Authentication Bypass

Full takeover of Oracle E-Business Suite's Pasta component (Internal Operations) is achievable by a high-privileged attacker with local logon access to the host infrastructure running versions 12.2.3 through 12.2.15. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the Pasta service, consistent with the tags noting Information Disclosure as a primary impact vector alongside full control. Patched in Oracle Critical Patch Update July 2026; no public exploit identified at time of analysis and the component is not listed in CISA KEV.

Local privilege abuse in Oracle E-Business Suite's Applications Technology Stack Configuration component exposes critical data to high-privileged local attackers across versions 12.2.3 through 12.2.15. The vulnerability allows an authenticated, high-privileged attacker with local infrastructure access to achieve both full confidentiality and integrity compromise of all data accessible to the Applications Technology Stack, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and the vulnerability is tagged as an authentication bypass despite the PR:H requirement - suggesting the bypass may escalate effective access beyond what the initial privilege level should permit.

Local privilege abuse in Oracle Applications DBA (E-Business Suite component: Internal Operations) allows a low-privileged authenticated user with local system access to achieve full confidentiality compromise of DBA-accessible data, with scope change enabling impact on additional Oracle products beyond the directly targeted component. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the E-Business Suite 12.2 release train. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle's own advisory classifies the vulnerability as 'easily exploitable,' lowering the bar for threat actors with local infrastructure access.

Oracle Enterprise Asset Management (EAM), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes an authentication bypass condition in the Internal Operations component that allows a low-privileged, network-authenticated attacker to read and tamper with a subset of EAM data. Despite the medium CVSS score of 4.2, the 'Authentication Bypass' tag signals that a legitimately low-privileged account can cross authorization boundaries within the application. No public exploit code exists and this vulnerability is not listed in CISA KEV, making it a moderate but non-urgent priority for most organizations.

Oracle Cost Management in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in the Internal Operations component, allowing a low-privileged remote attacker to gain unauthorized read and write access to sensitive cost management data over HTTP. The CVSS 3.1 score of 6.8 (C:H/I:H) reflects the potential for complete data exfiltration and manipulation - including creation, deletion, and modification of critical financial records - moderated by a High attack complexity that limits opportunistic targeting. No public exploit code or active exploitation has been identified at time of analysis.

Unauthorized data access and modification in Oracle Customer Interaction History (part of Oracle E-Business Suite) allows a network-adjacent low-privileged attacker to read a subset of confidential records and perform unauthorized insert, update, or delete operations via HTTP. Affected deployments span versions 12.2.3 through 12.2.15. The vulnerability was disclosed as part of Oracle's Critical Patch Update for July 2026; no public exploit or CISA KEV listing has been identified at time of analysis.

Unauthorized data access in Oracle Complex Maintenance, Repair and Overhaul (CMRO) versions 12.2.3 through 12.2.15 allows low-privileged authenticated attackers with HTTP network access to read a subset of CMRO application data and perform unauthorized insert, update, or delete operations against accessible records via the Common Utilities component. The vulnerability is tagged as an Authentication Bypass, suggesting that despite requiring a low-privileged account, exploitation circumvents authorization controls to access data beyond the attacker's sanctioned scope. No public exploit code or confirmed active exploitation has been identified at time of analysis; the issue was disclosed as part of Oracle's Critical Patch Update for July 2026.

Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) exposes an authentication bypass that permits low-privileged local users to read and modify CRM data beyond their authorized scope. The flaw requires an existing logon to the infrastructure hosting the application, constraining the attack surface to internal or compromised users rather than remote internet-based attackers. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.4 Medium rating reflects these limiting factors.

Local authentication bypass in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component) versions 22.3 through 26.5 allows a low-privileged attacker with infrastructure logon access to gain complete unauthorized read access to all CRM data, including critical records. The scope change in the CVSS vector confirms that exploitation can cascade to impact additional products integrated with the Siebel environment, amplifying data exposure beyond the initial target. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Unauthorized data access and manipulation is possible in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) via a flaw in the Siebel Cloud Manager component, tagged as an Authentication Bypass. An unauthenticated attacker positioned on the same physical network segment as the hosting hardware can, under high-complexity conditions, read a subset of accessible CRM data and perform unauthorized inserts or modifications. No confirmed active exploitation (CISA KEV) and no public proof-of-concept have been identified at time of analysis, and the CVSS 4.2 score accurately reflects the constrained adjacency and complexity requirements.

Full takeover of Oracle Universal Work Queue (versions 12.2.3 through 12.2.15) is achievable by a network-authenticated attacker with high administrative privileges exploiting a flaw in the Work Provider Site Level Administration component via HTTP. Despite requiring elevated credentials and high attack complexity, successful exploitation yields complete confidentiality, integrity, and availability compromise - effectively full system takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, and Oracle disclosed this through their July 2026 Critical Patch Update.

Oracle Site Hub's Site Hierarchy Flows component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes a medium-severity flaw accessible to low-privileged authenticated users over HTTP with no user interaction required. Successful exploitation yields partial unauthorized read access to Site Hub data, unauthorized insert, update, or delete capability against accessible data, and the ability to induce a partial denial of service within the application. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis; this vulnerability was disclosed as part of Oracle's July 2026 Critical Patch Update.

High-privileged network exploitation of Oracle Enterprise Asset Management's Internal Operations component allows unauthorized read and write access to critical EAM data across versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass by Oracle, the flaw requires an attacker who already holds high-level privileges to navigate high-complexity conditions over HTTP - suggesting an internal authorization bypass rather than a complete pre-auth bypass. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit or CISA KEV listing exists at time of analysis.

Cross-site scripting or authorization bypass in Oracle Enterprise Asset Management (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker to read a subset of accessible data and perform unauthorized write operations, with confirmed scope change that may impact additional E-Business Suite products. The attack is network-delivered via HTTP and requires a victim user to interact, consistent with a stored or reflected XSS-class injection despite the tag indicating authentication bypass. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the medium-severity tier warranting patch prioritization for internet-facing or multi-tenant E-Business Suite deployments.

Oracle E-Business Suite's Scheduler component (Rules UI) in versions 12.2.3 through 12.2.15 allows low-privileged, network-authenticated attackers to read restricted scheduling data, manipulate scheduling rules via unauthorized insert, update, or delete operations, and cause partial denial of service - all via HTTP without user interaction. Disclosed as part of Oracle's July 2026 Critical Patch Update, this vulnerability carries a CVSS 6.3 medium rating with no public exploit or CISA KEV listing identified at time of analysis.

Unauthorized access to sensitive federal financial data is possible in Oracle U.S. Federal Financials (versions 12.2.3-12.2.15, part of Oracle E-Business Suite) via a network-accessible authentication bypass in the Internal Operations component. An unauthenticated remote attacker with network access over HTTPS can, under high-complexity conditions, bypass authentication controls to read critical or complete confidential data - with scope change impact extending to additional E-Business Suite products beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag and scope-change designation elevate concern for federal agency deployments.

Cross-site injection in Oracle iSupport (E-Business Suite component) versions 12.2.3 through 12.2.15 enables unauthenticated remote attackers to compromise both iSupport and additional EBS components via HTTP. The CVSS scope change (S:C) combined with the 'Authentication Bypass' tag indicates the vulnerability can break out of iSupport's security boundary into adjacent Oracle EBS products, enabling unauthorized read and write access to application data. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires a victim user to interact with attacker-controlled content.

Unauthorized data manipulation in Oracle Applications Framework (Oracle E-Business Suite) versions 12.2.8 through 12.2.15 exposes the Upload Attachments component to low-privileged network attackers who can read and modify a subset of accessible application data. Exploitation requires human interaction from a third party, consistent with a cross-site request forgery or social-engineering-assisted vector. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 3.1 base score of 4.6 (Medium) reflects limited impact scope with no availability impact.

Unauthorized data disclosure in Oracle BI Publisher's XML Services component allows any low-privileged, network-authenticated attacker to access all data within the application via HTTP. Affected across three major release lines - 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 - the flaw carries a CVSS 3.1 score of 6.5 with high confidentiality impact and no integrity or availability dimension. The 'Authentication Bypass' tag suggests the vulnerability enables privilege escalation within the product's authorization model rather than a full pre-auth bypass; no public exploit or CISA KEV listing has been identified at time of analysis.

Integrity and partial availability compromise in Oracle PeopleSoft Enterprise HCM Global Payroll Mexico 9.2 is reachable by low-privileged network attackers over HTTP, though exploitation requires high complexity to trigger. Successful exploitation enables unauthorized creation, deletion, or modification of critical payroll data, as well as a partial denial of service against the Global Payroll Mexico component. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the Oracle CPU July 2026 advisory confirms the issue and presumably includes a patch.

Oracle PeopleSoft Enterprise HCM Human Resources 9.2 exposes a Security component flaw that enables a low-privileged, network-accessible attacker to bypass access controls via Oracle Net, resulting in complete confidentiality and integrity compromise of all HCM HR data. The vulnerability permits unauthorized creation, deletion, and modification of critical HR records alongside full read access to all accessible data within the system. No public exploit has been identified at time of analysis, and the CVSS AC:H designation indicates specific, undisclosed preconditions must be met for successful exploitation.

Local privilege escalation of data access in Oracle APEX's Installation component allows a low-privileged OS user to read all data accessible to the APEX platform. Affected versions are 24.1, 24.2, and 26.1. Despite the 'Authentication Bypass' tag suggesting a control-plane weakness during or after installation, exploitation is constrained to attackers with an existing local logon to the host infrastructure - no public exploit identified at time of analysis and no CISA KEV listing.

Authentication bypass in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 (Installation Security component) permits an unauthenticated attacker on the same physical network segment to partially read and modify data accessible to the application. Exploitation is constrained by high attack complexity and a mandatory user-interaction requirement, making opportunistic attacks highly impractical. No public exploit code exists and the vulnerability is not listed in CISA KEV; CVSS 3.7 (Low) accurately reflects the limited real-world threat.

Integrity compromise in JD Edwards EnterpriseOne Tools 9.2.26.3 allows a high-privileged local attacker to perform unauthorized creation, deletion, or modification of critical data - including all data accessible to the EnterpriseOne Tools platform - with a scope change that may extend impact to additional dependent products. The vulnerability resides in the Installation Security component and is tagged as an Authentication Bypass, suggesting the high-privilege requirement may be circumvented or bypassed under specific conditions. No public exploit code and no CISA KEV listing have been identified at time of analysis; this is a July 2026 Oracle Critical Patch Update disclosure.

Unauthenticated network-based authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 enables remote attackers to corrupt or destroy critical campus data and read a subset of accessible records via HTTP. The Security component flaw is tagged as an authentication bypass, with high integrity impact allowing unauthorized creation, deletion, and modification of critical data - a significant risk for higher education institutions relying on this system for student and community records. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's July 2026 CPU confirms the vulnerability and a patch release.

Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 exposes sensitive student and institutional data to unauthenticated remote attackers over HTTP. The Security component vulnerability allows a network-adjacent attacker to skip authentication controls and gain full read access to all Campus Community data, plus limited write access for inserts and deletes. No public exploit code exists and no CISA KEV listing has been observed, but the PR:N/C:H combination makes this a material confidentiality risk for higher education institutions running the affected version.

Full system takeover is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component, exploitable over HTTP by a high-privileged network attacker under high-complexity conditions. Successful exploitation yields complete compromise of confidentiality, integrity, and availability - effectively granting an attacker control over the affected instance. No public exploit code exists and the vulnerability is not listed in CISA KEV; Oracle disclosed this through its Critical Patch Update for July 2026.

Critical data exposure and unauthorized modification in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged, network-authenticated attacker to bypass access controls within the Commonline Loans component via HTTP. Successful exploitation yields complete read and write access to all financial aid data accessible to the application, including sensitive student loan records. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed.

Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows unauthenticated network attackers via HTTPS to access critical or complete application data through an authentication bypass in the Security component. Disclosed as part of Oracle's Critical Patch Update for July 2026, the CVSS 3.1 score of 5.9 (Medium) reflects high attack complexity (AC:H), meaning exploitation requires specific non-trivial conditions. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Unauthorized data access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows a low-privileged authenticated attacker to read all data accessible within the system via HTTPS against the Communication component. Tagged as an Authentication Bypass by EUVD intelligence, the flaw appears to operate at the authorization layer - an attacker with a valid low-privilege session can exceed their permitted data scope rather than bypass authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a credible insider or credential-theft-follow-on threat for higher education environments.

Local data integrity compromise in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 enables low-privileged users with logon access to the host infrastructure to bypass application-layer authorization controls within the Institutional Methodology Need Analysis component. Successful exploitation permits unauthorized creation, deletion, or modification of critical financial aid records and partial read access to accessible data. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; however, the low attack complexity makes exploitation straightforward for any insider or attacker with an existing host foothold.

Local unauthorized data access in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged authenticated user with logon access to the hosting infrastructure to compromise the FM Need Analysis Calculator component and read critical or complete financial aid data. The Authentication Bypass tag from EUVD-2026-46965 suggests the component fails to enforce authorization boundaries for already-authenticated low-privilege accounts, enabling horizontal or vertical privilege escalation within the application. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at the time of analysis.

Integrity compromise in Oracle PeopleSoft Enterprise FIN Common Objects 9.2 allows a low-privileged local attacker to perform unauthorized creation, deletion, or modification of critical financial data when human interaction from another user is obtained. The vulnerability resides in the Security component and carries a CVSS 3.1 base score of 4.4, reflecting high attack complexity and a local-only attack vector. No public exploit code or active exploitation has been identified at time of analysis, and Oracle has disclosed the issue via its July 2026 Critical Patch Update.

Local confidentiality exposure in Oracle PeopleSoft Enterprise FIN eSettlements 9.2 permits a high-privileged attacker with infrastructure-level logon access to read a subset of financial settlement data beyond their authorization. Disclosed via Oracle's July 2026 Critical Patch Update with a CVSS 3.1 score of 2.3 (Low), this vulnerability's real-world impact is significantly constrained by the local attack vector and high-privilege prerequisite. No active exploitation or public proof-of-concept has been identified at time of analysis.

Local information disclosure in Oracle PeopleSoft Enterprise FIN Pay/Bill Management 9.2 allows a low-privileged user with logon access to the hosting infrastructure to access all financial data within the Pay/Bill Management component. The vulnerability is tagged as an Authentication Bypass, suggesting a low-privileged account holder can circumvent internal access controls to read data beyond their authorization level. No public exploit code exists and it is not listed in the CISA KEV catalog, but the CVSS vector rates it as easily exploitable once local access is obtained.

Oracle Enterprise Asset Management (EAM) versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains an authorization control weakness in its Work Definition Issues component that permits low-privileged authenticated network attackers to partially compromise data integrity and confidentiality over HTTPS. Successful exploitation enables unauthorized read access to a subset of EAM-accessible data as well as unauthorized update, insert, or delete operations against EAM records. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the 'Authentication Bypass' intelligence tag suggests the flaw involves insufficient privilege enforcement within the Work Definition Issues component rather than a full pre-authentication bypass.

Oracle Project Foundation's Project Definition component in E-Business Suite versions 12.2.3 through 12.2.15 allows any low-privileged authenticated user to exploit HTTP-accessible endpoints, resulting in unauthorized read, insert, update, or delete of project data and partial denial of service. Disclosed in Oracle's Critical Patch Update for July 2026 and described by Oracle as 'easily exploitable,' the flaw's low attack complexity and absence of required user interaction broaden the practical attacker population to any valid EBS credential holder. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS signal is available from the provided intelligence.

Full takeover of Oracle MySQL Server and MySQL Cluster is achievable through the Server: Replication component by a highly privileged network attacker who can satisfy difficult exploitation conditions. Affected deployments include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, with complete confidentiality, integrity, and availability impact upon successful exploitation. Oracle disclosed this through the July 2026 Critical Patch Update; no public exploit identified at time of analysis.

Oracle Workflow's Notification Mailer component within E-Business Suite 12.2.3-12.2.15 is exploitable by network-authenticated low-privileged users to partially read, modify, and disrupt workflow data over HTTP without user interaction. The CVSS 3.1 score of 6.3 (Medium) reflects constrained but multi-dimensional CIA impact (C:L/I:L/A:L) with low attack complexity, making exploitation straightforward for any valid EBS account holder. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; remediation is available through the Oracle Critical Patch Update for July 2026.

Oracle Content Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite expose a medium-severity flaw in the Cover Letter component, exploitable by any low-privileged authenticated user over HTTP without user interaction. Successful exploitation allows unauthorized read access to a subset of Content Manager data, unauthorized insert/update/delete of accessible records, and partial denial of service against the component. No public exploit code and no CISA KEV listing have been identified at time of analysis; this vulnerability was disclosed as part of Oracle's July 2026 Critical Patch Update.

Partial confidentiality, integrity, and availability compromise in Oracle Partner Management's Partner Dashboard component (E-Business Suite 12.2.3-12.2.15) is reachable over HTTPS by any low-privileged account holder without user interaction. Successful exploitation allows unauthorized read access to a subset of partner data, unauthorized modification or insertion of records, and partial denial of service against the affected component. No public exploit code or CISA KEV listing exists at time of analysis; the July 2026 Oracle Critical Patch Update addresses the issue.

Network-exploitable integrity, confidentiality, and availability compromise in Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3 through 12.2.15) allows low-privileged authenticated attackers over HTTP to read, modify, or partially disrupt accessible data within the Web Service Provider component. Oracle rates this CVSS 6.3 Medium, with all three security pillars impacted at a low level and no scope change beyond the affected component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a credible threat for any internet- or intranet-reachable EBS deployment running the affected version range.

Oracle SDP Number Portability versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes a medium-severity flaw in its Installation sub-component that permits low-privileged authenticated network attackers to manipulate accessible data and partially disrupt service availability via HTTP. The CVSS 3.1 score of 5.4 reflects limited scope - no confidentiality impact and only partial integrity and availability degradation - with no confirmed active exploitation (not listed in CISA KEV) and no publicly available proof-of-concept at time of analysis. Oracle disclosed this vulnerability as part of the Critical Patch Update for July 2026, classifying it as 'easily exploitable' given the low attack complexity and absence of required user interaction.

MySQL Cluster's NDB Operator component allows a local, unauthenticated attacker with logon access to the infrastructure host to bypass authentication controls and gain complete read access to all MySQL Cluster data. Three active release lines are affected - 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1 - as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) together with the local-only access vector (AV:L) substantially constrain realistic exploitation, though the data-exposure consequence remains significant for environments handling sensitive workloads.

Unauthorized read access to all WebCenter Sites data is achievable by unauthenticated remote attackers via HTTP against Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 - two currently supported versions of Oracle Fusion Middleware's web content management component. The vulnerability is tagged as an Authentication Bypass requiring one-time victim interaction (UI:R), suggesting an attacker-controlled HTTP trigger that a legitimate user must initiate (e.g., by visiting a crafted URL or link), after which the attacker gains complete confidentiality access to all CMS data. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.

Unauthenticated remote exploitation of Oracle Advanced Pricing (E-Business Suite 12.2.3-12.2.15) via HTTP allows attackers to read and tamper with price list data without any credentials. The 'Authentication Bypass' tag and PR:N CVSS vector together confirm that the Price List component exposes sensitive pricing operations to the network without enforcing authentication. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a straightforward target for opportunistic actors with network access to the EBS HTTP interface.

Oracle Service Delivery Platform's Messaging Enabler component in versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged local users to perform unauthorized read and write operations on platform data, with a documented scope change that extends impact to additional co-deployed Oracle Fusion Middleware products. The vulnerability requires only a low-privileged local account on the hosting infrastructure, making insider threats and compromised service accounts the primary risk vector. No public exploit has been identified at time of analysis; this was disclosed as part of Oracle's July 2026 Critical Patch Update.

Partial data compromise and service disruption in Oracle Advanced Inbound Telephony 12.2.3-12.2.15 (SDK client integration component) is exploitable by a low-privileged attacker over HTTP without requiring user interaction. Successful exploitation allows unauthorized read access to a subset of telephony data, unauthorized insert, update, or delete operations on accessible data, and partial denial of service against the affected module. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS data was not available in the provided intelligence.

Unauthorized data exposure in Oracle Transportation Management 6.5.3 allows low-privileged remote attackers to read a subset of application data via HTTP, exploiting a flaw in the Authentication component. The vulnerability is tagged as an Authentication Bypass and is rated easily exploitable by Oracle, requiring only a low-privilege account and network access - no user interaction or complex conditions apply. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a constrained confidentiality-only impact.

Critical data exposure and unauthorized modification in Oracle Transportation Management 6.5.3 allows a high-privileged network attacker to fully compromise the confidentiality and integrity of all data accessible within the platform. The vulnerability resides in the Integration component, accessible over HTTP, and enables complete read and write access to sensitive supply chain data including shipment records, carrier contracts, and operational logistics data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 'Authentication Bypass' tag alongside PR:H CVSS metrics suggests an authorization bypass rather than a full authentication bypass - warranting close review of privileged account hygiene.

TimesTen In-Memory Database 26.1.1.1.0 contains a medium-severity flaw in its Kubernetes Operator component, exploitable by local high-privileged attackers to gain partial unauthorized read, write, and denial-of-service capability against database data. Critically, the CVSS scope change (S:C) signals that a successful attack may cascade to additional products sharing the Kubernetes cluster, elevating the real-world blast radius beyond the individual component score. No public exploit code and no CISA KEV listing have been identified at time of analysis; Oracle confirmed the issue in the July 2026 Critical Patch Update.

Confidentiality breach in Oracle TimesTen In-Memory Database 26.1.1.1.0 allows a low-privileged local attacker to gain complete read access to all database-accessible data through the Kubernetes Operator component via an authentication bypass. The scope-change CVSS metric indicates successful exploitation can cascade to co-located Kubernetes resources beyond the database itself. No public exploit or CISA KEV listing exists; exploitation is constrained by the requirement of local infrastructure access and high attack complexity, making this a post-compromise or insider-threat vector rather than a remote exposure.

Local authentication bypass in the Kubernetes Operator component of Oracle TimesTen In-Memory Database 26.1.1.1.0 allows a low-privileged attacker with infrastructure access to read all data managed by the database, including critical application data. The CVSS scope change (S:C) confirms that exploitation can cascade beyond the target instance, impacting additional workloads or containers sharing the Kubernetes environment - a meaningful amplifier in multi-tenant deployments. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the Authentication Bypass tag suggests the Operator fails to enforce access controls on a locally accessible interface or API, making exploitation straightforward once infrastructure access is established.

Unauthorized data manipulation via authentication bypass in Oracle Siebel CRM Integration's Siebel Server Sync for Exchange component allows unauthenticated remote attackers to insert, update, or delete a subset of CRM-accessible data over HTTP. All versions from 17.0 through 26.5 are affected, with exploitation constrained by high attack complexity that substantially reduces real-world risk. No public exploit code or active exploitation has been identified at time of analysis, consistent with the low CVSS score of 3.7 reflecting limited, integrity-only impact.

Partial data disclosure in Oracle JDeveloper's ADF Faces component (versions 12.2.1.4.0 and 14.1.2.0.0) allows low-privileged network-authenticated attackers to read a subset of JDeveloper-accessible data via crafted HTTP requests. Despite the 'Authentication Bypass' tag, the CVSS PR:L metric confirms full authentication is required - the bypass is best understood as an authorization or access-control bypass within ADF Faces rather than full session bypass. No public exploit has been identified and no CISA KEV listing exists; the low CVSS score of 3.1 reflects high exploit complexity and limited impact scope.

Oracle JDeveloper's ADF Faces component on versions 12.2.1.4.0 and 14.1.2.0.0 is susceptible to an authentication bypass exploitable over HTTP by unauthenticated network attackers. Successful exploitation yields partial unauthorized read and write/insert/delete access to data accessible within the JDeveloper context - confidentiality and integrity are both impacted at a limited scope. No public exploit has been identified at time of analysis, and the CVSS AC:H rating indicates meaningful technical barriers to exploitation, reducing the practical threat level despite the unauthenticated attack vector.

Local authentication bypass in Oracle JDeveloper's ADF Faces component exposes critical data to low-privileged local users on versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope change (S:C) indicates successful exploitation can extend beyond JDeveloper itself to impact additional Oracle Fusion Middleware products sharing the same infrastructure. No public exploit has been identified at time of analysis, and neither EPSS data nor a CISA KEV listing is available - however, the low attack complexity and no user interaction requirement make exploitation straightforward once local access is established.

Oracle JDeveloper's Java Business Objects component exposes a network-accessible confidentiality and availability flaw in versions 12.2.1.4.0 and 14.1.2.0.0, allowing low-privileged remote attackers to gain unauthorized access to critical or all JDeveloper-accessible data alongside a partial denial of service. The attack complexity is rated high, requiring specific conditions to be met, but no user interaction is needed beyond initial low-privilege authentication. No public exploit code or active exploitation has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.

Unauthenticated network exploitation of the ADF Faces component in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 enables complete confidentiality compromise of all data accessible within the IDE environment via HTTP. Tagged explicitly as an Authentication Bypass by Oracle's security team (secalert_us@oracle.com), the flaw allows a remote attacker with no credentials to circumvent access controls, though the CVSS AC:H rating constrains opportunistic exploitation by requiring attacker-controlled preconditions to be met. No public exploit or CISA KEV listing exists at time of analysis, and the impact is limited strictly to data exfiltration - no integrity or availability risk is present.

Local privilege abuse in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 allows a low-privileged attacker with infrastructure logon access to perform unauthorized data modifications and induce a partial denial of service against the Enterprise Infrastructure Security component. The attack complexity is rated High, meaning specific conditions beyond the attacker's direct control must be met. No public exploit code exists and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, placing it in a low operational risk tier despite the ERP-critical nature of the platform.

Partial denial of service in JD Edwards EnterpriseOne Tools 9.2.26.3 is achievable by an unauthenticated remote attacker via the JDENET protocol, specifically through the Interoperability Security component. The vulnerability carries a low CVSS base score of 3.7 driven by high attack complexity and limited availability-only impact, with no confidentiality or integrity consequences. No public exploit code or active exploitation has been identified at time of analysis, placing this at low operational priority for most organizations.

Unauthorized data access and manipulation in the French HR Payroll component of Oracle HRMS (France) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a network-based, low-privileged authenticated attacker to read, insert, update, or delete sensitive payroll data via HTTP. The 'Authentication Bypass' tag from multi-source intelligence suggests the root mechanism involves insufficient authorization controls within the payroll component, enabling privilege escalation beyond the attacker's assigned role. No confirmed active exploitation (KEV) or public exploit code exists at time of analysis, but the sensitivity of French HR payroll data - salaries, tax records, employee details - elevates real-world business risk well above what the moderate CVSS score of 5.4 alone conveys.

Oracle Project Manufacturing V16's PJM Command Center component exposes a low-severity local vulnerability requiring infrastructure-level access and high attack complexity. A low-privileged attacker with logon access to the host infrastructure can, under difficult exploitation conditions, perform unauthorized data modification or deletion against accessible Project Manufacturing records and induce a partial denial of service against the component. No public exploit code exists and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, placing practical risk well below the already-low CVSS score of 3.6 suggests.

Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component, part of Oracle E-Business Suite) permits a highly privileged, locally authenticated attacker to bypass access controls and gain unauthorized read access to all Oracle Project Manufacturing data as well as limited write access. The CVSS vector (AV:L/AC:H/PR:H) confirms this is neither remotely exploitable nor accessible to low-privileged users, substantially constraining real-world impact despite the High confidentiality impact rating. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component of Oracle E-Business Suite) enables a high-privileged attacker with local infrastructure access to achieve unauthorized read and write access to critical application data. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector explicitly requires high privileges (PR:H) and local access (AV:L), suggesting the bypass operates within application-layer authorization controls rather than at the authentication perimeter. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Full takeover of Oracle MySQL Server and MySQL Cluster is achievable by a high-privileged local attacker exploiting a flaw in the Group Replication Group Communication System (GCS) component across multiple supported release trains. Affected deployments span MySQL Server 8.4.x and 9.7.x, and MySQL Cluster 8.0.x, 8.4.x, and 9.7.x. Despite the CVSS score of 6.4 being mid-range, the CIA impact triple (C:H/I:H/A:H) indicates complete compromise of the database instance; however, the local attack vector (AV:L), high complexity (AC:H), and high privilege requirement (PR:H) substantially constrain real-world exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.

Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit flaw in the Server: Replication component, affecting MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Despite a moderate CVSS base score of 6.4, the impact triad is complete (C:H/I:H/A:H), meaning successful exploitation grants an attacker full control over data confidentiality, integrity, and service availability. No public exploit code exists and no confirmed active exploitation has been identified at time of analysis, with exploitation gated by local infrastructure access and high privilege requirements.

Cross-origin resource sharing controls in Netty's CorsHandler can be entirely bypassed by sending an `Origin: null` header, due to a logical operator error in the origin evaluation path. Affected are Netty 4.1.0.Final through 4.1.135.Final and 4.2.0.Final through 4.2.15.Final - a range spanning years of releases across both major active branches. An unauthenticated remote attacker who can induce a victim to initiate a cross-origin request can bypass the `shortCircuit()` enforcement entirely, causing unauthorized requests to be forwarded to the backend application as if they were permitted. No public exploit or KEV listing is identified at time of analysis, but the bypass mechanism is straightforward and vendor-confirmed.

Public-only personal access token scope enforcement in Gitea's REST API is inconsistently applied across two organization endpoints, allowing a token holder to enumerate private organization memberships and retrieve detailed permission data (ownership, admin status, write access, repository-creation capability) that the public-only restriction was explicitly designed to block. All Gitea versions prior to 1.27.0 are affected via GET /api/v1/user/orgs and GET /api/v1/users/{username}/orgs/{org}/permissions. Publicly available exploit code with full HTTP request/response traces is confirmed in the GHSA advisory; no CISA KEV listing exists, indicating no confirmed opportunistic mass exploitation at time of analysis.

Incorrect authorization enforcement in Gitea's team API routes exposes private repository metadata and activity feed entries to public-only access tokens. Affected versions through 1.26.2 allow an authenticated team member holding a public-only scoped token to bypass the intended access restriction and retrieve private team repository listings and private activity feed data via /api/v1/teams/{id} endpoints. Publicly available exploit code (PoC) has been verified against Gitea 1.26.2 and nightly builds; no KEV listing at time of analysis. EPSS data not provided, but the CVSS score of 4.3 and limited confidentiality impact (metadata only, no code exfiltration) suggest moderate real-world risk.

Unauthenticated remote data exposure and manipulation affects Oracle Applications Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite, via the Oracle Diagnostics Interfaces component. An attacker with HTTP network access can bypass authentication to read a subset of OAM-accessible data and perform unauthorized insert, update, or delete operations against OAM data - no credentials or user interaction required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the low attack complexity and unauthenticated vector raise real-world concern for internet-facing or poorly segmented EBS deployments.

Oracle Project Manufacturing V16 (PJM Command Center component) exposes a local privilege-abuse flaw allowing a high-privileged attacker with infrastructure logon access to bypass authorization controls and gain unauthorized read and write access to all Project Manufacturing data. The CVSS vector (AV:L/AC:H/PR:H) constrains real-world risk significantly - exploitation requires existing elevated access on the host infrastructure and high attack complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping this vulnerability in a watchlist rather than emergency-response category for most organizations.

Local privilege escalation in Oracle Data Integrator's Patchset Assistant component allows low-privileged users with host logon access to bypass internal authorization controls and gain complete read access to all data accessible by the ODI process across versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope change designation (S:C) confirms that successful exploitation can cascade beyond ODI itself to impact additional Oracle Fusion Middleware products and any data systems connected through ODI integration pipelines. No public exploit code has been identified at time of analysis, and exploitation is constrained to attackers with existing local host access.

Unauthorized data access and modification in Oracle Performance Management (E-Business Suite Appraisals component, versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated user with HTTP network access. The flaw enables partial reads of restricted appraisal data and unauthorized insert, update, or delete operations within the accessible data scope - an insider threat or compromised low-privilege account scenario. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing real-world urgency at moderate levels for enterprises running Oracle E-Business Suite with the Performance Management module active.

Denial of service in Oracle Coherence's Core component allows a low-privileged network attacker to cause a hang or repeatable crash of the service via TCP, affecting all four currently supported release lines (12.2.1.4.0 through 15.1.1.0.0). Oracle classifies this as easily exploitable - low attack complexity and no user interaction required - making it accessible to any authenticated user with TCP connectivity to the cluster. No public exploit has been identified at time of analysis, and Oracle disclosed this through its July 2026 Critical Patch Update; the CVE is not listed in CISA KEV.

Unauthorized data access in Oracle Coherence allows a low-privileged, network-adjacent attacker to read, insert, update, or delete data within the Coherence data grid via TCP. Affected versions span the current supported lifecycle: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Despite a moderate CVSS score of 5.4, the 'easily exploitable' descriptor and Authentication Bypass tag suggest the barrier to exploitation is low once an attacker holds any valid low-privileged credential or session token - making this a meaningful data integrity and confidentiality risk in multi-tenant or externally-accessible Coherence deployments. No public exploit code or CISA KEV listing identified at time of analysis.

Oracle Coherence's Core component across all currently-supported Fusion Middleware releases is exploitable by high-privileged network attackers over HTTP to exfiltrate critical in-memory grid data and perform limited unauthorized data modification. Intelligence sources tag this as an authentication bypass class issue, suggesting that a legitimate high-privileged account can circumvent Coherence's internal data-scope access controls to reach data partitions or records beyond its authorized boundary. No public exploit code exists and the vulnerability does not appear in the CISA KEV catalog at time of analysis, placing this in the planned-maintenance remediation tier rather than emergency response.

Unauthenticated confidentiality breach in Oracle Coherence's Core component exposes complete cached data over TLS to network attackers across all current supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The flaw is tagged as an Authentication Bypass, allowing a remote unauthenticated attacker reachable via TLS to read all data accessible within the Coherence grid - including potentially sensitive application state, session data, and business records. No active exploitation is confirmed (not in CISA KEV) and no public exploit code exists at time of analysis; however, the PR:N/UI:N profile combined with complete confidentiality loss makes this a material concern for enterprises running exposed Coherence clusters.

Oracle Coherence Core in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 exposes a confidentiality flaw that allows a high-privileged local attacker to gain complete unauthorized read access to all data accessible by the Coherence service, with scope change potential extending that breach to additional Oracle Fusion Middleware products sharing the same infrastructure. The CVSS scope change metric (S:C) is the most operationally significant signal here - exploitation is not contained within Oracle Coherence and may expose data in adjacent Oracle products. No public exploit code and no CISA KEV listing exist at time of analysis, and the local attack vector with high-privilege prerequisite significantly constrains real-world exploitability to insider threat or post-compromise scenarios.

Unauthenticated network exploitation of Oracle Coherence's Core component via HTTP allows partial unauthorized read and write access to Coherence-managed data, with a confirmed scope change indicating impact can extend to additional products beyond the directly targeted instance. Affecting four supported versions (12.2.1.4.0 through 15.1.1.0.0), the flaw is tagged as an Authentication Bypass, suggesting the HTTP-facing interface can be accessed without valid credentials under high-complexity attack conditions. No public exploit code has been identified at time of analysis, and Oracle disclosed this through its July 2026 Critical Patch Update.

Oracle Coherence (Core component) across all currently supported versions exposes authenticated low-privileged network attackers to unauthorized data access and manipulation over HTTP, enabling both partial read access and unauthorized insert, update, or delete operations on Coherence-accessible cached data. Disclosed as part of Oracle's July 2026 Critical Patch Update, this medium-severity flaw is tagged as an Authentication Bypass, suggesting that a low-privileged credential confers data access beyond its intended authorization scope rather than enforcing proper boundary controls. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction mean exploitation is straightforward for any attacker holding valid Coherence credentials.

Denial of service in Oracle MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged authenticated attacker to cause a complete, repeatable crash or hang of the database service by exploiting a flaw in the Server: JSON Duality component over any supported network protocol. The vulnerability is rated medium severity (CVSS 4.9) due to the high privilege prerequisite, limiting real-world exposure primarily to environments where privileged credentials have been compromised or where insider threat is a concern. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Denial of service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a high-privileged network attacker to cause a complete hang or repeatable crash of the database server via the JSON Duality component. The vulnerability is rated CVSS 4.9, with the PR:H requirement substantially limiting real-world exposure to authenticated administrators or compromised high-privilege accounts. No public exploit code or active exploitation has been identified at time of analysis.

Denial-of-service exposure in MySQL Server and MySQL Cluster's Replication component allows a high-privileged local attacker to repeatedly crash or hang the database service under difficult-to-reproduce conditions. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit code or active exploitation has been identified at time of analysis.

Partial denial-of-service in Oracle MySQL Server and MySQL Cluster's Replication component affects multiple supported release lines, exploitable only by highly privileged, authenticated attackers over the network under difficult conditions. The attack yields only a partial availability impact with no confidentiality or integrity exposure, and no public exploit code has been identified at time of analysis. Given the CVSS score of 2.2 and the combination of high complexity and high privilege requirements, this represents a low-priority, low-impact finding in the context of Oracle's July 2026 Critical Patch Update.

Denial of service in Oracle MySQL Server and MySQL Cluster's Replication component allows a high-privileged network attacker to cause a complete, repeatable crash or hang of the database service. Affected are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis; the CVSS 3.1 score of 4.4 (Medium) accurately reflects the high privilege requirement and elevated attack complexity that substantially constrain real-world risk.

Denial of service in Oracle MySQL Server and MySQL Cluster's replication component allows a high-privileged network attacker to cause a complete hang or repeatedly crash the database server. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code and no confirmed active exploitation have been identified; the high privilege and high complexity requirements substantially constrain real-world risk to insider threats or compromised DBA-level accounts.

Full takeover of MySQL Server and MySQL Cluster 9.7.0-9.7.1 is achievable via a local, low-privileged attacker exploiting a flaw in the Server: Configurator component, provided a second user interacts during the attack window. The CVSS 3.1 score of 6.7 reflects the high attack complexity and local-only vector, which meaningfully constrain real-world exploitability despite the high-impact outcome (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent.

Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit vulnerability in the Clone Plugin component, requiring a high-privileged attacker with network access via multiple protocols. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is tempered by the AC:H/PR:H exploitation prerequisites, though the full CIA:H/H/H impact warrants priority patching in environments using the Clone Plugin.

Full takeover of Oracle Autonomous Health Framework is achievable by a highly privileged local attacker under difficult exploitation conditions in versions 26.0.0 through 26.2.0, specifically within the Developer triaging platform component. Successful exploitation requires both high infrastructure privileges and active human interaction from a separate user, making opportunistic attacks unlikely. No public exploit code or CISA KEV listing has been identified; this vulnerability appears to be a low-frequency, targeted risk rather than a widespread exploitation concern.