Authentication Bypass

Oracle Price Protection (Internal Operations component) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes a medium-severity flaw allowing low-privileged, network-accessible attackers to partially compromise data confidentiality, integrity, and availability via HTTP. The vulnerability is easily exploitable with no attack complexity, requiring only a valid low-privileged account, enabling unauthorized read, write/delete operations on a subset of Price Protection data, and the ability to cause partial denial of service. No public exploit code or active exploitation has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.

Oracle Bills of Material's Web Services component in E-Business Suite 12.2.3-12.2.15 exposes a medium-severity flaw allowing low-privileged authenticated attackers to compromise data confidentiality, integrity, and availability via HTTP. Exploitation yields unauthorized read access to a subset of Bills of Material data, unauthorized insert, update, or delete capability, and the ability to cause a partial denial of service against the module. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.

Partial compromise of Oracle Advanced Benefits (Self Service Benefits component) is achievable by any low-privileged, network-adjacent attacker over HTTP, affecting all E-Business Suite deployments on versions 12.2.4 through 12.2.15. Successful exploitation yields unauthorized read access to a subset of benefits data, unauthorized write/insert/delete capability against accessible records, and the ability to cause partial denial of service within the affected component. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog, though the low complexity and minimal privilege threshold make it accessible to a broad pool of internal threat actors.

Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) exposes a network-exploitable flaw in its Outlook Sync Win 32 component that allows low-privileged authenticated users to perform unauthorized data reads, writes, and cause a partial denial of service via HTTP. Oracle classified this as easily exploitable, with low attack complexity and no user interaction required beyond holding a valid low-level account. No public exploit identified at time of analysis and it does not appear in the CISA KEV catalog, but the low barrier to exploitation makes it a credible insider or compromised-credential threat for affected EBS deployments.

Oracle Workflow's Notification Mailer component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is compromised by a low-privileged, network-accessible attacker via HTTP, yielding partial confidentiality, integrity, and availability impacts. Exploitation requires no user interaction, making it straightforward for any authenticated EBS user to abuse this flaw. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.

Oracle Marketing's Audience component, within Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits low-privileged authenticated network attackers to exploit the application over HTTP with low complexity. Successful exploitation yields unauthorized read access to a subset of marketing data, unauthorized insert/update/delete capability against that data, and the ability to cause a partial denial of service within the Oracle Marketing module. No public exploit code or active exploitation has been identified at time of analysis.

Oracle Product Hub versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes a flaw in its Role Based Security component that allows a low-privileged, network-authenticated attacker to exceed their authorized data access via HTTP. Successful exploitation yields unauthorized read access to a subset of product catalog data, unauthorized insert, update, or delete operations on accessible records, and the ability to cause partial denial of service within the Product Hub module. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.

Oracle Product Hub's Item Catalog component in E-Business Suite versions 12.2.3 through 12.2.15 exposes an easily exploitable flaw allowing low-privileged, authenticated HTTP network attackers to compromise item master data. Successful exploitation yields unauthorized read access to a subset of Product Hub data, unauthorized data modification or deletion, and partial denial of service against the Product Hub component. No public exploit identified at time of analysis, and Oracle classified this as 'easily exploitable' in its July 2026 Critical Patch Update.

Oracle Product Workbench's WebUI component within E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated attackers reachable over HTTP to perform unauthorized data reads, inserts, updates, and deletions against accessible product data, and to cause partial denial of service. Oracle's CPU July 2026 advisory characterizes the vulnerability as 'easily exploitable,' indicating a low-complexity attack path once valid low-level credentials are obtained. No public exploit code or CISA KEV listing has been identified at time of analysis, placing current exploitation status as unconfirmed.

Partial authorization bypass in Oracle Call Center Technology (E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read a subset of sensitive CCT data and perform unauthorized insert, update, or delete operations against that data over HTTP. The RDBMS and UI component fails to enforce access boundaries for authenticated sessions, exposing data integrity and partial confidentiality. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the Oracle Security Alert tag of 'Authentication Bypass' warrants prompt patching in internet-accessible deployments.

Oracle Scripting's Scripting Admin component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is exploitable by low-privileged, network-authenticated attackers over HTTP, enabling unauthorized read and write access to accessible Scripting data. Tagged as an Authentication Bypass, this flaw requires only a valid low-privilege account and no user interaction, making the realistic threat surface broader than the medium CVSS score alone suggests for large enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Oracle July 2026 Critical Patch Update addresses this issue.

Unauthenticated remote exploitation of Oracle Teleservice (E-Business Suite versions 12.2.3 through 12.2.15) via HTTP allows attackers to read a subset of accessible service data and perform unauthorized insert, update, or delete operations against Teleservice records through the Service Diagnostics Scripts component. The vulnerability is tagged as an authentication bypass, indicating the diagnostic scripting interface fails to enforce access controls against unauthenticated callers. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though Oracle's own advisory classifies this as 'easily exploitable,' elevating operational priority for internet-facing EBS deployments.

Unauthorized data access in Oracle Knowledge Management (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged attacker over HTTP without user interaction. Exploitation allows unauthorized read access to a subset of Knowledge Management data and unauthorized insert, update, or delete operations against accessible data records. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, though the 'Authentication Bypass' tag warrants scrutiny given the CVSS PR:L rating.

Unauthorized data access in the UK Payroll component of Oracle HRMS (UK) within Oracle E-Business Suite allows low-privileged, authenticated network attackers to read and manipulate payroll records beyond their intended authorization level. Affected versions span 12.2.3 through 12.2.15 and the attack path requires only HTTP access with no user interaction. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.

Unauthorized data access and modification in Oracle iSupport's Call Back component exposes versions 12.2.3 through 12.2.15 of Oracle E-Business Suite to low-privileged network-based attack. Authenticated attackers with only basic network access via HTTP can bypass authorization controls - consistent with the 'Authentication Bypass' tag despite the PR:L vector - to read a subset of iSupport data and perform unauthorized insert, update, or delete operations. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low attack complexity and absence of user-interaction requirements make it straightforward to exploit once credentials are obtained.

Oracle Advanced Inbound Telephony (versions 12.2.3 through 12.2.15) within Oracle E-Business Suite exposes a medium-severity network-exploitable flaw in its Servers component that allows low-privileged authenticated attackers to perform unauthorized data reads, data manipulation, and partial denial of service via HTTP. Disclosed as part of Oracle's Critical Patch Update for July 2026 and tracked under ENISA EUVD-2026-47445, the vulnerability carries a CVSS 3.1 base score of 6.3, reflecting its low complexity and absence of required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad affected version range make it a meaningful risk for organizations running unpatched Oracle E-Business Suite deployments.

Unauthorized data access and modification in Oracle HRMS (New Zealand) 12.2.3-12.2.15 exposes the New Zealand Payroll component to low-privileged network attackers over HTTP. Exploiting this flaw, a low-privileged authenticated user can read a subset of HRMS payroll data and perform unauthorized insert, update, or delete operations on accessible records - consistent with an authorization bypass within the application layer. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; EPSS data was not provided in source intelligence.

Unauthorized data access in Oracle HRMS (Hong Kong), a component of Oracle E-Business Suite, exposes payroll records to low-privileged network attackers via HTTP. Affected versions 12.2.13 through 12.2.15 allow an authenticated low-privileged user to read a subset of restricted payroll data and perform unauthorized insert, update, or delete operations against accessible Hong Kong Payroll data. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible insider or compromised-credential risk for affected tenants.

Unauthorized payroll data exposure in Oracle E-Business Suite's HRMS (Australia) Payroll component allows a low-privileged, network-authenticated attacker to access all HR and payroll data accessible to the application. Affecting versions 12.2.3 through 12.2.15, Oracle classifies this as 'easily exploitable' in the July 2026 Critical Patch Update, requiring only low user privileges over HTTP with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the confidentiality impact against sensitive payroll records elevates practical priority for affected Australian EBS deployments.

Unauthorized data access in Oracle Payroll (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to read all Payroll-accessible data over HTTP. Tagged by intelligence sources as an Authentication Bypass, this flaw enables a user with basic EBS credentials to exceed their authorization and access sensitive payroll records - including salary, tax, and banking information - belonging to the entire organization. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this a practical insider and credential-theft risk for any enterprise running affected EBS versions.

Unauthorized data disclosure in Oracle Learning Management (E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to access critical or complete LMS data via the Import and Export component over HTTP. Tagged as an Authentication Bypass, the flaw enables privilege escalation beyond the attacker's granted access level, resulting in full confidentiality compromise of all Learning Management accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network vector make this straightforward to exploit once credentials are obtained.

Oracle Workflow's Notification Mailer component in Oracle E-Business Suite exposes an unauthenticated SMTP-based attack path allowing partial data manipulation and partial denial of service. Versions 12.2.3 through 12.2.15 are confirmed affected per Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and Oracle rates this difficult to exploit (AC:H), placing the practical risk below the moderate CVSS 4.8 score for most organizations.

Unauthorized data access and modification in Oracle Item Master (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by any low-privileged authenticated attacker over HTTP, with no user interaction required. The vulnerability resides in the iSet-up component and enables an attacker to read a subset of Item Master data and perform unauthorized inserts, updates, or deletes beyond their intended authorization scope. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; however, the 'Authentication Bypass' tag suggests an authorization boundary failure that could be straightforward to exploit once an attacker holds any valid account.

Client-side injection in Oracle Banking Origination 14.5.0.16.0's Configuration component allows unauthenticated remote attackers over HTTP to read a subset of accessible banking origination data and perform unauthorized data modifications when a legitimate user interacts with a crafted payload. The CVSS scope change (S:C) confirms exploitation can cascade beyond the primary application into other Oracle Financial Services components sharing the same deployment context. Disclosed in Oracle's Critical Patch Update July 2026 with no confirmed active exploitation or public exploit code at time of analysis.

Confidentiality and integrity compromise in Oracle Security Service 12.2.1.4.0 (Oracle SSL API component within Oracle Fusion Middleware) allows a low-privileged, network-connected attacker to gain unauthorized read and write access to critical data managed by the service over TLS. Tagged as an Authentication Bypass by ENISA EUVD (EUVD-2026-47416) and reported by Oracle's security team via the July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 6.4 due to high attack complexity and mandatory human interaction, significantly constraining real-world exploitability. No public exploit code or CISA KEV listing has been identified at time of analysis.

Oracle Labor Distribution (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 exposes an authorization bypass in its Internal Operations component, enabling a low-privileged authenticated attacker with network access to read a subset of labor distribution data and perform unauthorized insert, update, or delete operations. The vulnerability is classified as 'easily exploitable' by Oracle with a CVSS 3.1 score of 5.4 (Medium), reflecting low attack complexity and no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; remediation is available via Oracle's July 2026 Critical Patch Update.

Local integrity and availability compromise in Oracle Agile Engineering Data Management 6.2.1's Document Management component enables low-privileged local users to perform unauthorized data manipulation and trigger partial denial-of-service conditions. Oracle classifies this as 'easily exploitable' given low attack complexity, though the local infrastructure access requirement significantly constrains the realistic attacker pool. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the CVSS 4.4 Medium score reflects the bounded impact ceiling - partial integrity and availability loss only, with no confidentiality exposure.

Oracle Agile Engineering Data Management 6.2.1 contains an authentication bypass in its Install component, reachable over HTTP by low-privileged network attackers, that enables complete unauthorized read and write access to all application data. Exploitation requires both high attack complexity and active human interaction from a victim - limiting opportunistic exploitation - but successful attacks yield critical confidentiality and integrity compromise with no availability impact. No public exploit has been identified at time of analysis; Oracle addressed this in the Critical Patch Update for July 2026.

Unauthorized critical data disclosure in Oracle Agile Engineering Data Management 6.2.1 is achievable by a low-privileged attacker with local infrastructure access, exploiting a weakness in the Install component to bypass authentication controls and reach protected data. The scope change (S:C) means successful exploitation can cascade into unauthorized access across additional Oracle Supply Chain products beyond EDM itself. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and absence of user interaction make this straightforward to exploit given local footing.

Oracle Product Lifecycle Analytics 3.6.1 exposes a network-exploitable flaw in its Installation Issues component, allowing a high-privileged attacker to achieve full confidentiality and integrity compromise of all accessible application data alongside partial service disruption via HTTP. The 'Installation Issues' component designation and the 'Authentication Bypass' intelligence tag together suggest the flaw may reside in insecure post-installation artifacts, exposed setup endpoints, or improperly secured administrative interfaces left accessible after deployment. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Local privilege escalation via authentication bypass in Oracle Agile PLM 9.3.6 allows a low-privileged attacker with existing local infrastructure access to gain unauthorized read access to all PLM-accessible data, with confirmed scope change effects that may extend compromise to additional Oracle supply chain products. The CVSS vector (AV:L/PR:L/S:C/C:H) confirms exploitation is constrained to local infrastructure foothold but produces high-impact confidentiality loss across trust boundaries. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes low-privileged authenticated users to unauthorized read and write access on platform data via HTTP. Disclosed as part of Oracle's Critical Patch Update for July 2026 and tagged as an authentication bypass issue, the vulnerability enables a low-privileged network attacker to read a subset of data and perform unauthorized insert, update, or delete operations within the Experience Manager component. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Full system takeover of Oracle Communications Convergent Charging Controller (Prov IF component) is achievable by a high-privileged network attacker exploiting a difficult-to-trigger flaw over HTTP in versions 15.0.0.0.0 and 15.2.0.0.0. The attack requires human interaction from a third party in addition to prior high-privilege access, making opportunistic exploitation unlikely. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis, though the complete confidentiality, integrity, and availability impact warrants patching within standard enterprise patch cycles.

Authentication bypass in Oracle Commerce Platform 11.4.0 exposes full data confidentiality and integrity through the Dynamo Application Framework component, allowing a low-privileged network attacker to read or modify all platform data via HTTP. The CVSS 3.1 score of 6.8 reflects meaningful exploitation complexity (AC:H) and the requirement for at least some authenticated access (PR:L), limiting opportunistic mass exploitation. No public exploit code or active exploitation has been identified at time of analysis, and remediation is available via Oracle's July 2026 Critical Patch Update.

Unauthorized data exfiltration in Oracle HRMS (UK), a component of Oracle E-Business Suite, exposes complete HR records to low-privileged network attackers via a scope-changing vulnerability in the Internal Operations component. Versions 12.2.8 through 12.2.15 are affected, and successful exploitation can breach data beyond the immediate HRMS (UK) boundary, impacting additional E-Business Suite products. Tagged as an authentication bypass by EUVD intelligence, the attack requires HTTP network access and low privilege credentials but no user interaction, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.

Unauthorized data disclosure in Oracle Order Management's Product Diagnostic Tools component (E-Business Suite 12.2.3-12.2.15) allows a low-privileged network attacker to read all data accessible to the application over HTTP with no user interaction required. The 'Authentication Bypass' tag suggests the diagnostic interface fails to enforce proper authorization boundaries, enabling a minimally privileged account to exceed its intended data access scope. No public exploit has been identified at time of analysis, but the low attack complexity and ERP-grade data sensitivity - order records, customer PII, financial data - elevate business impact well beyond the moderate CVSS 6.5 score.

Local privilege escalation via authentication bypass in Oracle Application Object Library (AOL) Core component exposes critical data across Oracle E-Business Suite 12.2.3 through 12.2.15. A low-privileged attacker with local system access can bypass authentication controls within AOL Core, gaining unauthorized read access to critical or complete AOL-accessible data - and, due to a confirmed scope change, potentially compromising additional integrated EBS products beyond AOL itself. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) enables an unauthenticated attacker positioned on the adjacent physical network segment to access critical application data and manipulate select records. The exploit is rated difficult due to adjacent-network positioning requirements and high attack complexity, yielding a moderate CVSS 5.9 score despite the high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, limiting immediate mass-exploitation risk.

Local authentication bypass in MySQL Server and MySQL Cluster's Pluggable Auth component allows an unauthenticated local attacker to perform unauthorized data modification under high-complexity conditions. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster across 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Impact is limited to low-severity integrity compromise - no confidentiality or availability impact - with no public exploit or CISA KEV listing identified at time of analysis.

Local privilege abuse in Oracle GoldenGate's Libraries component allows low-privileged OS users on the GoldenGate host to read and modify a subset of GoldenGate-accessible data without proper authorization. Three major version branches are affected - 19.x, 21.x, and 23.x - covering a broad deployment window documented in Oracle's Critical Patch Update for July 2026. No public exploit or active exploitation has been identified at time of analysis; the moderate CVSS 4.4 score correctly reflects the local-only attack vector and constrained data impact.

Oracle Performance Management (E-Business Suite, Appraisals component, versions 12.2.3-12.2.15) exposes a network-accessible authorization bypass that allows low-privileged authenticated users to read and manipulate appraisal data beyond their intended access scope via HTTP. Tagged as an Authentication Bypass, the flaw enables partial confidentiality and integrity compromise against a widely-deployed enterprise ERP module. No public exploit code or CISA KEV listing has been identified at time of analysis; disclosure is tied to Oracle's CPU July 2026 advisory cycle.

Unauthorized access to critical data is achievable against MySQL Connector/J versions 9.7.0 and 9.7.1 via a network-accessible authentication bypass flaw requiring human interaction. Oracle classifies this as easily exploitable, meaning a network-positioned unauthenticated attacker can intercept or otherwise obtain complete access to all data flowing through the affected connector when a legitimate application initiates a database connection. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Unauthorized data access in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker operating over HTTP to read a subset of HR data and perform unauthorized insert, update, or delete operations within the Regression Testing component. The vulnerability is rated CVSS 5.4 Medium with no availability impact, confined to confidentiality and integrity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the source intelligence warrants further investigation given its tension with the PR:L CVSS metric.

Oracle GoldenGate Libraries contain a local, high-complexity flaw affecting versions 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, and 23.4 through 23.26.2 that allows a high-privileged local attacker - with an additional required victim interaction - to gain complete read access to all GoldenGate-accessible data, partially manipulate data integrity, and cause a complete denial of service via hang or repeatable crash. Tagged as an authentication bypass by intelligence sources, the vulnerability likely allows an already-privileged operator to circumvent an internal GoldenGate security control within the Libraries component, elevating their effective access beyond their authorized scope. No public exploit code or CISA KEV listing has been identified at time of analysis.

Oracle Self-Service Human Resources within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes an exploitable authorization control weakness in its Internal Operations component, reachable over HTTP without requiring high privileges. A low-privileged authenticated attacker can perform unauthorized read, insert, update, and delete operations against a subset of HR data - impacting both confidentiality and data integrity. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this straightforward to exploit for any authenticated user.

PeopleSoft Enterprise FIN Engineering Argentina version 9.1 exposes a secondary authorization flaw in its Engineering component that enables a network-reachable high-privileged attacker to perform unauthorized read and limited write operations against accessible financial data via HTTP. The Oracle-provided CVSS 3.1 score of 3.3 (Low) reflects high attack complexity and high privilege prerequisites, substantially containing real-world risk. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the reporter-supplied 'Authentication Bypass' tag conflicts with the PR:H CVSS metric and warrants vendor clarification.

Integrity compromise and partial denial-of-service in Oracle PeopleSoft Enterprise FIN General Ledger Argentina 9.1 allows a low-privileged, network-based attacker to create, delete, or modify critical financial data and partially disrupt service availability via HTTP. Exploitation is rated difficult (AC:H), and no confidentiality impact is indicated, suggesting the flaw is scoped to data-write and availability disruption within the Argentina General Ledger component. No public exploit code or active exploitation has been identified at time of analysis.

Unauthorized data access in Oracle E-Business Suite Secure Enterprise Search versions 12.2.3 through 12.2.15 allows a low-privileged network attacker to read and modify data within the Search Integration Engine component via HTTP. Despite requiring a valid low-privilege account, the vulnerability is tagged as an Authentication Bypass, suggesting attackers can circumvent authorization controls within the search subsystem to access data beyond their permitted scope. No public exploit code or CISA KEV listing exists at time of analysis, and Oracle has addressed this in the July 2026 Critical Patch Update.

PeopleSoft Enterprise FIN eSettlements 9.2 exposes financial settlement data to unauthenticated network attackers via an HTTP-accessible authentication bypass, enabling limited unauthorized read access and write manipulation of settlement records. Carrying a CVSS 3.1 score of 4.8 with high attack complexity (AC:H), exploitation is not trivial and resists easy automation, but the financial nature of the affected data - electronic payments and settlement instructions - amplifies business risk well beyond the moderate numeric score. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept has been identified at the time of this analysis.

Partial authentication bypass in Oracle PeopleSoft Enterprise FIN Grants 9.2 exposes limited data read and write capabilities to unauthenticated network attackers over HTTP. Exploitation is rated difficult (AC:H), meaning the attacker must satisfy specific, unstated preconditions to succeed, constraining real-world risk despite the absence of authentication requirements. Impact is bounded: only a subset of Grants data is accessible for reading, and unauthorized inserts, updates, or deletes are limited to some accessible data - full database compromise is not implied. No public exploit code or active exploitation has been identified at time of analysis.

Oracle Concurrent Processing within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a medium-severity flaw in its BI Publisher Integration component that allows a low-privileged, authenticated network attacker to compromise data integrity, read restricted data, and cause partial denial of service via HTTP. The vulnerability is described by Oracle as 'easily exploitable,' lowering the bar for abuse by any user holding a valid account. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, though its low attack complexity and no-UI-interaction requirements make it operationally straightforward once credentials are obtained.

Unauthorized data disclosure in Oracle Production Scheduling (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged network attacker to gain complete read access to all data within the application via a difficult-to-exploit flaw in the User Interface component. Tagged as an authentication bypass, the vulnerability suggests improper access control enforcement in the UI layer that permits privilege escalation beyond the attacker's normally granted permissions, enabling full confidentiality compromise of Production Scheduling data. No public exploit code or active exploitation has been identified; Oracle addressed this in the Critical Patch Update for July 2026.

Oracle Production Scheduling (E-Business Suite component) exposes an integrity-only vulnerability exploitable exclusively by high-privileged local attackers on the hosting infrastructure, across versions 12.2.3 through 12.2.15. Successful exploitation permits unauthorized write operations - insert, update, or delete - against a subset of the scheduling module's data, with no confidentiality or availability impact. No public exploit code exists and the vulnerability is not listed in CISA KEV; the extremely low CVSS score of 1.9 reflects the steep exploitation barrier imposed by local access and high privilege prerequisites.

Oracle Production Scheduling (versions 12.2.3 through 12.2.15) contains a high-privilege network-exploitable flaw in its Internal Operations component that allows authorized but potentially abusive HTTP requests to bypass internal controls and achieve unauthorized creation, deletion, or modification of critical data, with a documented scope change that can cascade impact into adjacent Oracle E-Business Suite products. The vulnerability is tagged as an Authentication Bypass by both the Oracle reporter (secalert_us@oracle.com) and ENISA EUVD-2026-47260, introducing meaningful ambiguity against the CVSS PR:H designation. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the standard CPU patching priority tier despite the scope change.

Oracle Production Scheduling versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes its Internal Operations component to exploitation by high-privileged remote attackers over HTTP. Successful exploitation yields partial unauthorized read and write access to accessible data alongside a partial denial of service condition. No public exploit code or confirmed active exploitation has been identified at time of analysis; CVSS score of 4.7 (Medium) reflects the significant mitigation from the high-privilege prerequisite.

Oracle Production Scheduling versions 12.2.3 through 12.2.15 in Oracle E-Business Suite exposes a local exploitation path through its Internal Operations component, enabling a low-privileged attacker - given co-presence of a second interacting user - to achieve unauthorized creation, deletion, or modification of critical data with a scope change that can cascade impact to additional Oracle EBS products. Tagged as an authentication bypass by ENISA EUVD-2026-47258, the flaw is addressed in Oracle's Critical Patch Update for July 2026. No public exploit code or CISA KEV listing has been identified at time of analysis.

Oracle HRMS (Norway) Payroll component within E-Business Suite versions 12.2.3 through 12.2.15 exposes limited confidentiality and integrity risks to high-privileged authenticated network attackers over HTTP. A successfully exploited vulnerability enables unauthorized read access to a subset of Norway Payroll data and unauthorized update, insert, or delete operations on accessible records within that module. No public exploit code has been identified at time of analysis, CISA KEV listing is absent, and the CVSS 3.1 base score of 3.8 (Low) reflects the constrained scope and high privilege bar required.

Oracle Time and Labor (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 exposes a difficult-to-exploit flaw that allows a high-privileged, network-authenticated attacker operating over HTTP to gain complete read access to all Time and Labor data and limited write access (insert, update, delete), with scope change implications affecting additional Oracle EBS components. Tagged as an authentication bypass by ENISA EUVD intelligence, this conflict with the CVSS PR:H requirement warrants investigative scrutiny - it may indicate a secondary authorization bypass rather than a full authentication bypass. No public exploit has been identified and the vulnerability is not listed in CISA KEV.

Oracle Scripting within E-Business Suite (versions 12.2.3 through 12.2.15) allows a high-privileged attacker with HTTP network access to fully compromise data confidentiality and integrity in the Internal Operations component. Despite the PR:H CVSS rating, the 'Authentication Bypass' tag raises concern that effective access controls may be circumventable, potentially lowering the real exploitation barrier below what the score implies. No public exploit or CISA KEV listing has been identified at time of analysis, but the July 2026 Oracle CPU advisory confirms the issue and remediation is available.

Unauthorized data access and modification in Oracle Flow Manufacturing (component: Internal Operations) allows a low-privileged, network-adjacent attacker to compromise confidentiality and integrity of Flow Manufacturing data, with a scope change that may impact additional Oracle E-Business Suite products. Affected versions span 12.2.3 through 12.2.15, a wide deployment window covering over a decade of releases. The attack requires human interaction from a victim beyond the attacker, suggesting a social-engineering or UI-based exploitation vector. No public exploit code or CISA KEV listing has been identified at time of analysis; this is a medium-severity finding addressed in Oracle's July 2026 Critical Patch Update.

Oracle Service Contracts (E-Business Suite versions 12.2.3-12.2.15) exposes a network-accessible integrity and confidentiality flaw in its Internal Operations component that allows a high-privileged, authenticated attacker to bypass authorization controls and gain unauthorized read or write access to all Service Contracts data. The attack is rated difficult to exploit and requires human interaction from a third party, substantially limiting opportunistic exploitation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, though the 'Authentication Bypass' tag signals a meaningful authorization control gap rather than a simple privilege escalation.

Partial data integrity compromise in Oracle Labor Distribution (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged attacker with network access via HTTP to perform unauthorized insert, update, or delete operations on some accessible data within the product's Internal Operations component. The 'Authentication Bypass' tag in the intelligence data is notable but conflicts with the PR:L CVSS metric, suggesting this is more accurately an internal authorization bypass within an authenticated session rather than a full bypass of the login mechanism. No public exploit code exists and the vulnerability is not listed in CISA KEV; with a CVSS 3.1 score of 3.1 (Low) and AC:H, this represents a low-priority finding for most environments.

Unauthorized data manipulation in Oracle Public Sector Financials (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged authenticated attacker over HTTP targeting the Internal Operations component. Despite the 'Authentication Bypass' tag, the CVSS PR:L metric confirms initial credentials are required, suggesting the flaw represents a post-authentication authorization control bypass rather than a full authentication bypass. Impact is constrained to limited integrity loss - partial unauthorized insert, update, or delete of accessible data - with no confidentiality or availability impact, and no public exploit or active exploitation identified at time of analysis.

Unauthorized data access in Oracle Property Manager (E-Business Suite component: Internal Operations) allows low-privileged authenticated network attackers to read and manipulate property management data via HTTP. Affected versions span 12.2.3 through 12.2.15. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low attack complexity and broad version range make patching a near-term priority for EBS deployments.

Unauthorized data access and modification in Oracle Property Manager (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a network-authenticated low-privileged attacker via HTTP when a victim user interacts with attacker-controlled content, triggering a scope change that may impact additional EBS components. The vulnerability permits unauthorized read access to a subset of Property Manager data and unauthorized insert, update, or delete operations on accessible data. No public exploit code or CISA KEV listing is identified at time of analysis, but the 'Authentication Bypass' tag signals a potential authorization control failure beyond the base CVSS score suggests.

Partial compromise of Oracle Installed Base (Create Item Instance component) within Oracle E-Business Suite versions 12.2.4 through 12.2.15 is achievable by a low-privileged authenticated attacker over HTTP, subject to high attack complexity conditions. Successful exploitation results in unauthorized read access to a subset of Installed Base data, unauthorized data manipulation (insert/update/delete), and the ability to cause a partial denial of service. No public exploit or active exploitation has been identified at time of analysis; the Oracle CPU July 2026 advisory addresses this issue.

Unauthorized data disclosure in Oracle HCM Configuration Workbench (Rapid Implementation component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to gain complete access to all data accessible within the application via HTTP. Tagged as an Authentication Bypass, the flaw indicates that a legitimately authenticated user with minimal privileges can circumvent authorization controls to access sensitive HCM data well beyond their entitlement - covering employee PII, compensation structures, and organizational data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range spanning twelve supported minor releases elevate operational risk in large enterprise environments running externally accessible EBS instances.

Local privilege escalation via authentication bypass in Oracle Payroll (E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged user with infrastructure logon to gain complete unauthorized read access to all Oracle Payroll data, with scope change indicating potential lateral impact to additional EBS components. The CVSS vector confirms local attack vector with low complexity and no user interaction required, making this straightforwardly exploitable by any authenticated OS-level user on the Payroll host. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle's 'easily exploitable' language in the advisory warrants prompt patching for any internet-adjacent or multi-tenant EBS deployment.

Full takeover of Oracle HRMS (Norway) - the Norway Payroll component within Oracle E-Business Suite - is possible for a high-privileged attacker who can satisfy difficult exploitation conditions over HTTP across versions 12.2.8 through 12.2.15. Despite the complete C/I/A impact, the CVSS 3.1 score of 6.6 reflects real-world constraints: both high attack complexity (AC:H) and high privilege requirements (PR:H) must be met, making opportunistic mass exploitation unlikely. No public exploit code or CISA KEV listing has been identified at time of analysis, consistent with this being a targeted, insider-threat-class risk.

Unauthorized read access to critical data in Oracle Work in Process (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-connected attacker exploiting an authentication bypass in the Internal Operations component via HTTP. The flaw is rated difficult to exploit (AC:H) and carries no integrity or availability impact, but successful exploitation grants complete access to all data accessible within the Work in Process module. No public exploit code or CISA KEV listing is associated with this vulnerability at time of analysis.

Unauthorized critical data disclosure in Oracle Order Management (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 stems from a flaw in the Product Diagnostic Tools component, exploitable by a high-privileged attacker over HTTP with no user interaction. Successful exploitation triggers a scope change, meaning the compromise can extend to additional Oracle products accessible through the Order Management context, resulting in complete access to all confidential data within that reach. No public exploit has been identified at time of analysis, and a fix is available via Oracle's Critical Patch Update for July 2026.

Unauthorized data access and denial of service in Oracle Mobile Application Server's MWA Terminal Server component (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a high-privileged attacker over HTTP. Successful exploitation grants complete read access to all data accessible by the Mobile Application Server, limited write capability (insert/update/delete on some data), and the ability to cause a complete, repeatable denial-of-service crash. The 'Authentication Bypass' tag in the intelligence data conflicts with the PR:H CVSS metric, suggesting the flaw may allow an authenticated administrator to bypass authorization controls beyond their intended access scope. No public exploit or CISA KEV listing has been identified at time of analysis.

Critical data exposure and tampering in Oracle Citizen Interaction Center (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a high-privileged, network-authenticated attacker to achieve full read and write access to all application data via HTTP. Despite the 'Authentication Bypass' tag, the CVSS PR:H metric indicates exploitation requires an already-authenticated high-privilege account, suggesting an internal authorization control bypass rather than an unauthenticated entry point. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed through Oracle's Critical Patch Update for July 2026.

The Search component of Oracle Knowledge Management in E-Business Suite versions 12.2.5 through 12.2.15 allows unauthenticated network attackers to compromise data confidentiality and integrity when a victim user interacts with a crafted HTTP request, with successful exploitation producing a scope change that can impact additional E-Business Suite products. Disclosed via Oracle's July 2026 Critical Patch Update, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) scores 6.1 and is consistent with a reflected injection class - likely Cross-Site Scripting - given the combination of no-privilege network access, required human interaction, and cross-product scope change. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthorized data disclosure in Oracle Price Protection (E-Business Suite versions 12.2.3 through 12.2.15) allows a network-adjacent, low-privileged attacker to gain complete read access to all pricing data accessible by the application. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass, suggesting that a legitimately authenticated but low-privileged session can circumvent authorization controls to reach confidential pricing records. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network reachability make it straightforward to exploit once credentials are obtained.

Oracle Interaction Blending within E-Business Suite exposes a network-accessible RMI interface flaw that allows a high-privileged attacker to partially compromise confidentiality, integrity, and availability of application data. Affected deployments span versions 12.2.3 through 12.2.15 of the Internal Operations component. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing it at low immediate operational priority despite the triple-impact scope.

Oracle iSupport versions 12.2.3 through 12.2.15 within Oracle E-Business Suite contain a vulnerability in the Internal Operations component that allows a highly privileged network attacker to fully compromise the affected application via HTTP. Successful exploitation results in complete confidentiality, integrity, and availability impact - described by Oracle as a full takeover of Oracle iSupport. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; disclosure occurred through Oracle's July 2026 Critical Patch Update.

Full takeover of Oracle iSupport (E-Business Suite versions 12.2.3-12.2.15) is achievable by a highly privileged remote attacker exploiting a flaw in the Internal Operations component via HTTP, resulting in complete compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score of 6.6 reflects the severity of the impact offset by high attack complexity and high privilege requirements, which meaningfully constrain the exploitable attacker population. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, making this a significant but operationally constrained risk for Oracle EBS deployments.

Unauthorized read access to critical data is possible in Oracle iStore (E-Business Suite Shopping Cart component, versions 12.2.3-12.2.15) via an authentication bypass condition exploitable by low-privileged network attackers over HTTP. The attack is rated difficult to exploit (AC:H), limiting opportunistic risk, but a successful attempt yields high confidentiality impact - complete access to all iStore-accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Oracle via their July 2026 Critical Patch Update.

Cross-site injection in Oracle iStore's Shopping Cart component (E-Business Suite versions 12.2.3-12.2.15) enables unauthenticated remote attackers to read a subset of iStore-accessible data and perform unauthorized data modifications, with a scope change indicating impact can extend to adjacent Oracle E-Business Suite modules. The attack requires victim interaction via HTTP but no credentials, and Oracle has published a fix in the July 2026 Critical Patch Update. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the vendor-assigned tag of 'Authentication Bypass' suggests the client-side injection may circumvent session-level controls beyond what the CVSS score alone implies.

Unauthorized data disclosure in Oracle Supply Chain Trading Connector (E-Business Suite versions 12.2.3 through 12.2.15) exposes all connector-accessible data to low-privileged authenticated network attackers via HTTP. The Collaboration History component fails to enforce proper authorization controls, enabling a valid but low-privileged account to read critical trading data beyond its intended scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and straightforward network vector make this a realistic insider or credential-compromise escalation path.

Oracle Supply Chain Trading Connector versions 12.2.3 through 12.2.15 expose the Collaboration History component to unauthorized data access and service degradation by any authenticated network user over HTTP. Low-privileged attackers can read a subset of accessible records and perform unauthorized inserts, updates, and deletes, as well as cause a partial denial of service. No public exploit code and no CISA KEV listing exist at time of analysis, but Oracle's own advisory classifies this as 'Easily exploitable,' indicating minimal preconditions beyond valid credentials.

Oracle Cost Management versions 12.2.3 through 12.2.15 (Cost Planning component) exposes a network-exploitable flaw enabling a high-privileged attacker to compromise full data confidentiality and integrity within the module, plus cause partial denial of service. Oracle's own CPU July 2026 advisory classifies this as difficult to exploit due to high attack complexity and elevated privilege prerequisites, yielding a medium CVSS 3.1 score of 6.2 despite high C/I impact ratings. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Integrity compromise in Oracle E-Business Intelligence (component: Definition) affects versions 12.2.3 through 12.2.15, disclosed as part of Oracle's Critical Patch Update July 2026. A network-accessible, high-privileged attacker who can also induce victim interaction may perform unauthorized insert, update, or delete operations on a subset of accessible E-Business Intelligence data. The CVSS base score of 2.0 reflects the highly constrained exploitation requirements: high attack complexity, high privilege level, and mandatory user interaction, all of which drastically limit real-world exploitation probability. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Cross-site scripting or client-side injection in Oracle E-Business Intelligence 12.2.3 through 12.2.15 enables unauthenticated remote attackers to read a subset of accessible data and perform unauthorized data modifications when a victim user interacts with a crafted HTTP request. The scope change (S:C in CVSS) indicates successful exploitation extends impact beyond the vulnerable component - characteristic of a browser-context attack such as reflected XSS through the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the tagging as 'Authentication Bypass' alongside PR:N merits close attention in enterprise deployments.

Oracle E-Business Intelligence versions 12.2.3 through 12.2.15 contains a flaw in its Internal Operations component that, under high-complexity conditions, permits a network-accessible highly privileged attacker to gain unauthorized read and write access to critical business intelligence data. Despite high confidentiality and integrity impact metrics, the overall CVSS 3.1 score of 5.9 reflects the mitigating effects of AC:H and PR:H, meaning exploitation is neither trivial nor broadly accessible. Notably, the 'Authentication Bypass' tag attached to this vulnerability is in tension with the PR:H CVSS metric, suggesting the bypass may circumvent a secondary authorization layer rather than the initial authentication mechanism - no public exploit or CISA KEV listing has been identified at time of analysis.

Oracle iSetup (versions 12.2.3 through 12.2.15), the General Ledger Update Transform and Reports component within Oracle E-Business Suite, allows a low-privileged authenticated attacker with network access via HTTP to bypass authorization controls and achieve complete confidentiality and integrity compromise of all iSetup-accessible data. Successful exploitation enables unauthorized read access to critical financial data and the ability to create, modify, or delete ledger records - a significant business risk in financial and compliance contexts despite the CVSS 3.1 medium score of 6.8. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.

Unauthorized data access in Oracle TeleSales (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to read, insert, update, or delete subsets of TeleSales data via HTTP without additional complexity. Tagged as an authentication bypass, the vulnerability likely represents an authorization control failure where a low-privilege account can exceed its intended data permissions within the Internal Operations component. No public exploit code or CISA KEV listing exists at time of analysis, but Oracle rates it 'easily exploitable' with low attack complexity.

Oracle Application Object Library (AOL), the Core component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exploitable over HTTP by low-privileged authenticated attackers with network access, resulting in partial unauthorized read access to AOL data, unauthorized data modification or insertion, and partial denial of service against AOL services. Oracle's July 2026 Critical Patch Update (CPU) addresses this vulnerability and classifies it as 'easily exploitable,' indicating limited technical barriers to exploitation. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the broad affected version range and low exploitation complexity elevate remediation priority for internet-facing EBS deployments.

Full takeover of Oracle Application Object Library in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a high-privileged local attacker exploiting a flaw in the AOL Generic Loader component. The CVSS vector (AV:L/AC:L/PR:H) confirms this is a local, infrastructure-level attack requiring existing privileged access to the host, yet yields complete confidentiality, integrity, and availability compromise once triggered. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.