Scripting
Monthly
Unauthenticated remote data disclosure in Oracle Scripting (Oracle E-Business Suite component: Internal Operations) affects all supported releases from 12.2.3 through 12.2.15. Exploitation over HTTP requires no credentials, no user interaction, and no special configuration - consistent with the Authentication Bypass tag reported alongside this vulnerability. Successful exploitation grants an attacker unauthorized read access to all data accessible within Oracle Scripting, including potentially critical business data. No public exploit or active exploitation has been confirmed at time of analysis.
Oracle Scripting versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes an Internal Operations component vulnerability allowing low-privileged, network-based attackers to achieve full confidentiality and integrity compromise of all Scripting-accessible data, plus partial service disruption. The "Authentication Bypass" tag from the intelligence feed creates a notable tension with the CVSS PR:L assignment - if the bypass allows unauthenticated users to obtain a low-privilege session context, the effective attack surface is wider than the CVSS vector alone suggests. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H rating constrains opportunistic exploitation.
Oracle Scripting within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible vulnerability in the Internal Operations component, allowing a low-privileged authenticated attacker to gain complete unauthorized read access to all Oracle Scripting-accessible data and limited write access via HTTP. The vulnerability carries an Authentication Bypass tag, indicating the flaw permits privilege escalation beyond the attacker's intended authorization level within the module. No public exploit code or active exploitation has been identified at time of analysis, though Oracle itself characterizes the vulnerability as easily exploitable, elevating urgency despite the absence of a CISA KEV listing.
Oracle Scripting versions 12.2.3 through 12.2.15, as part of Oracle E-Business Suite, exposes an easily exploitable flaw in its Internal Operations component that enables a low-privileged network attacker to achieve full system takeover over HTTP. The vulnerability scores CVSS 3.1 8.8, reflecting High impacts across all three pillars - Confidentiality, Integrity, and Availability - with low attack complexity and no user interaction required. No public exploit has been identified at time of analysis, but the minimal authentication barrier and network accessibility make this a high-urgency remediation target for organizations running Oracle EBS.
Oracle Scripting's Scripting Admin component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is exploitable by low-privileged, network-authenticated attackers over HTTP, enabling unauthorized read and write access to accessible Scripting data. Tagged as an Authentication Bypass, this flaw requires only a valid low-privilege account and no user interaction, making the realistic threat surface broader than the medium CVSS score alone suggests for large enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Oracle July 2026 Critical Patch Update addresses this issue.
Full takeover of Oracle Scripting, the scripted-interaction module of Oracle E-Business Suite (Internal Operations component), is possible by a remote unauthenticated attacker over HTTP in supported releases 12.2.3 through 12.2.15. Because the CVSS vector carries high confidentiality, integrity, and availability impact (8.1), a successful attack yields complete compromise of the module rather than mere data exposure, though the high attack complexity (AC:H) means exploitation is not trivial. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list.
Oracle Scripting within E-Business Suite (versions 12.2.3 through 12.2.15) allows a high-privileged attacker with HTTP network access to fully compromise data confidentiality and integrity in the Internal Operations component. Despite the PR:H CVSS rating, the 'Authentication Bypass' tag raises concern that effective access controls may be circumventable, potentially lowering the real exploitation barrier below what the score implies. No public exploit or CISA KEV listing has been identified at time of analysis, but the July 2026 Oracle CPU advisory confirms the issue and remediation is available.
Reflected cross-site scripting in Oracle E-Business Suite Scripting Admin (versions 12.2.3-12.2.15) allows unauthenticated attackers to modify or read sensitive data via malicious HTTP requests that require user interaction. The vulnerability can impact other Oracle products due to scope changes and currently lacks an available patch. CVSS 6.1 (Medium) reflects low-complexity network-based exploitation with confidentiality and integrity impacts.
In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Script Author). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 31.0%.
Unauthenticated remote data disclosure in Oracle Scripting (Oracle E-Business Suite component: Internal Operations) affects all supported releases from 12.2.3 through 12.2.15. Exploitation over HTTP requires no credentials, no user interaction, and no special configuration - consistent with the Authentication Bypass tag reported alongside this vulnerability. Successful exploitation grants an attacker unauthorized read access to all data accessible within Oracle Scripting, including potentially critical business data. No public exploit or active exploitation has been confirmed at time of analysis.
Oracle Scripting versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes an Internal Operations component vulnerability allowing low-privileged, network-based attackers to achieve full confidentiality and integrity compromise of all Scripting-accessible data, plus partial service disruption. The "Authentication Bypass" tag from the intelligence feed creates a notable tension with the CVSS PR:L assignment - if the bypass allows unauthenticated users to obtain a low-privilege session context, the effective attack surface is wider than the CVSS vector alone suggests. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H rating constrains opportunistic exploitation.
Oracle Scripting within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible vulnerability in the Internal Operations component, allowing a low-privileged authenticated attacker to gain complete unauthorized read access to all Oracle Scripting-accessible data and limited write access via HTTP. The vulnerability carries an Authentication Bypass tag, indicating the flaw permits privilege escalation beyond the attacker's intended authorization level within the module. No public exploit code or active exploitation has been identified at time of analysis, though Oracle itself characterizes the vulnerability as easily exploitable, elevating urgency despite the absence of a CISA KEV listing.
Oracle Scripting versions 12.2.3 through 12.2.15, as part of Oracle E-Business Suite, exposes an easily exploitable flaw in its Internal Operations component that enables a low-privileged network attacker to achieve full system takeover over HTTP. The vulnerability scores CVSS 3.1 8.8, reflecting High impacts across all three pillars - Confidentiality, Integrity, and Availability - with low attack complexity and no user interaction required. No public exploit has been identified at time of analysis, but the minimal authentication barrier and network accessibility make this a high-urgency remediation target for organizations running Oracle EBS.
Oracle Scripting's Scripting Admin component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is exploitable by low-privileged, network-authenticated attackers over HTTP, enabling unauthorized read and write access to accessible Scripting data. Tagged as an Authentication Bypass, this flaw requires only a valid low-privilege account and no user interaction, making the realistic threat surface broader than the medium CVSS score alone suggests for large enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Oracle July 2026 Critical Patch Update addresses this issue.
Full takeover of Oracle Scripting, the scripted-interaction module of Oracle E-Business Suite (Internal Operations component), is possible by a remote unauthenticated attacker over HTTP in supported releases 12.2.3 through 12.2.15. Because the CVSS vector carries high confidentiality, integrity, and availability impact (8.1), a successful attack yields complete compromise of the module rather than mere data exposure, though the high attack complexity (AC:H) means exploitation is not trivial. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list.
Oracle Scripting within E-Business Suite (versions 12.2.3 through 12.2.15) allows a high-privileged attacker with HTTP network access to fully compromise data confidentiality and integrity in the Internal Operations component. Despite the PR:H CVSS rating, the 'Authentication Bypass' tag raises concern that effective access controls may be circumventable, potentially lowering the real exploitation barrier below what the score implies. No public exploit or CISA KEV listing has been identified at time of analysis, but the July 2026 Oracle CPU advisory confirms the issue and remediation is available.
Reflected cross-site scripting in Oracle E-Business Suite Scripting Admin (versions 12.2.3-12.2.15) allows unauthenticated attackers to modify or read sensitive data via malicious HTTP requests that require user interaction. The vulnerability can impact other Oracle products due to scope changes and currently lacks an available patch. CVSS 6.1 (Medium) reflects low-complexity network-based exploitation with confidentiality and integrity impacts.
In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Script Author). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 31.0%.