Authentication Bypass

Unauthenticated HTTP requests against Oracle Helidon deployments that use the helidon-dbclient-mongodb component can let a remote attacker read or modify MongoDB-backed data and cause a partial denial of service in versions 3.0.0–3.2.20 and 4.0.0–4.5.4. Oracle rates this CVSS 3.1 base 7.0 with high attack complexity (AV:N/AC:H/PR:N/UI:N), meaning successful exploitation depends on conditions that are difficult for an attacker to arrange. No public exploit code or CISA KEV listing was provided at time of analysis, so this should be treated as a patch-priority issue rather than an emergency.

Oracle Siebel CRM Deployment (Siebel Management Console) in versions 17.0 through 26.7 fails to properly restrict what a low-privileged, network-connected user can reach, letting that user read critical deployment data and make limited unauthorized changes. Exploitation is trivial once a valid low-privilege account exists: CVSS 3.1 scores it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N), with the confidentiality impact rated High and integrity impact Low. There is no public exploit code and no CISA KEV listing at time of analysis, so this is currently a patch-on-schedule item for Siebel shops rather than an emergency, though EPSS data was not supplied and the untrusted-network exposure of the management console should drive prioritization.

Takeover of Siebel CRM Deployment 17.0 through 26.7 is possible for high-privileged attackers via HTTP requests to the Siebel Management Console. Oracle rates this 9.1 Critical with low attack complexity and no user interaction, and a scope change means compromise can affect additional products beyond the vulnerable component. No public exploit or CISA KEV listing was identified in the provided data.

Oracle Siebel CRM versions 17.0 through 26.7 contain a flaw in the Siebel CRM Integration (EAI) component that lets a low-privileged, network-positioned attacker achieve full takeover of the integration service over HTTP. Exploitation is rated difficult (CVSS AV:N/AC:H/PR:L/UI:N, base 7.5) and yields high confidentiality, integrity, and availability impact on the Integration component. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so the immediate risk is driven by patch urgency rather than confirmed in-the-wild activity.

Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 can be fully taken over by a low-privileged attacker who already holds a valid account and can reach the deployment over HTTP. The flaw is rated 7.5 with High complexity (AC:H), meaning it is not a trivial drive-by exploit but requires a favorable, harder-to-arrange condition to succeed; when it does, confidentiality, integrity, and availability are all fully compromised. There is no CISA KEV listing and no public exploit code identified at time of analysis, but Oracle has published a Security Alert with a patch, so exposure is patch-gated rather than just theoretical.

Oracle Siebel CRM Deployment (Server Infrastructure component) in supported releases 17.0 through 26.7 exposes critical CRM data to a low-privileged, network-positioned attacker who can reach the deployment service over HTTP, and also allows that attacker to partially degrade availability. Oracle rates it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/A:L) and describes it as easily exploitable in its cspusep2026 security alert; there is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the source data.

Low-privileged attackers who can reach Oracle Siebel CRM Deployment over HTTP can exploit a hard-to-trigger flaw in the Siebel Remote component to fully take over the deployment, gaining high confidentiality, integrity and availability impact across the affected system. The vendor lists all supported Siebel CRM Deployment releases from 17.0 through 26.7 as affected, and rates the issue CVSS 3.1 7.5 with a high attack-complexity metric, meaning successful exploitation demands precise conditions rather than a straightforward request. No public exploit code and no CISA KEV listing were identified at time of analysis, so exploitation currently appears to require attacker-specific research or favorable timing rather than off-the-shelf tooling.

Oracle Siebel CRM Integration (EAI component) versions 17.0 through 26.7 expose a network-reachable SOAP interface that fails to properly restrict operations for authenticated low-privileged users, letting an attacker read critical CRM data and perform limited unauthorized inserts, updates, or deletions. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N) and is rated 'easily exploitable' by the vendor, requiring only a valid low-privilege account and network reachability to the EAI endpoint. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.

Oracle Siebel CRM Integration versions 23.6 through 26.7 expose the Event Publish and Subscribe component to unauthenticated attackers who can reach the server from the same network segment, allowing them to read, create, delete, or modify critical CRM data (CVSS 3.1 base 8.1, AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:N). Because the attack vector is adjacent network rather than internet-facing, exposure is gated by network topology rather than by credentials, and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis. Exploitation probability scoring (EPSS) was not supplied with the source data, so prioritization should rest on asset criticality and segment reachability.

Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.7, allows an attacker who already holds a low-privileged logon on the host where the deployment component runs to read, create, modify, and delete all data accessible to that deployment. The vulnerability is locally exploitable with low complexity and no user interaction, but it does not grant entry to the host itself — it escalates what an existing low-privileged account can reach across the Siebel deployment layer, producing high confidentiality and integrity impact (CVSS 3.1 base 7.1) with no availability impact. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score, CWE mapping, or confirmed fix version was supplied with the source data.

Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contain an authentication-related flaw that lets a remote, unauthenticated attacker over HTTP read, create, delete, or modify critical deployment data - CVSS 3.1 base 7.4 with high confidentiality and integrity impact. Exploitation is rated difficult (AC:H), presumably because the attacker must meet a hard-to-satisfy protocol or timing condition, but no privileges or user interaction are required if that condition is met. Oracle has published a fix via its Critical Security Patch Update advisory; active exploitation is not confirmed and no public exploit code was identified in the supplied intelligence.

Improper access control in the Open UI component of Oracle Siebel CRM (End User) versions 17.0 through 26.7 lets an authenticated low-privilege user issue crafted HTTP requests that expose and modify data beyond their authorized scope. Successful exploitation yields high confidentiality impact — unauthorized read of critical Siebel data — plus limited integrity impact via unauthorized insert, update or delete operations; availability is unaffected (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). No CISA KEV listing, public exploit code or EPSS signal is present in the supplied intelligence, so this is currently a patch-cycle priority rather than a confirmed actively exploited issue.

Unauthenticated attackers with HTTP network reachability to the Siebel CRM Deployment component of Oracle Siebel CRM can bypass authentication and gain unauthorized access to critical data, plus limited ability to update, insert, or delete records. The flaw affects supported Siebel CRM versions 17.0 through 26.7 and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N). No public exploit code or active exploitation has been identified from the available intelligence at time of analysis.

Unauthenticated remote attackers with HTTP access to the Reports component of Oracle Siebel CRM End User (versions 17.0 through 26.7) can bypass intended access controls and read data they should not be able to reach, giving them unauthorized access to critical data or the full set of data accessible to the Siebel CRM End User application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), meaning it is trivially reachable and requires no credentials or user interaction, but it does not permit data modification or denial of service. No public proof-of-concept, EPSS score, or CISA KEV listing was supplied with this report, so active exploitation is not confirmed at time of analysis.

A low-privileged, authenticated attacker with network access can fully take over Oracle Siebel CRM Deployment (versions 17.0 through 26.7) by abusing SQL handling in the Server Infrastructure component, achieving high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw is trivially exploitable once any valid low-privilege account is obtained — no user interaction and no elevated privileges beyond a standard login are required. Oracle released a fix in its Critical Security Patch Update (cspusep2026); there is no CISA KEV listing and no public exploit code identified at time of analysis, so current exploitation appears opportunistic rather than confirmed in the wild.

A low-privileged, authenticated attacker with HTTP access to the Workflow component of Oracle Siebel CRM Development can fully take over the affected deployment, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). All supported Siebel CRM Development releases from 17.0 through 26.7 are affected per Oracle and ENISA EUVD-2026-79561. No public exploit code or CISA KEV entry is reported in the supplied intelligence, and no EPSS score or CWE classification was provided, so real-world exploitation activity is currently unconfirmed.

Oracle Siebel CRM Deployment (Migration component), versions 17.0 through 26.7, can be fully taken over by a low-privileged attacker who reaches the component over the network and supplies crafted SQL. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N, all three impact metrics High), meaning a single authenticated low-privilege account is enough to gain high confidentiality, integrity and availability impact across the deployment. At time of analysis there is no public exploit identified and no CISA KEV listing, though no EPSS score was supplied, so real-world exploitation likelihood could not be quantified from the provided intelligence.

Oracle Siebel CRM Development (Integration - Scripting component), versions 17.0 through 26.7, can be crashed and partially read or modified by a low-privileged, authenticated attacker who can reach the application over HTTP. Successful exploitation yields a repeatable denial of service (hang or crash) plus unauthorized read of a subset of data and unauthorized insert/update/delete of some records, giving a CVSS 3.1 base score of 7.6. No public exploit code or CISA KEV entry is currently associated with this CVE, and no EPSS score was supplied, so the practical risk is driven mainly by the breadth of affected versions and the low privilege bar rather than by confirmed in-the-wild activity.

Takeover of Oracle Banking Corporate Lending Process Management (component: Base, versions 14.5.0.0.0 through 14.9.0.0.0) is possible for a low-privileged attacker who reaches the application over HTTP and convinces another user to interact with attacker-supplied content, resulting in full loss of confidentiality, integrity and availability of the product. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:R) — network reachable but hard to exploit, requiring an existing low-privilege account and victim interaction. No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV entry was supplied in the source data.

Low-privileged attackers with network access via HTTP can fully compromise the Oracle Applications Framework component (Personalization) of Oracle E-Business Suite 12.2.3 through 12.2.15, achieving complete loss of confidentiality, integrity and availability of that component (CWE not assigned). The vulnerability is trivially exploitable — network vector, low complexity, no user interaction — and carries a CVSS 3.1 base score of 8.8. No public exploit code or CISA KEV listing was reported in the supplied intelligence, and no EPSS score was provided; Oracle's own advisory (cspusep2026) is the authoritative source and a patched update is expected through the relevant Critical Patch Update.

An attacker holding a low-privileged Oracle E-Business Suite account with network access to the Oracle Sourcing 'Internal Operations' component can take over Oracle Sourcing in supported releases 12.2.3 through 12.2.15, achieving full loss of confidentiality, integrity, and availability within that module (CVSS 3.1 base score 7.5, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle characterizes the issue as difficult to exploit (AC:H), meaning specific timing, state, or configuration preconditions must be satisfied rather than a single unauthenticated request; authentication is mandatory (PR:L) and no user interaction is required (UI:N). There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV), so the practical risk is a moderate-to-serious patching priority rather than an emergency pre-auth compromise scenario.

Unauthenticated network attackers can reach the Open UI component of Oracle Siebel CRM End User (versions 17.0 through 26.7) over HTTP and gain unauthorized read access to critical data, limited insert/update/delete access, and the ability to partially degrade availability. Oracle rates the issue CVSS 3.1 base 8.6 (AV:N/AC:L/PR:N/UI:N), meaning no credentials or user interaction are needed; the accompanying tags indicate an authentication-bypass class flaw. There is no CISA KEV entry, no EPSS score, and no public exploit identified at time of analysis, and Oracle has published the fix through its Critical Security Patch Update advisory.

Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets an unauthenticated remote attacker reach the HTTP interface and take full read/write control of deployment data. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (score 9.1) confirms no credentials, no user interaction, and no non-default configuration are required; impact is confined to confidentiality and integrity, so data can be stolen or tampered with but the service cannot be disrupted (A:N). No public exploit code has been identified at time of analysis and CISA SSVC rates exploitation as 'none', though the flaw is rated automatable with total technical impact - making exposure reduction the key control while patching.

Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7) lets an unauthenticated remote attacker reach critical CRM data over HTTP and read, create, delete, or modify it at will. Rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and classified CWE-287, the flaw requires no credentials and no user interaction - the only meaningful barrier is network reachability of the Siebel HTTP interface. No public exploit code exists and there is no confirmed active exploitation (CISA SSVC exploitation: none), but the issue is assessed as automatable with total technical impact, so exposure should be treated as urgent for internet-facing deployments; EPSS data was not provided for this CVE.

Takeover of Oracle Siebel CRM Deployment is possible for any low-privileged, authenticated attacker who can reach the Server Infrastructure component over HTTP, affecting supported versions 17.0 through 26.7. Oracle rates the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning a single valid low-privilege account is enough to gain full confidentiality, integrity and availability impact on the deployment — no user interaction or privilege escalation step is required. No CISA KEV entry, EPSS score or public exploit code was present in the supplied intelligence, so this is currently 'no public exploit identified at time of analysis', though Oracle's advisory language ('easily exploitable') and the low attack complexity make it an attractive post-authentication target.

Oracle Siebel CRM's Financial Services module (Financial Accounts component) can be compromised by an unauthenticated attacker with network access over HTTP, exposing critical Financial Accounts data and enabling a hang or repeatable crash of the affected service. Supported versions 17.0 through 26.7 are impacted, and the assessed vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is possible without credentials, user interaction, or non-default configuration, with impact limited to confidentiality and availability (no data modification). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); practical exposure is governed mainly by whether the Siebel HTTP endpoint is reachable from untrusted networks, since many deployments are intranet-facing.

Full takeover of Oracle Depot Repair — the field-service and repair-management module of Oracle E-Business Suite — is possible in versions 12.2.3 through 12.2.15 for any attacker who already holds a high-privileged account and can reach the application over HTTP. The flaw sits in the module's Internal Operations component and permits complete loss of confidentiality, integrity and availability of Depot Repair data and functions. There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is currently limited to actors who obtain or already possess elevated EBS credentials.

Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an application-layer access-control weakness that lets a low-privileged user with network access to the EBS HTTP interface create, delete or modify critical calendar data and read a subset of calendar records. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), meaning no user interaction is needed but a valid low-privileged account is a prerequisite. No public exploit code or CISA KEV listing was provided in the source data, and no EPSS score was supplied, so active exploitation is currently unconfirmed.

Low-privileged users with network access to Oracle E-Business Suite 12.2.3 through 12.2.15 can tamper with, create, or delete Applications Calendar data they should not control, and can partially degrade the availability of that component (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N, integrity high and availability low, no confidentiality impact). The flaw sits in the Oracle Common Applications Calendar module of EBS and is rated 'easily exploitable' by the vendor, but it is not a pre-authentication bug: an attacker must already hold a valid low-privileged account and HTTP reachability to the EBS application tier. No CISA KEV listing, EPSS score, or public exploit code was provided with the advisory data, so there is currently no public exploit identified at time of analysis.

Oracle Common Applications, a shared framework component of Oracle E-Business Suite (CRM User Management Framework), fails to properly restrict actions for low-privileged users in versions 12.2.3 through 12.2.15, allowing them to create, delete, or modify critical CRM data and read data they should not access. Exploitation is network-based over HTTP with low complexity, but requires the attacker to already hold a valid low-privileged account and to persuade another user to interact with a crafted request (CVSS 7.3, AV:N/AC:L/PR:L/UI:R). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was provided in the source data.

Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Core component of the Application Object Library that allows a remote, unauthenticated attacker with HTTP access to bypass authentication and gain unauthorized read and write access to critical application data. Oracle rates the issue 7.4 with a high attack complexity, reflecting that exploitation is possible over the network without credentials but requires conditions an attacker must engineer or discover. No public exploit code has been identified and the issue is not listed in CISA KEV, so at time of analysis this is a patch-now, high-impact confidentiality and integrity risk rather than a confirmed active campaign.

Authenticated low-privileged attackers with network reachability can fully take over Oracle Siebel CRM Development (versions 17.0 through 26.7) by exploiting the Configuration Tools component through SQL-based input, resulting in complete loss of confidentiality, integrity, and availability on the affected deployment. Oracle rates this 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a hard-to-execute but network-reachable flaw that requires only a low-privileged account and no user interaction. There is no public exploit identified at time of analysis, no EPSS score supplied, and no CISA KEV listing, so this is currently a patch-cycle priority rather than an observed active campaign.

Unauthenticated remote attackers can reach the Workspaces component of Oracle Siebel CRM Development over HTTP and obtain unauthorized read access to critical application data while also degrading service availability (CVSS 3.1 base 8.2, AV:N/AC:L/PR:N/UI:N). Affected are all Siebel CRM Development releases from 17.0 through 26.7. There is no public exploit code or CISA KEV listing confirmed in the supplied intelligence, so the practical priority depends on whether the Workspaces HTTP interface is exposed beyond trusted internal networks.

Full compromise of Oracle Siebel CRM Deployment (Server Infrastructure component, versions 17.0 through 26.7) is achievable by an authenticated low-privileged user who can reach the deployment tier over HTTP. Oracle's own advisory rates it 8.8 with complete confidentiality, integrity, and availability impact, meaning a single low-privilege account can escalate to takeover of the deployment rather than merely reading data. No CISA KEV listing, no public exploit code, and no EPSS score were included in the source data, so the current exploitation status is unconfirmed and the immediate risk is driven by the breadth of the affected version range combined with trivial attack complexity.

Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker who already holds a valid account and can reach the application over HTTP. Successful exploitation gives the attacker unauthorized read, creation, modification, and deletion access to Calendar data and can also cause a partial denial of service, though Oracle rates the flaw as difficult to exploit (CVSS 3.1 7.1, AV:N/AC:H/PR:L/UI:N). No public exploit code or CISA KEV entry was provided in the intelligence feed, and the only authoritative reference is Oracle's Critical Patch Update advisory cspusep2026.

Authenticated high-privilege abuse in Oracle Application Object Library (AOL) Core, the shared foundation component of Oracle E-Business Suite 12.2.3 through 12.2.15, lets an attacker who already holds elevated EBS application privileges reach a vulnerable code path over HTTP and achieve full takeover of the AOL component itself. Exploitation is rated difficult (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.0), so success depends on conditions outside the attacker's direct control, and the high-privilege prerequisite sharply limits who can mount the attack. The offsetting aggravator is the scope change: a successful compromise can significantly impact additional integrated EBS products beyond AOL, and no public exploit code has been identified at time of analysis, so this is a genuine but hard-to-reach post-authentication risk rather than an opportunistic remote flaw.

Low-privileged users of Oracle One-to-One Fulfillment (the Documents component of Oracle E-Business Suite 12.2.3 through 12.2.15) can read, create, delete, or modify critical fulfillment and document data over HTTP without any user interaction. Oracle assigns it a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning the attacker only needs network reachability plus a low-privileged account, not administrative rights. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data.

Improper authorization in the Application Framework component of Oracle CRM Technical Foundation (Oracle E-Business Suite 12.2.3–12.2.15) lets a low-privileged user with ordinary HTTP access to the instance read and alter critical CRM data that should be restricted to higher-privileged roles — integrity and confidentiality are both rated High, availability is unaffected. Oracle scores it 8.1 (AV:N/AC:L/PR:L/UI:N), meaning exploitation is straightforward but requires a valid low-privilege account rather than anonymous access. No public exploit code or active exploitation has been reported in the supplied intelligence, and no EPSS value was provided, so it should be treated as a patch-priority issue rather than an emergency.

Oracle One-to-One Fulfillment, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes unauthorized access to critical data and can be partially disrupted by an attacker holding only a low-privileged account with HTTP access to the application. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/A:L), the issue requires authentication but no user interaction, and yields high confidentiality loss plus a limited availability impact. There is no public exploit code and no CISA KEV entry at time of analysis, and no EPSS score was supplied; the vendor patch is published in the September 2026 Critical Patch Update advisory.

Oracle Sales Online, a component of Oracle E-Business Suite, is affected by an easily exploitable flaw in versions 12.2.3 through 12.2.15 that lets a low-privileged attacker with HTTP network access compromise the application and reach data outside its intended boundary (scope change). Successful exploitation can expose critical data or all Oracle Sales Online-accessible data, plus allow unauthorized insert, update, or delete of some records. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle's Critical Security Patch Update advisory (cspusep2026.html) is the authoritative fix reference and the CVSS 3.1 base score of 8.5 reflects high confidentiality and low integrity impact.

Authenticated low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the One-to-One Fulfillment 'Documents' component to read critical data outside their authorized scope and partially degrade availability of the module. The vendor-assigned CVSS 3.1 base score is 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L), reflecting high confidentiality impact with no integrity impact and only partial denial of service; the scope-change flag indicates that exploitation can significantly affect resources beyond the vulnerable component. There is no CISA KEV listing, no public proof-of-concept identified, and no EPSS data supplied, so exploitation is not confirmed to be active at time of analysis.

An unauthenticated remote attacker with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can bypass access controls in the Oracle Application Object Library (FND) Core component and read critical application data, per Oracle's own disclosure (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/C:H/I:N/AN). The flaw is fully automatable — no credentials, no user interaction, low complexity — making it attractive for mass scanning, though its impact is limited to confidentiality (no integrity or availability loss). No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, but no EPSS score was supplied, so real-world exploitation probability is unquantified.

Oracle E-Business Suite 12.2.3 through 12.2.15 contains a broken-authorization flaw in the Customer Interaction History module (Outcome-Result component) that allows a low-privileged user with HTTP access to read data well outside their intended privileges. Exploitation is trivial once an attacker holds any valid low-privileged EBS account, and Oracle's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) marks it as an easily exploitable, confidentiality-only issue whose scope change means other EBS modules can be affected. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical risk is driven by the enormous blast radius of an ERP holding financial, HR and customer records rather than by confirmed active exploitation.

Oracle E-Business Suite releases 12.2.3 through 12.2.15 allow a low-privileged, authenticated user with network access to the HTTPS interface to take over the Customer Interaction History module, compromising confidentiality, integrity and availability of that component's data. No public exploit code has been identified and the CVE is not listed in CISA KEV, but the attack is network-reachable with low complexity and no user interaction, so a single valid account is the only real barrier. Exploitation probability metrics (EPSS) were not supplied with this record, so real-world activity cannot be quantified from the available data.

Authenticated low-privileged users can fully compromise the Customer Interaction History module (Outcome-Result component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 over HTTP, achieving complete loss of confidentiality, integrity and availability of that module. Oracle rates the issue 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker needs only a valid low-privilege account and no user interaction, making the barrier to exploitation low for anyone who already holds any EBS login. No public exploit code has been identified and the flaw does not appear in CISA KEV at time of analysis, but the Oracle Critical Patch Update reference (cspusep2026.html) indicates a vendor fix is published and patching should follow normal CPU urgency for internet-facing EBS deployments.

Network-reachable file-upload flaws in Oracle E-Business Suite's Application Object Library (Attachments component, versions 12.2.3 through 12.2.15) allow a low-privileged authenticated user to take over the affected component, earning a CVSS 3.1 base score of 8.8 with High confidentiality, integrity and availability impact and no user interaction. Exploitation needs only a valid low-privilege EBS account plus HTTP access — no privileged role, no crash, no victim action — which makes it an attractive post-authentication escalation path inside ERP deployments. No public exploit code or CISA KEV entry has been identified at time of analysis, and Oracle's cspusep2026 Critical Patch Update is the authoritative fix source.

Unauthenticated attackers able to reach the HTTPS interface of Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the Oracle Application Object Library (Core component) to create, delete, or modify critical data and to read data they should never see. The CVSS 3.1 base score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), meaning no credentials or user interaction are needed but successful exploitation depends on conditions the attacker must satisfy. No public exploit code has been identified and the flaw is not listed in CISA KEV, so it should be treated as a high-severity patch obligation rather than an actively exploited emergency.

Authenticated low-privileged users can compromise Oracle Project Intelligence within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) over HTTP, gaining unauthorized create, delete, and modify access to critical data along with read access to a subset of application data. Oracle rates the issue CVSS 3.1 base 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), reflecting a trivial-to-execute, low-privilege attack whose dominant impact is data integrity rather than availability or broad disclosure. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so exploitation status is unconfirmed.

Oracle Database Server releases 23.4.0 through 23.26.3 contain a flaw in the RDBMS component that allows a low-privileged database account holding the Create Table privilege to escalate to full takeover of the database engine over Oracle Net. The attack is network-reachable, requires no user interaction, and carries high confidentiality, integrity and availability impact, producing a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied in the source data, so the immediate driver is the combination of a low privilege bar and complete database compromise rather than confirmed in-the-wild activity.

Oracle E-Business Suite's Applications DBA component (ADPatch) contains a flaw in versions 12.2.3 through 12.2.15 that allows an attacker who already holds a logon on the host infrastructure to take over Applications DBA without presenting Oracle application credentials. Exploitation requires the attacker to persuade another person to perform some interaction (UI:R) and is scored 7.8 with full confidentiality, integrity and availability impact. No public exploit code, EPSS score, or CISA KEV entry was provided in the available intelligence, so active exploitation is unconfirmed at time of analysis.

Oracle E-Business Suite Applications Manager 12.2.3 through 12.2.15 lets a low-privileged attacker who already holds a logon on the host running Applications Manager read and tamper with critical data through the Command Line - RapidClone component. The flaw is a local-only, low-complexity authorization weakness (CVSS 7.1, AV:L/PR:L/UI:N) that yields high confidentiality and integrity impact with no availability impact, and no scoped privilege escalation beyond the component. No public exploit code has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.

Command-line processing in Oracle Applications Manager, a component of Oracle E-Business Suite 12.2.3 through 12.2.15, can be abused by a high-privileged attacker with network access over HTTP to take full control of the Applications Manager host and, because of a scope change, to significantly impact other linked EBS products. Oracle's own vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates that exploitation is difficult and requires an already-elevated account (a privileged operator, administrator, or equivalent account with access to the RapidClone command-line functionality), and no public exploit code or CISA KEV listing has been identified at time of analysis. No EPSS score was supplied with the source data, so the probability of real-world exploitation cannot be quantified from the available intelligence.

A flaw in the Oracle XML Developers Kit (XDK) component bundled with Oracle Database Server lets a low-privileged database account holding the XDKC privilege execute a network-delivered Oracle Net attack that can lead to full takeover of the XDK component, with high confidentiality, integrity and availability impact. Supported releases 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3 are affected. Oracle classifies the issue as difficult to exploit (AC:H) and no public exploit code or CISA KEV entry has been identified at time of analysis, though any user able to obtain XDKC rights is a viable candidate attacker.

Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contains an easily exploitable flaw that lets a low-privileged attacker positioned on the physical communication segment adjacent to the Siebel Deployment host read critical data and repeatedly crash the service. Successful exploitation yields complete confidentiality loss of all data accessible to Siebel CRM Deployment plus a repeatable denial-of-service condition, per the Oracle CPU advisory. No public exploit code or CISA KEV listing was identified at time of analysis, and EPSS data was not supplied for this CVE.

Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication in Oracle Siebel CRM End User versions 17.0 through 26.7 and obtain full read, create, modify, and delete access to all data reachable through the affected component. Rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw requires no credentials, no user interaction, and has low attack complexity, though it carries no availability impact (A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, so the primary real-world risk driver is whether the SOAP endpoint of a given deployment is exposed beyond trusted networks.

Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 can be fully taken over by a low-privileged attacker who can reach the deployment server over HTTPS, with high impact to confidentiality, integrity and availability. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) and describes it as easily exploitable, meaning a valid low-privilege account plus network reachability to the Deployment tier is sufficient — no user interaction and no elevated privileges are required. No public exploit code or CISA KEV entry is associated with this CVE in the supplied intelligence, and no technical root-cause detail (CWE) has been published, so exploitation in the wild is not confirmed.

Improper authorization control in the Oracle Project Intelligence module of Oracle E-Business Suite allows a low-privileged authenticated user with network access to read, create, modify, or delete data across the module, including records the account should never reach. Affected releases are 12.2.3 through 12.2.15; the vendor's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N, base 8.1) indicates the flaw is trivially automatable once credentials exist, because no user interaction is needed. No public exploit code, KEV listing, or EPSS estimate was supplied with the available intelligence, so active exploitation should be treated as unconfirmed rather than assumed.

Unauthenticated attackers with network access to the SOAP interface of Oracle Service Delivery Platform (SDP) versions 12.2.1.4.0 and 14.1.2.0.0 can bypass authentication and achieve full takeover of the product, per CWE-287 and a CVSS 3.1 base score of 9.8. The flaw is remotely exploitable without privileges or user interaction (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. Real-world risk is concentrated in telecom environments where the Messaging Enabler component is deployed and network-reachable.

Oracle Siebel CRM 17.0 through 26.7 exposes a flaw in the Open UI component that lets a low-privileged, network-positioned attacker compromise a victim's Siebel CRM End User session once that victim is persuaded to interact with attacker-supplied content. Successful exploitation yields unauthorized read, creation, deletion or modification of critical and otherwise inaccessible CRM data, and the scope-change (S:C) rating means the fallout can extend to products beyond Siebel CRM End User itself. Rated CVSS 7.7 with high attack complexity, the bug is difficult to exploit reliably, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Low-privileged attackers with network access to the Siebel Apps - Customer Order Management module (Order Management component) in Oracle Siebel CRM versions 17.0 through 26.7 can craft HTTP requests that, once a second user is induced to interact, allow unauthorized read, creation, modification, and deletion of critical order data, with a scope change that can propagate impact to connected products. The flaw carries a CVSS 3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), but no EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so active exploitation is not confirmed (no public exploit identified at time of analysis). It is an easily exploitable, low-complexity issue, making patch deployment a high priority for any organization running an affected Siebel release.

Unauthenticated network attackers can bypass authentication in the eDetailing component of the Siebel Apps - Life Sciences module shipped with Oracle Siebel CRM, affecting versions 17.0 through 26.7, and gain both read and write access to critical CRM data — provided a human other than the attacker is induced to interact with a crafted HTTP request. Oracle scores this 8.1 (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:N), reflecting full confidentiality and integrity compromise but no availability impact and only the Life Sciences vertical exposed. No public exploit code or active exploitation has been identified at time of analysis, and the vendor advisory is Oracle's September 2026 Critical Security Patch Update (cspusep2026.html).

Improper access control in Oracle Proposals, a module of Oracle E-Business Suite (component: Internal Operations), lets a low-privileged, authenticated attacker reach data outside their authorization boundary over HTTP. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields unauthorized read access to critical Oracle Proposals data with a scope change that can extend impact to other EBS-backed products. Oracle rates the issue 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code or CISA KEV entry is present in the supplied intelligence, so it should be treated as an unpatched-window exposure rather than a confirmed in-the-wild campaign.

Low-privileged, network-reachable users of Oracle Field Service can read data far beyond their authorized scope in Oracle E-Business Suite releases 12.2.3 through 12.2.15, potentially reaching critical data across additional products because the flaw crosses a security scope boundary (CVSS 3.1 7.7, C:H only). The vulnerability is exploitable over HTTP with no user interaction once a low-privileged session exists, and no public exploit code or active exploitation is identified at time of analysis. Oracle has published a Critical Security Patch Update advisory covering this issue; there is no CISA KEV listing and no EPSS score was supplied in the source data.

A high-severity flaw in the Internal Operations component of Oracle Spares Management, part of Oracle E-Business Suite, lets a high-privileged attacker who already holds a valid EBS account and HTTP network access take over the Spares Management module and pivot into connected products. All supported 12.2.3 through 12.2.15 releases are affected, and because the flaw is rated hard to exploit (AC:H) the window for a successful attack depends on satisfying a specific, currently undisclosed technical precondition. No CISA KEV listing, public exploit code, or EPSS score was provided, so the risk is driven by the CVSS 8.0 impact profile and the breadth of EBS deployments rather than by observed exploitation.

Oracle Spares Management, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged authenticated user with HTTP network access take full control of the module. Versions 12.2.3 through 12.2.15 are affected, with a CVSS 3.1 base score of 8.8 reflecting high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis, and no EPSS score was provided, so real-world exploitation status cannot be confirmed from available data.

Authenticated but only low-privileged access to the Oracle Spares Management module in Oracle E-Business Suite 12.2.3 through 12.2.15 is sufficient to seize full control of that module, with high confidentiality, integrity and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The weakness sits in the module's Internal Operations component and is reachable over HTTP with no user interaction required, which makes it practically exploitable by anyone who already holds a valid EBS account. No CISA KEV entry, public exploit code or EPSS score was supplied, so active exploitation and real-world prevalence of attacks remain unconfirmed

Oracle iStore, the e-commerce/shopping cart module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exposed to a cross-site style attack in which a low-privileged authenticated attacker with HTTP network access can induce a second user to interact with crafted content and thereby gain unauthorized read, create, modify, and delete access to iStore data — with the vendor warning the impact can extend to other EBS products. With CVSS 3.1 base 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), the flaw is trivially automatable once an attacker holds any low-privileged account, but exploitation still hinges on victim interaction, which materially lowers real-world risk. No public proof-of-concept, EPSS estimate, or CISA KEV entry was present in the supplied intelligence, so exploitation is assessed as not confirmed in the wild at time of analysis.

Low-privileged users of Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can reach data they should not be able to read through the Shopping Cart component over HTTP. Successful exploitation results in unauthorized access to critical data or complete read access to everything the iStore application can reach, and because the flaw carries a scope change it can also significantly affect other E-Business Suite products. Oracle rates it CVSS 3.1 7.7 (confidentiality only, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code and no CISA KEV entry were identified at time of analysis.

Unauthenticated information disclosure in Oracle iStore (Shopping Cart component) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a remote attacker with plain HTTP access read critical data exposed through the storefront, up to and including all data reachable by the iStore application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is trivially automatable given the network vector and lack of credentials or user interaction. No CISA KEV entry, EPSS score, or public proof-of-concept was present in the supplied intelligence, so exploitation is assessed as possible but not confirmed in the wild at time of analysis.

Authenticated, low-privileged attackers with HTTP access to Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can read, create, modify, or delete critical shopping-cart, order, and customer data, giving them full read and write reach into all iStore-accessible records. The flaw sits in the Shopping Cart component and is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is remotely reachable over HTTP with no user interaction and only a low-privilege account. No CISA KEV listing and no public exploit code were identified at time of analysis, so exploitation is currently presumed opportunistic rather than confirmed in the wild.

Oracle Web Applications Desktop Integrator (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) exposes a file download weakness that lets a low-privileged, network-connected user retrieve data they should not be able to reach. Exploitation is rated 'easily exploitable' by Oracle — HTTPS network vector, low complexity, no user interaction — and because the flaw can cross a security boundary (CVSS scope change), successful abuse may expose critical data belonging to other EBS components, not just the Desktop Integrator. CVSS 3.1 base score is 7.7 with confidentiality-only impact; no public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.

Oracle Sales, the sales module of Oracle E-Business Suite (supported versions 12.2.3 through 12.2.15), exposes critical business data to any low-privileged authenticated user who can reach its HTTP interface. A crafted request against the Internal Operations component bypasses the intended access boundary, and because the CVSS vector carries a scope change (S:C), the exposure is not limited to Oracle Sales — data reachable through additional Oracle products can be read as well. Oracle classifies it as 'easily exploitable' (AV:N/AC:L/PR:L/UI:N, CVSS 3.1 base 7.7, confidentiality-only impact); no public exploit code, EPSS score, or CISA KEV entry was provided in the source data.

Unauthenticated remote attackers with HTTP access to Oracle Sales Offline, a module of Oracle E-Business Suite, can read any data the application exposes on affected versions 12.2.3 through 12.2.15. The flaw sits in the Internal Operations component and requires no credentials, no user interaction and no non-default configuration, yielding a 7.5 confidentiality-only CVSS base score. Exploitation is highly automatable and attractive for bulk data theft, though at the time of analysis there is no public exploit code and no confirmed exploitation (no CISA KEV listing); EPSS is not available in the supplied intelligence.

Oracle Sales Offline, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged authenticated user with HTTP access read critical data far beyond their intended authorization, and Oracle's own scoring marks the impact as a scope change, meaning the flaw in this component can also reach data owned by other EBS products. The CVSS 3.1 base score is 7.7 with high confidentiality impact and no integrity or availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis.

Low-privileged attackers with network access over HTTP can compromise Oracle Sales Online in Oracle E-Business Suite releases 12.2.3 through 12.2.15, exposing critical sales data and allowing limited modification of records. Exploitation requires that a low-privileged account already be held and that a second person (not the attacker) be induced to interact with the application, yet the flaw's scope change means a successful attack can ripple into other E-Business Suite components beyond Sales Online itself. It carries a CVSS 3.1 base score of 7.6, but there is no CISA KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied in the intelligence feed.

Oracle Report Manager, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP. The flaw sits in the Internal Operations component and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity, and availability for the Report Manager component with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data, but the low privilege bar and network reachability make this a strong candidate for post-authentication lateral movement inside an EBS environment.

Oracle Sales Online, a module of Oracle E-Business Suite, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP; the flaw sits in the 'Internal Operations' component and is rated 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with high confidentiality, integrity and availability impact across versions 12.2.3 through 12.2.15. Exploitation needs no user interaction and no elevated privileges, only a valid low-privilege login, making any internet- or partner-facing EBS deployment with this module enabled a realistic target. No public exploit code and no CISA KEV listing were identified at time of analysis, so the immediate driver is exposure and patch lag rather than observed in-the-wild activity.

Oracle Report Manager, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes an internal-operations flaw that lets a low-privileged attacker with HTTPS network access read critical data and degrade service availability. Successful exploitation yields high confidentiality impact against all Report Manager-accessible data plus partial denial of service, giving the flaw a 7.1 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is not confirmed to be active; risk is concentrated in internet- or broadly-reachable EBS Report Manager deployments where ordinary authenticated users exist.

Oracle Report Manager — the reporting and output-management product within Oracle E-Business Suite — can be taken over by an attacker who already holds a low-privileged account on the same instance and can reach the application tier over HTTPS. Affected releases are E-Business Suite 12.2.3 through 12.2.15, covering a very long-lived branch of the ERP platform (per the EUVD record and Oracle's Critical Security Patch Update advisory). Successful exploitation yields full read, write and denial-of-service impact on the Report Manager component (CVSS 3.1 base 8.8: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no EPSS score, CISA KEV entry, or public proof-of-concept is present in the supplied intelligence, so exploitation status should be treated as unconfirmed.

Oracle E-Business Suite Order Management (versions 12.2.5 through 12.2.15) exposes order data through its Product Diagnostic Tools component to any low-privileged user who can reach the HTTP interface. The flaw is easily exploitable — network vector, low complexity, no user interaction — and Oracle notes the impact can spread beyond Order Management into interconnected products, resulting in unauthorized access to critical data or complete access to all Order Management data. No public exploit code or CISA KEV listing was provided at time of analysis; no patch version is specified in the available references beyond the linked Oracle advisory.

Unauthenticated remote attackers can read sensitive data from Oracle Applications Manager within Oracle E-Business Suite 12.2.3 through 12.2.15 by sending crafted HTTP requests to the RapidClone command-line component. The issue is scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning exploitation needs no credentials, no user interaction, and only affects confidentiality — an attacker gains unauthorized access to critical data or all data reachable through Applications Manager. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis, so exploitation appears opportunistic rather than confirmed in the wild.

Low-privileged authenticated users with HTTP access to Oracle Quality in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Quality records and make limited unauthorized changes to them, because the Internal Operations component fails to enforce proper authorization on its requests. Oracle scores this 7.1 with a network vector, low attack complexity and no user interaction, so exploitation is straightforward for anyone who already holds any valid EBS account. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied in the input.

Low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can leverage a hard-to-reach flaw in the Oracle Partner Management module (Internal Operations component) to read critical data and modify records far beyond their authorization, with the impact crossing into other EBS components because the vulnerability carries a scope change. Oracle rates it CVSS 7.1 and characterizes it as difficult to exploit, and a fix is published in the 2026 Critical Patch Update. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Unauthenticated remote attackers can read any data reachable through the Audience component of Oracle Marketing in Oracle E-Business Suite versions 12.2.3 through 12.2.15 by sending crafted HTTP requests, with no user interaction required. The flaw is scored 7.5 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N) and is confidentiality-only - integrity and availability of the affected module are unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS probability was supplied with the source data.

Unrestricted network access to Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows unauthenticated attackers to bypass authentication in the Forms Services C/S/Charmode component and take over the application, with CVSS 9.8 and no user interaction. No public exploit or CISA KEV listing is present in the supplied intelligence, but the Oracle advisory confirms the affected versions. Organizations running these releases should treat the flaw as critical and patch immediately.

High-privileged attackers who already hold administrative access within Oracle Fusion Middleware and can reach Oracle Forms over HTTP can achieve full takeover of the Forms service, with impact extending into other connected products. The flaw affects the Forms Services / Client-Server (C/S) Charmode component in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, and carries a CVSS 3.1 base score of 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) with high confidentiality, integrity and availability impact and a scope change - but the PR:H metric is decisive: this is not an unauthenticated remote exploit, no user interaction is needed, and the attacker must already be highly privileged before the attack begins. No public exploit code and no CISA KEV entry were identified from the available intelligence sources at the time of analysis, and no EPSS score was supplied in the source data.

Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 can be fully taken over by a low-privileged, network-positioned attacker who reaches Forms Services over HTTP. Oracle rates the flaw difficult to exploit (AC:H) but complete in impact, with high confidentiality, integrity and availability loss once triggered. No public exploit code has been identified and the issue is not listed in CISA KEV, so current risk is driven by the value of Forms-based business applications rather than by observed exploitation.

Unauthenticated remote attackers who can reach the HTTP interface of Oracle Forms Services in a Client/Server, Character mode (C/S, Charmode) deployment can potentially achieve full takeover of the affected Oracle Forms instance on versions 12.2.1.19.0 and 14.1.2.0.0. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.0) reflects complete confidentiality, integrity and availability impact plus a scope change, meaning a successful compromise can materially affect products beyond Oracle Forms itself; however, the High attack complexity rating means exploitation is difficult and depends on a condition outside the attacker's direct control, which limits reliability and mass exploitation. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) - real-world exposure is confined to environments running the affected Forms Services C/S Charmode component with its HTTP listener reachable by the attacker.

Improper authentication in the Oracle Forms Client/Server (C/S) Charmode runtime allows an unauthenticated, network-reachable attacker to bypass authentication and operate with the data privileges granted to the Oracle Forms application, yielding high confidentiality and integrity impact (CVSS 3.1 base 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, as shipped in Oracle Fusion Middleware (Forms Services, C/S, Charmode), are affected; the vector requires no credentials and no user interaction, and there is no availability impact. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and exposure is limited to deployments whose C/S Charmode listener is network-reachable over TCP from an untrusted network.

Full takeover of Oracle Forms is possible in the Forms Services component of Oracle Fusion Middleware for versions 12.2.1.19.0 and 14.1.2.0.0, where an attacker who already holds high privileges on the target and has HTTP network access to the Forms Services listener (including C/S and Charmode deployments) can achieve complete confidentiality, integrity, and availability impact and, because of a scope change, extend that impact to other products in the same deployment. The 9.1 CVSS base score reflects low attack complexity and no user interaction, but the PR:H prerequisite is the dominant limiter - this is not exploitable by an unauthenticated remote actor, so the realistic threat is a privileged insider or an attacker who has already obtained elevated credentials. No public exploit code or evidence of active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied with the source data.