - such as a malicious or compromised app running on the device - bypass a missing permission check and elevate to System-level execution privileges, with no user interaction required. The flaw is assessed at CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) and was reported by Google Devices against the Pixel security bulletin, so real-world exposure centers on Pixel hardware that exposes the affected VPU subsystem rather than all devices matching the broad google:android CPE. EPSS is only 0.12% (2nd percentile) and no public exploit identified at time of analysis; impact is bounded to System privileges, not full kernel or root.
Out-of-bounds read in the Android kernel's configuration accessor get_global_config_item_addr() in gc.c allows a local attacker to read memory past the end of an allocation because the routine never validates the requested item index against the bounds of the config region. Google assigns the issue High severity (CVSS 8.4, vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting that it can be reached with no additional execution privileges and no user interaction and can be leveraged toward local escalation of privilege on the affected device. Current intelligence does not indicate active exploitation: EPSS is only 0.11% (2nd percentile), no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV; fixes shipped in the September 2026 Android/Pixel security bulletin (2026-09-01), making this a genuine but not urgent local privilege-escalation issue.
Local privilege escalation in the Android kernel allows an unprivileged app already running on a Pixel or other affected Android device to bypass a missing permission check and gain elevated privileges, resulting in full compromise of confidentiality, integrity, and availability (CVSS 8.4, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the vector is local-only and requires the attacker to already execute code on the device, the exposure is limited to post-compromise or malicious-app scenarios rather than remote attacks, and no user interaction is needed once that foothold exists. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable); EPSS is low at 0.12% (2nd percentile), and the September 2026 Android/Pixel security patch level (2026-09-01) contains the fix. Vendor-assigned severity is High, driven by the complete loss of C/I/A from a low-privilege starting point.
Use-after-free (CWE-416) in the Android kernel allows a remote attacker to escalate privileges to kernel level on affected Pixel and Android devices, with no authentication, no user interaction, and no additional execution privileges required per the CVSS vector. Google rates this 9.8 (AV:N/AC:L/PR:N/UI:N) in its September 2026 Pixel security bulletin, while independent assessment lowers the practical rating to 8.1 (AC:H) because successful exploitation must first reach the vulnerable kernel code path and then defeat Android kernel memory-corruption mitigations such as KASLR, allocator hardening, and CFI. EPSS is only 0.16% (5th percentile) and there is no CISA KEV entry and no public exploit identified at time of analysis, so exploitation is currently considered possible but not observed.
Local privilege escalation in Google Android's VPU (Video Processing Unit) driver lets an unprivileged app trigger an out-of-bounds write through a confused-deputy path, corrupting kernel memory and gaining root-level code execution on the device. Per the CVSS vector, the attacker must already hold local code execution (PR:L) but needs no user interaction, and the September 2026 Pixel/Android Security Bulletin confirms a vendor fix. No public exploit code or CISA KEV activity has been identified at time of analysis.
An out-of-bounds write in ReadTileInfo of vp9hwd_headers.cc lets a crafted VP9 bitstream corrupt memory inside Android's VP9 hardware-decoder header parser, which Google rates as remote escalation of privilege with no additional execution privileges and no user interaction required. Affected builds are those tracked under the Google Android CPE and addressed by the Android/Pixel security bulletin dated 2026-09-01. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-window issue rather than a confirmed in-the-wild campaign.
Local privilege escalation in Google Android's fingerprint TEE HAL allows an unprivileged app already running on an affected Pixel/Android device to trigger a use-after-free in fpc_tee_hal.c and gain elevated code execution. Exploitation requires local code execution as a prerequisite, no user interaction, and no additional execution privileges; it is not remotely triggerable. No public exploit code has been identified at time of analysis, and EPSS is 0.12% (2nd percentile), indicating low predicted exploitation activity despite the 8.4 CVSS score. Devices are affected if they include the Fingerprint Cards TEE HAL and have not been updated to the 2026-09-01 Android/Pixel security patch level.
Local privilege escalation in the Android kernel affecting Google/Pixel devices lets an unprivileged app already running on the device trigger a use-after-free and gain elevated privileges. The flaw stems from improper locking in a kernel code path (CWE-416), and no user interaction is required; however, an attacker must first have local code execution on the device and must win a locking race to corrupt kernel memory, which adds real-world reliability constraints. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is low at 0.11% (2nd percentile), so this is a genuine but not urgent local privilege-escalation issue confined to devices running kernel builds older than the 2026-09-01 patch level.
Local privilege escalation in the Android kernel's remap.c enable_segment path allows an unprivileged app to bypass segment permissions and gain elevated privileges on affected Pixel and Android devices (CVSS 8.4, High). Exploitation requires only an app-level foothold with no user interaction, and no public exploit code has been identified at time of analysis; EPSS is low at 0.13% (3rd percentile). Devices at a pre-2026-09-01 patch level remain at risk and are fixed by the Android Security Bulletin dated 2026-09-01.
Authentication bypass in Android's IP Multimedia Subsystem (IMS) telephony stack lets an attacker who can reach a device's IMS/SIP signaling path escalate privileges remotely, with no user interaction and no prior authentication required per the vendor vector (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is a logic error (CWE-693, Protection Mechanism Failure) affecting unpatched Android builds - the CPE entry covers all Android versions until the 2026-09-01 security patch level is applied. Exploitation in practice most plausibly requires an adjacent or carrier-network foothold, such as a compromised or malicious IMS core or a rogue base station, because the vulnerable path is the telephony signaling channel rather than an arbitrary Internet-facing service; no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low (0.20%, 10th percentile), so the high severity stems from the potential impact if reachable rather than from observed exploitation.