Authentication Bypass

Oracle Application Testing Suite 13.3.0.1 exposes a network-accessible vulnerability allowing low-privileged attackers holding the Load Testing for Web Apps role to achieve unauthorized complete read access to critical data and limited write access through HTTP-based exploitation that requires victim interaction. The attack carries a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle products beyond the testing suite itself. No public exploit code has been identified and CISA KEV listing is absent, though the low attack complexity and network accessibility make this a credible targeted threat for any environment running this specific version.

Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by any low-privileged attacker holding the 'Load Testing for Web Apps' role via a network-accessible HTTPS vector. Oracle's own advisory classifies this as 'easily exploitable,' with complete confidentiality, integrity, and availability impact resulting in system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and broad CIA impact make this a credible priority for affected deployments.

Unauthenticated remote compromise of Oracle Application Testing Suite 13.3.0.1 allows a network attacker to read, create, modify, or delete all data accessible to the application over HTTP with no credentials or user interaction. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact (no availability impact), and tagged as an authentication bypass, this is a pre-auth flaw fixed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full takeover of PeopleSoft Enterprise FIN Common Objects Brazil 9.1 is achievable by a high-privileged attacker with network access using Oracle's T3 or IIOP protocols. The vulnerability carries a CVSS 3.1 score of 7.2, reflecting complete confidentiality, integrity, and availability impact despite the PR:H prerequisite. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though Oracle's August 2026 Critical Patch Update advisory addresses it.

Full takeover of Oracle Siebel CRM Integration (versions 17.0-26.6) is achievable by a low-privileged authenticated attacker over HTTP, exploiting a flaw in the REST component. The CVSS scope change (S:C) means successful exploitation can pivot beyond the directly targeted service, potentially compromising additional Oracle or backend systems. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog; however, the C:H/I:H/A:H impact triad warrants prioritized patching for organizations running Siebel in enterprise environments.

Remote exploitation of Oracle WebCenter Content's Content Server component allows unauthenticated network attackers to compromise confidentiality, integrity, and availability of the platform when a victim user interacts with a malicious payload delivered over HTTP. Both actively supported versions - 12.2.1.4.0 and 14.1.2.0.0 - are affected, and successful exploitation produces a scope change, meaning impacts can propagate beyond the directly targeted WebCenter Content instance to adjacent products within the Fusion Middleware stack. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a credible threat in internet-exposed deployments.

Oracle Siebel CRM End User versions 17.0 through 26.6 expose a network-exploitable flaw in the Open UI component that, when triggered via a crafted HTTPS interaction, grants a low-privileged attacker full read and write access to critical CRM data - including complete confidentiality and integrity compromise with a documented scope change to additional products. The 'Authentication Bypass' tag reported by Oracle's security team suggests the Open UI layer can be manipulated to circumvent access controls in the context of an authenticated victim's session. No exploit code is publicly available and the vulnerability is not listed in the CISA KEV catalog at the time of analysis.

Full system takeover of Oracle Siebel CRM Deployment (versions 17.0 through 26.6) is achievable by unauthenticated remote attackers via HTTP, targeting the Migration component. The attack requires human interaction from a victim - a social engineering or luring condition that constrains opportunistic exploitation - but successful exploitation results in complete compromise of confidentiality, integrity, and availability of the Siebel CRM Deployment instance. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.

Cross-boundary compromise in Oracle Siebel CRM's Siebel Apps - Self Service module (Helpdesk/Training component, versions 17.0 through 26.6) lets an unauthenticated remote attacker fully read and modify all data accessible to the application after luring a legitimate user into interacting with a crafted HTTP request. Because the CVSS vector carries a scope change (S:C), successful exploitation can significantly impact products beyond Siebel itself, and the vendor/analyst tagging as an 'Authentication Bypass' reinforces the high confidentiality and integrity risk. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.3 base score and network-facing, unauthenticated nature make it a top-tier patch priority.

Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allow a remote, unauthenticated attacker to reach the application over HTTP and create, modify, or delete critical data as well as trigger a complete, repeatable crash. Oracle rates this CVSS 9.1 (I:H/A:H, no confidentiality impact), reflecting an easily exploitable network-facing flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch item.

Remote unauthorized data access in Oracle Demand Planning versions 12.1 and 12.2 enables unauthenticated network attackers over HTTP to read all data accessible to the application and perform limited unauthorized write operations, with no authentication, elevated privileges, or user interaction required. Tagged as an authentication bypass by Oracle's own security team, this flaw carries a CVSS 3.1 base score of 8.2, reflecting high confidentiality and low integrity impact with no availability component. No public exploit code has been identified at the time of analysis, though the low attack complexity and complete absence of authentication barriers make this a straightforward target for automated or opportunistic exploitation once a proof-of-concept surfaces.

Privilege-leveraging compromise of Oracle Demand Planning (Internal Operations component) in Oracle Supply Chain / E-Business Suite versions 12.1 and 12.2 lets a low-privileged attacker with HTTP network access read and modify all data reachable by the module. Because the CVSS scope is Changed (S:C), successful attacks can extend impact beyond Demand Planning to additional connected products. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the 9.6 base score and low attack complexity make it a high-priority patch.

Oracle Loans 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes its Internal Operations component to network-based exploitation by low-privileged authenticated attackers over HTTP. Successful exploitation grants unauthorized ability to create, delete, or modify critical data across all Oracle Loans accessible records, and can induce a partial denial of service against the application. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and broad affected version range (12.2.3-12.2.15) make this a notable priority for Oracle EBS deployments.

Oracle Loans within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes all loan records to network-authenticated low-privileged users through an authorization control failure in the Internal Operations component. A low-privileged attacker with HTTP network access can read the complete Oracle Loans dataset and perform unauthorized inserts or updates on a subset of that data, without requiring elevated credentials or any victim interaction. No public exploit code has been identified at time of analysis, and Oracle has addressed this vulnerability in the August 2026 Critical Patch Update.

Local privilege escalation with scope change in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged authenticated user on the host system to bypass security controls within the Security component, achieving complete unauthorized read and write access to all application data. The CVSS scope change (S:C) means successful exploitation can cascade into additional Oracle products sharing the same infrastructure, amplifying the blast radius beyond the immediate application. No public exploit code or CISA KEV listing exists at time of analysis; the vulnerability was disclosed through Oracle's Critical Security Patch Update for August 2026.

Local privilege escalation in Oracle Hyperion Financial Management 11.2.25.0.000 enables low-privileged authenticated host users to fully compromise the application's confidentiality and data integrity via a flaw in the Security component. Critically, the CVSS scope change indicator (S:C) signals that successful exploitation may cascade beyond the HFM application boundary to impact additional co-hosted Oracle products. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of required user interaction make exploitation straightforward for any attacker holding a valid local system account.

Unauthorized data access in Oracle Financials for EMEA (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-accessible attacker to exfiltrate critical financial data and perform limited data manipulation via HTTP. The 'Authentication Bypass' tag from ENISA EUVD suggests the flaw in the Internal Operations component permits privilege escalation beyond what the authenticated identity should authorize - effectively letting a standard user reach data reserved for higher roles. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across a financial ERP increase urgency for EMEA-facing Oracle deployments.

Authenticated low-privileged network exploitation of Oracle Financials for Asia/Pacific (versions 12.2.3-12.2.15) enables unauthorized creation, deletion, or modification of critical financial data, with partial read access to additional records. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is reachable over HTTP without user interaction. No public exploit or active KEV listing has been identified at time of analysis, though Oracle classifies it as 'easily exploitable,' and the 'Authentication Bypass' tag suggests the low-privilege requirement may be bypassed or trivially satisfied under certain conditions.

Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to compromise the Internal Operations component via HTTP, resulting in full read access to and arbitrary creation, modification, or deletion of all iRecruitment-accessible data. Tagged as an Authentication Bypass class vulnerability, the flaw enables an attacker with minimal account privileges to exceed their authorization boundary - likely bypassing object-level access controls within the HR recruitment workflow. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; remediation is available via Oracle's Critical Security Patch Update (CPU) for August 2026.

Full system takeover in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged attacker with HTTP network access, exploiting a flaw in the Security component. Oracle's own description characterizes the outcome as complete compromise, with CVSS 3.1 confirming full confidentiality, integrity, and availability impact (C:H/I:H/A:H), making this more severe than the accompanying 'Information Disclosure' tag suggests. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthorized data access and partial data manipulation in Oracle Landed Cost Management (versions 12.2.3 through 12.2.15) is exploitable by low-privileged, network-accessible attackers via HTTP, with no user interaction required. Tagged as an Authentication Bypass, the vulnerability in the Internal Operations component allows an authenticated low-privilege user to exceed their authorization, gaining complete read access to all data accessible by the module and limited write/insert/delete capability. No public exploit has been identified at time of analysis and the flaw is not listed in the CISA KEV catalog.

Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable via HTTP due to a failure in the Security component's authentication enforcement. Tagged as an authentication bypass, the flaw allows any network-reachable attacker with no credentials or user interaction to access all data within the application's scope, carrying a CVSS 3.1 score of 7.5 (High) reflecting complete confidentiality compromise. No public exploit code or confirmed active exploitation has been identified at the time of analysis, though the low attack complexity lowers the practical barrier for capable adversaries who can reach the service.

Oracle Process Manufacturing Systems (OPM), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes a high-severity authenticated network vulnerability in the Internal Operations component that allows low-privileged attackers to both read and manipulate critical data. The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impact with no availability impact, exploitable over HTTP without user interaction. Tagged as an Authentication Bypass, this vulnerability is described as 'easily exploitable,' raising the effective risk for any organization running unpatched OPM installations; no public exploit or CISA KEV listing has been identified at time of analysis.

Full system takeover is possible in Oracle Process Manufacturing Systems (OPM), an Oracle E-Business Suite component, via a network-accessible flaw in the Internal Operations sub-component affecting versions 12.2.3 through 12.2.15. A low-privileged attacker operating over HTTP can, under high-complexity conditions, compromise confidentiality, integrity, and availability simultaneously - Oracle's own language is 'takeover of Oracle Process Manufacturing Systems.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope of impact makes this a priority patch target for manufacturing-sector organizations running Oracle EBS. Oracle addressed this in the Critical Patch Update for August 2026.

Complete data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a network-accessible, low-privileged authenticated attacker to bypass security controls within the application's Security component and gain unauthorized read access to all data the application can reach. The scope change (S:C) in the CVSS vector signals that successful exploitation may expose data beyond the HFM instance itself, potentially impacting other integrated Oracle Hyperion suite components. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low attack complexity and the Authentication Bypass tag make this a practical risk for any organization running this CPM platform.

Unauthorized data disclosure in Oracle MES for Process Manufacturing (versions 12.2.3-12.2.15) allows a low-privileged attacker with network HTTP access to bypass internal authorization controls and gain complete access to all data accessible by the MES component. The scope change (S:C in CVSS) means successful exploitation can cascade into other Oracle E-Business Suite products, amplifying the confidentiality impact beyond the MES module itself. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; however, the 'Authentication Bypass' tag, low attack complexity, and no required user interaction make this a credible risk in exposed enterprise EBS deployments.

Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 exposes critical financial data to unauthenticated network attackers via HTTPS. The Security component flaw - tagged explicitly as an authentication bypass by Oracle - allows complete read and write access to all data within the application, including sensitive financial consolidation records. No public exploit or CISA KEV listing is confirmed at time of analysis, and the high attack complexity (AC:H) limits opportunistic mass exploitation, but the unauthenticated network vector and dual high-severity impact on both confidentiality and integrity make this a serious priority for organizations running this version.

Unauthenticated remote information disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 exposes the complete data set accessible to the application via HTTP. The Security component contains an authentication bypass weakness that allows a network-adjacent attacker with no credentials to retrieve critical financial data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to target.

Full system takeover of Oracle Call Center Technology (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged attacker with network access over HTTP targeting the Internal Operations component. The vulnerability is rated 7.2 CVSS 3.1 with complete Confidentiality, Integrity, and Availability impacts, meaning successful exploitation yields effective control of the affected instance. No public exploit code has been identified at time of analysis, and the requirement for high-privilege credentials is the primary limiting factor constraining real-world exposure.

Oracle Hyperion Financial Management 11.2.25.0.000 is vulnerable to full system takeover via a SQL-based attack against its Security component, exploitable by any low-privileged network-authenticated user. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability with no user interaction required beyond holding basic credentials. Oracle disclosed this as part of its August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.

SQL-based network exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged authenticated attacker to fully compromise the application, achieving complete confidentiality, integrity, and availability impact. The vulnerability resides in the Security component and is exploitable with low attack complexity and no user interaction required, making it a reliable attack path for any threat actor holding valid credentials. No public exploit code or active exploitation has been identified at time of analysis.

Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated attacker with HTTP network access to fully compromise the application. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and per the CVSS vector requires no privileges or user interaction, making it a prime candidate for opportunistic exploitation. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; despite the Oracle-supplied 'Information Disclosure' tag, the CVSS I:H/A:H metrics and 'takeover' language indicate impact well beyond disclosure.

Oracle Financials for EMEA (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to gain unauthorized read access to critical financial data and perform limited unauthorized write operations via HTTP. The vulnerability resides in the Internal Operations component and, despite requiring an existing account, carries a High confidentiality impact given the sensitivity of EMEA financial records involved. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the low attack complexity and absence of user-interaction requirements make this a realistic post-authentication privilege escalation path.

Oracle Internet Procurement Connector in E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated network attackers to fully compromise data confidentiality and integrity within the connector via HTTP. Tagged as an authentication bypass by ENISA EUVD (EUVD-2026-61766), the flaw enables unauthorized creation, modification, deletion, and exfiltration of all connector-accessible data with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's own characterization as 'easily exploitable' combined with low attack complexity and network accessibility make this a credible remediation priority for organizations running Oracle E-Business Suite.

Full system takeover of Oracle Call Center Technology - a component of Oracle E-Business Suite - is achievable by unauthenticated remote attackers via HTTP across versions 12.2.3 through 12.2.15, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The high attack complexity (AC:H) designation indicates that exploitation requires satisfying non-trivial preconditions beyond mere network reachability, but no authentication or user interaction is necessary, keeping the attack surface entirely external. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Full system takeover is achievable in Oracle Call Center Technology (versions 12.2.3-12.2.15) by a low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The vendor describes this as 'easily exploitable' and confirms full Confidentiality, Integrity, and Availability compromise - consistent with a CVSS 8.8 High rating and system takeover outcome. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal privilege threshold lower the bar for exploitation significantly. Notably, the vulnerability tag 'Information Disclosure' understates the confirmed impact scope, which extends to full takeover.

Oracle Call Center Technology versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes a flaw in the Internal Operations component that allows a low-privileged authenticated network attacker to fully compromise the affected system via HTTP. The vendor-assigned CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability - consistent with the described 'takeover' outcome. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.

Oracle Purchasing versions 12.2.5 through 12.2.15 within Oracle E-Business Suite expose an authorization bypass flaw in the Internal Operations component, allowing any authenticated low-privileged network user to gain complete read access to all purchasing data and perform unauthorized creation, deletion, or modification of critical records. Tagged as an Authentication Bypass by ENISA EUVD-2026-61762, the vulnerability is exploitable over HTTP with no user interaction and low attack complexity, making it a high-priority remediation target in Oracle EBS deployments. No public exploit code has been identified and the vulnerability is not currently listed in the CISA KEV catalog at time of analysis.

Unauthenticated remote data disclosure in Oracle Scripting (Oracle E-Business Suite component: Internal Operations) affects all supported releases from 12.2.3 through 12.2.15. Exploitation over HTTP requires no credentials, no user interaction, and no special configuration - consistent with the Authentication Bypass tag reported alongside this vulnerability. Successful exploitation grants an attacker unauthorized read access to all data accessible within Oracle Scripting, including potentially critical business data. No public exploit or active exploitation has been confirmed at time of analysis.

Oracle Scripting versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes an Internal Operations component vulnerability allowing low-privileged, network-based attackers to achieve full confidentiality and integrity compromise of all Scripting-accessible data, plus partial service disruption. The "Authentication Bypass" tag from the intelligence feed creates a notable tension with the CVSS PR:L assignment - if the bypass allows unauthenticated users to obtain a low-privilege session context, the effective attack surface is wider than the CVSS vector alone suggests. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H rating constrains opportunistic exploitation.

Oracle Scripting within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible vulnerability in the Internal Operations component, allowing a low-privileged authenticated attacker to gain complete unauthorized read access to all Oracle Scripting-accessible data and limited write access via HTTP. The vulnerability carries an Authentication Bypass tag, indicating the flaw permits privilege escalation beyond the attacker's intended authorization level within the module. No public exploit code or active exploitation has been identified at time of analysis, though Oracle itself characterizes the vulnerability as easily exploitable, elevating urgency despite the absence of a CISA KEV listing.

Unauthorized data access in Oracle Call Center Technology (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged remote attacker to gain complete read access to all data accessible by the application and limited write capability via HTTP, with a confirmed scope change enabling cascading impact on additional E-Business Suite components. The EUVD tags this as an Authentication Bypass, suggesting the Internal Operations component fails to enforce sufficient authorization boundaries for low-privilege accounts despite requiring initial authentication. No public exploit has been identified at time of analysis; this vulnerability was disclosed as part of Oracle's Critical Patch Update for August 2026.

Oracle E-Business Tax versions 12.2.3 through 12.2.15 allows a low-privileged local attacker to compromise data integrity and trigger a repeatable denial-of-service condition in the Internal Operations component. Successful exploitation enables unauthorized creation, deletion, or modification of critical tax data, and can cause the application to hang or crash completely, disrupting core business tax processing workflows. No public exploit has been identified at time of analysis, though the low complexity and low privilege requirements make this an accessible target for any authenticated local user on the affected infrastructure.

Unauthorized data access and modification in Oracle Project Planning and Control (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged authenticated network attacker via HTTP, targeting the Change Management component. The vulnerability is tagged as an authentication bypass, suggesting an attacker with minimal credentials can exceed their authorized access level to read or manipulate critical project data without any user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle rates this as easily exploitable with a CVSS 8.1, making it a high-priority patching target in enterprise environments running E-Business Suite.

Unauthorized data access and modification in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3-12.2.15) is achievable by a high-privileged remote attacker via HTTP, with exploitation triggering a scope change that can affect systems beyond the directly targeted component. The flaw resides in the Regression Testing component and carries CVSS 3.1 Base Score 7.7, reflecting high confidentiality and integrity impacts. No public exploit or CISA KEV active-exploitation listing has been identified at time of analysis.

Unauthorized data manipulation in Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical financial records via HTTP, with secondary read and partial availability impacts. The vulnerability resides in the Internal Operations component and requires only a valid low-privilege account - no elevated rights or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high integrity impact make this a significant risk for any organization running Oracle EBS financials.

Full system takeover in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged, network-capable attacker exploiting a flaw in the Regression Testing component over HTTP. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, with a scope change indicating that impact can cascade into adjacent Oracle EBS components beyond the directly affected module. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.

Unauthorized data access in Oracle Flow Manufacturing 12.2.3 through 12.2.15 allows network-authenticated low-privileged users to fully compromise confidentiality of all accessible manufacturing data and perform limited unauthorized data modification via HTTP. Tagged as an authentication bypass by the reporting source, this suggests the vulnerability enables low-privileged users to circumvent authorization controls within Oracle E-Business Suite's Internal Operations component, exposing critical operational data beyond their intended access scope. No public exploit has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Security Patch Update.

Oracle SDP Number Portability versions 12.2.3 through 12.2.15, a telecommunications management component of Oracle E-Business Suite, exposes a local privilege-abuse flaw in its Internal Operations component that enables high-privileged insiders or post-breach actors to compromise the affected system. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, read access to a subset of accessible data, and the ability to cause a partial denial of service - with a scope change (S:C) extending potential impact to additional Oracle products co-hosted in the same E-Business Suite environment. No public exploit code exists and this CVE does not appear in the CISA KEV catalog at time of analysis; the CVSS 3.1 base score of 7.3 reflects the scope change rather than inherent exploitability from the perimeter.

Unauthenticated remote data exposure in Oracle SDP Number Portability (E-Business Suite versions 12.2.3 through 12.2.15) allows a network attacker over HTTP to access critical or all data managed by the component without any credentials. The vulnerability is tagged as an Authentication Bypass in the Internal Operations component, consistent with the PR:N/AC:L CVSS vector indicating trivial exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity significantly lowers the bar for opportunistic abuse.

Oracle Purchasing within E-Business Suite versions 12.2.3 through 12.2.15 exposes a local privilege escalation in the Internal Operations component that yields full application takeover. A low-privileged attacker with OS-level logon to the infrastructure running Oracle Purchasing can exploit this flaw without any additional complexity or user interaction, achieving complete confidentiality, integrity, and availability compromise of the Purchasing module. No public exploit has been identified at time of analysis, but Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' materially elevating practical risk for organizations running EBS in shared or multi-tenant server environments.

Oracle Purchasing, a procurement module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes a high-severity network-exploitable vulnerability in its Internal Operations component that enables full system takeover - complete loss of confidentiality, integrity, and availability. Oracle itself classifies this as 'easily exploitable' despite the high-privilege requirement (PR:H), meaning that once an attacker possesses elevated credentials, exploitation presents no meaningful technical barrier. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the full CIA impact and low attack complexity make this a priority patching target for any organization running internet-exposed or broadly network-accessible Oracle EBS deployments.

Oracle General Ledger versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, contains an authentication bypass weakness in the Internal Operations component that allows a highly privileged local attacker to gain unauthorized read and write access to critical financial ledger data, with a scope change that may cascade impact to additional Oracle EBS products. The attack requires local infrastructure logon and high attack complexity, substantially constraining the realistic attacker population to insiders or those who have already compromised the host environment. No public exploit code has been identified and Oracle has addressed this through the August 2026 Critical Patch Update.

Full takeover of Oracle Applications Platform Engineering (Oracle E-Business Suite versions 12.2.3-12.2.15) is achievable by unauthenticated remote attackers via the Oracle Net protocol by exploiting a flaw in the Valid Session component. The CVSS 3.1 score of 8.1 reflects complete confidentiality, integrity, and availability impact, tempered by a high attack complexity (AC:H) that limits opportunistic mass exploitation. No public exploit code or CISA KEV listing exists at time of analysis, though the unauthenticated network vector over Oracle Net makes this a high-priority patch target for any internet-adjacent EBS deployment.

Full system takeover of Oracle Yard Management (E-Business Suite component, versions 12.2.3 through 12.2.15) is achievable by any low-privileged authenticated user over HTTP, with the vendor-reported CVSS impact of C:H/I:H/A:H indicating complete compromise of confidentiality, integrity, and availability. The affected subcomponent is Internal Operations, and Oracle addressed this flaw in the August 2026 Critical Patch Update. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Oracle Transportation Execution (E-Business Suite versions 12.2.3 through 12.2.15) exposes a network-exploitable integrity flaw in its Internal Operations component that allows a low-privileged authenticated attacker to gain unauthorized create, delete, and modify access to critical data - including a partial confidentiality breach - with a scope change impacting additional Oracle EBS products. The attack requires human interaction from a victim other than the attacker, consistent with a client-side injection pattern (e.g., stored XSS or similar), amplified by the 'Authentication Bypass' tag suggesting privilege escalation from low to higher access tiers. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Unauthorized data manipulation in Oracle Telecommunications Billing Integrator versions 12.2.3 through 12.2.15 allows unauthenticated network attackers to compromise critical data integrity via crafted HTTP requests, requiring only victim interaction to trigger. The CVSS scope change (S:C) indicates successful exploitation can cascade into other Oracle E-Business Suite components beyond the directly targeted module, amplifying the overall impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this vulnerability through its August 2026 Critical Patch Update.

Full system takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by any low-privileged authenticated user over HTTP, with no additional complexity required. The Server component is vulnerable to exploitation that results in complete compromise of confidentiality, integrity, and availability - Oracle's own description uses the word 'takeover'. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low bar to exploitation (PR:L, AC:L, AV:N) makes this a high-priority patching target for any organization running this Oracle Hyperion version.

Unauthorized data access and partial integrity compromise in Oracle Service Fulfillment Manager (E-Business Suite Fulfillment Engine component) affects all releases from 12.2.3 through 12.2.15. A low-privileged network attacker can, after inducing a victim user to interact with a crafted payload delivered over HTTP, achieve complete confidentiality loss of all data accessible to the application and limited unauthorized write access - with confirmed scope change affecting additional EBS products. No public exploit code has been identified at time of analysis, and Oracle has addressed this vulnerability in the August 2026 Critical Patch Update. The Authentication Bypass tag warrants verification, as the provided CVSS vector assigns PR:L rather than PR:N, suggesting privilege escalation within the session rather than a full authentication bypass.

Oracle Service Contracts in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in its Internal Operations component reachable over HTTP without credentials, enabling unauthorized full read and write access to critical service contract data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impact, moderated by high attack complexity (AC:H) that prevents trivial mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass nature of the flaw and the sensitivity of contract data make this a meaningful target for motivated adversaries with access to the EBS application layer.

Oracle Labor Distribution versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, allows a low-privileged network attacker to bypass internal authorization controls via HTTP, resulting in complete unauthorized read and write access to critical labor and payroll cost distribution data. The vendor characterizes this as 'easily exploitable,' and the 'Authentication Bypass' tag indicates that a standard EBS account holder can escalate beyond their assigned access level within the Internal Operations component. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and high dual confidentiality and integrity impact make this a high-priority item in the August 2026 Oracle CPU.

Full takeover of Oracle Proposals (Oracle E-Business Suite component) is achievable by a high-privileged, network-adjacent attacker over HTTP, resulting in complete compromise of confidentiality, integrity, and availability. Affected deployments span versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, a widely deployed enterprise ERP platform. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.

Oracle iSupplier Portal versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes an authentication bypass in the Internal Operations component that allows unauthenticated network attackers to fully compromise supplier data confidentiality and integrity via HTTP. Successful exploitation grants complete read access to all iSupplier Portal data and the ability to create, delete, or modify critical data records - high-value targets in supply chain environments. Oracle patched this in the August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis, though the AC:H rating indicates non-trivial but achievable exploitation conditions.

Unauthorized data access and modification in Oracle Customer Care (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by network-authenticated low-privileged attackers through the Internal Operations component via HTTP, with successful exploitation requiring victim interaction and producing a scope change that can compromise additional Oracle E-Business Suite components. The vulnerability carries a CVSS 3.1 score of 8.7, reflecting high confidentiality and integrity impacts with a cross-component blast radius. Oracle's August 2026 Critical Patch Update confirms the issue; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Unauthenticated remote attackers can access all data within Oracle iSupplier Portal 12.2.3 through 12.2.15 via a trivially exploitable HTTP flaw in the Internal Operations component, with no credentials, no user interaction, and no special configuration required. The 'Authentication Bypass' tag indicates that access controls protecting internal operations endpoints can be circumvented entirely over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity makes opportunistic exploitation realistic if portal instances are internet-facing.

Oracle Warehouse Management versions 12.2.3 through 12.2.15 within Oracle E-Business Suite allows low-privileged network-authenticated attackers to corrupt, delete, or create critical warehouse data and partially disrupt service availability over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms easy exploitability requiring only a low-privilege account and HTTP connectivity - no user interaction or elevated rights are needed. No public exploit code or CISA KEV listing has been identified at time of analysis; the August 2026 Oracle Critical Patch Update references a fix.

Unauthenticated remote access to critical HR data is possible in Oracle HCM Common Architecture (Knowledge Integration component) across versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, exploitable over HTTP without credentials or user interaction. Successful exploitation yields full read access to all HCM-accessible data and partial write capability (insert/update/delete) against some HCM data stores, as confirmed by Oracle's own CVSS breakdown (C:H, I:L). Tagged as an authentication bypass by Oracle's security team, this represents a significant exposure for any organization running HCM within a network-reachable deployment. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthenticated remote data exposure in Oracle Warehouse Management (versions 12.2.3 through 12.2.15) allows any network-accessible attacker to read critical warehouse management data via HTTP without credentials. Tagged as an authentication bypass in the Internal Operations component, this vulnerability provides complete read access to all data within the WMS module's scope. No public exploit code or CISA KEV listing has been identified at time of analysis, though the trivial attack complexity (AC:L, PR:N) elevates practical risk relative to the absence of observed exploitation.

Unauthorized data disclosure in Oracle Warehouse Management (Oracle E-Business Suite component: Internal Operations) allows a low-privileged authenticated attacker with HTTPS network access to bypass authorization controls and obtain critical or complete WMS data across versions 12.2.3 through 12.2.15. The CVSS scope change (S:C) is confirmed by Oracle's advisory, meaning successful exploitation can propagate to additional Oracle EBS products deployed in the same instance - amplifying the data exposure beyond WMS itself. No public exploit code and no CISA KEV listing are identified at time of analysis; the 'Authentication Bypass' tag combined with a PR:L vector indicates this is an authorization bypass for credentialed users rather than a fully unauthenticated flaw.

Oracle Warehouse Management versions 12.2.3 through 12.2.15 - a component of Oracle E-Business Suite - exposes a high-severity vulnerability in its Internal Operations component allowing low-privileged, network-authenticated attackers to compromise confidentiality, integrity, and availability via HTTP. Successful exploitation enables unauthorized read and write access to critical warehouse management data, including creation, deletion, and modification of records, alongside a partial denial of service. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Unauthorized data access and partial denial of service affect Oracle General Ledger versions 12.2.3 through 12.2.15, a core financial management component of Oracle E-Business Suite. A low-privileged, network-authenticated attacker can exploit the Internal Operations component via HTTP to gain complete read access to all Oracle General Ledger data, perform unauthorized insert/update/delete operations on a subset of that data, and cause a partial availability disruption. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Oracle Operations Intelligence, the Daily Business Intelligence component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, contains a network-exploitable vulnerability that allows a low-privileged authenticated attacker to achieve full takeover - encompassing complete loss of confidentiality, integrity, and availability - via crafted HTTP requests. The vendor-assigned CVSS 3.1 score of 7.5 reflects high attack complexity (AC:H), tempering immediacy despite the severe impact ceiling. No public exploit code and no CISA KEV listing have been identified at time of analysis, indicating this is not currently subject to widespread opportunistic exploitation.

Oracle Risk Management versions 12.2.3 through 12.2.15 in Oracle E-Business Suite exposes critical data to low-privileged authenticated attackers over HTTP via a flaw in the Internal Operations component, tagged as an authentication bypass. A successful attack grants full unauthorized read access to all Risk Management data and the ability to create, delete, or modify critical records. No public exploit or CISA KEV listing has been identified at this time, but the low attack complexity and broad version range make this a high-priority patching target for Oracle EBS deployments.

Full takeover of Oracle Risk Management (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated user over HTTP, with no interaction from other parties required. The CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability impact - Oracle's own advisory characterizes the outcome as system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a high-priority patch target for Oracle EBS deployments.

Unauthorized data access in Oracle Order Management's Product Diagnostic Tools component allows low-privileged authenticated attackers over HTTP to compromise confidentiality of critical order data and perform limited data manipulation, with a confirmed scope change that can extend impact to adjacent Oracle E-Business Suite components. Affected deployments span a wide version range, 12.2.3 through 12.2.15, and are addressed in Oracle's Critical Patch Update for August 2026. No public exploit code has been identified at time of analysis, though the Authentication Bypass tag associated with this CVE signals a potentially exploitable access control weakness in the diagnostic sub-component.

Unauthenticated remote disclosure of sensitive financial data affects Oracle Hyperion Financial Reporting 11.2.25.0.000 via HTTP, with no credentials required to trigger the flaw. Tagged as an authentication bypass, the vulnerability allows a network-adjacent attacker to read critical data or gain complete access to all data accessible by the Financial Reporting server component. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's own description characterizes it as 'easily exploitable.'

Full application takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by a low-privileged attacker with local OS logon access to the server host, requiring no user interaction and resulting in complete loss of confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects an easily exploitable local flaw in the Server component, with all three impact dimensions rated High. No public exploit code or active exploitation has been identified at time of analysis, though the severity of the described outcome - full application takeover - warrants prompt remediation.

Full system takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by unauthenticated remote attackers over HTTP without user interaction. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates the attack is network-accessible and requires no credentials, but high attack complexity (AC:H) implies specific preconditions - such as race conditions, timing requirements, or environmental factors - that prevent trivial mass exploitation. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though full CIA impact at CVSS 8.1 makes this a high-priority remediation target for organizations running this EPM platform.

Full takeover of Oracle Customers Online (E-Business Suite component) is achievable by any low-privileged authenticated user over HTTP, across versions 12.2.3 through 12.2.15. The Customer Tab component contains a flaw that, when exploited, yields complete confidentiality, integrity, and availability compromise - Oracle's own description uses the word 'takeover.' No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad authentication baseline (any portal account qualifies) make this a critical patching priority for Oracle EBS deployments.

Oracle Hyperion Financial Reporting version 11.2.25.0.000 is affected by an authentication bypass vulnerability exposing critical financial data to unauthenticated remote attackers over HTTP. Successful exploitation, which requires human interaction from a victim user, grants unauthorized read access to all accessible financial data as well as the ability to create, modify, or delete critical records. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Authentication Bypass tag and CVSS 8.1 score highlight significant risk to corporate financial data confidentiality and integrity.

Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows an unauthenticated attacker with HTTP network access to fully compromise the Server component, yielding complete confidentiality, integrity, and availability loss. Rated CVSS 9.8 and flagged as 'easily exploitable' by Oracle, though tagged as Information Disclosure in EUVD; no public exploit identified at time of analysis and it is not listed in CISA KEV. This is part of Oracle's August 2026 Critical Patch Update and should be treated as high-priority given the unauthenticated network vector.

Full takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by an unauthenticated remote attacker via HTTP, according to Oracle's August 2026 Critical Security Update. The vulnerability resides in the Server component and, if successfully exploited, results in complete compromise of confidentiality, integrity, and availability of the affected instance. No public exploit code or CISA KEV listing has been identified at time of analysis; the High attack complexity rating reduces the likelihood of opportunistic mass exploitation but does not eliminate targeted risk.

Unauthenticated remote exploitation of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows network attackers to obtain complete access to all financial reporting data and cause a partial denial of service via HTTPS. The vulnerability resides in the Server component and is tagged as an authentication bypass, meaning no credentials are required to trigger the flaw against a network-exposed instance. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a high-priority patch target for any organization running this specific version.

Full takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by any low-privileged network attacker communicating via HTTPS, with complete confidentiality, integrity, and availability impact confirmed by a CVSS 3.1 score of 8.8. The vulnerability resides in the Server component and requires only minimal authenticated access, presenting a low barrier for insider threat or compromised-credential scenarios. Oracle formally disclosed and addressed this issue in its August 2026 Critical Security Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote unauthenticated compromise of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an attacker with network access via the Java RMI interface to read, create, modify, or delete all data accessible to the application. Carrying a CVSS 3.1 base score of 9.1 and tagged as an authentication bypass, the flaw yields full confidentiality and integrity compromise without any credentials or user interaction, though it does not affect availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an unauthenticated attacker with only HTTP network reach to fully compromise the application, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact reflects complete product compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch.

Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an unauthenticated attacker with only HTTP network access to fully compromise the application, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' At time of analysis there is no public exploit identified and no CISA KEV listing, but the trivial exploitability and complete-compromise outcome make it a high patch priority.

Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 exposes critical financial data to full unauthorized read and write access through an authorization bypass flaw in its Deployment component, exploitable over HTTP by any low-privileged authenticated user. The dual high-severity impacts - complete confidentiality loss and full integrity compromise covering unauthorized creation, deletion, and modification of all PCM-accessible data - make this a significant threat to enterprise financial management environments. No public exploit has been identified at time of analysis, and CISA KEV listing is not confirmed.

Full system takeover is achievable in Oracle Enterprise Manager for Systems Infrastructure (versions 13.5 and 24.1) via the Storage Server Management component, exploitable by any low-privileged attacker with HTTP network access. The CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact confirms complete compromise of the affected OEM instance - not merely information disclosure despite the 'Information Disclosure' tag in the source intelligence. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though Oracle's opaque CPU advisory format historically delays exploit development rather than preventing it.

Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 exposes critical financial planning data to low-privileged network attackers through its Deployment component over HTTP. Tagged as an authentication bypass, the vulnerability permits a credentialed user to gain complete read access to all data accessible within the application and perform limited unauthorized insert, update, or delete operations, without requiring user interaction or elevated privileges beyond an initial low-level account. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity (AC:L) means a skilled attacker with any valid credential could exploit this reliably.