Authentication Bypass

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 expose an exploitable flaw in the SQR component that lets a low-privileged, authenticated user reach the service over HTTP and read data well beyond their intended authorization while also crashing or repeatedly hanging the application. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) the attacker needs a valid account but no elevated role and no victim interaction, and the confidentiality impact is rated total for data accessible through PeopleTools, with a matching high availability impact from the resulting denial of service. Oracle rates this 8.1 and released it in its Critical Security Patch Update cycle; no EPSS score, CISA KEV listing, or public exploit code was supplied with the source data at time of analysis.

Local, low-privileged compromise of the SQR component in Oracle PeopleSoft Enterprise PeopleTools 8.61–8.63 lets an attacker who already holds a logon to the host where PeopleTools runs take full control of the PeopleTools instance, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8). The flaw is rated easily exploitable once host access exists (AC:L, PR:L, UI:N), but the AV:L vector means it is not remotely reachable from the network without some foothold on the target infrastructure. The provided intelligence contains no EPSS score, no CISA KEV listing and no public exploit reference, so no public exploit was identified at time of analysis, though the code-execution outcome makes this a high-value post-compromise escalation path.

Low-privileged attackers with network access to the HTTP interface of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Report Distribution component to achieve full takeover of the PeopleTools application, with high impact to confidentiality, integrity, and availability. Oracle rates the issue 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), characterizing it as easily exploitable because it needs only a basic authenticated account and no user interaction. No public proof-of-concept or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.

Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can be fully taken over through a flaw in its SQR component, but only by an attacker who already holds a high-privileged logon on the host where PeopleTools runs and who can persuade another user to perform an interaction. Oracle rates it 7.2 because a successful attack is difficult to execute yet delivers complete loss of confidentiality, integrity and availability, and because the compromise can spill over into connected products (scope change). No public exploit code is identified and there is no CISA KEV entry, so the issue is a defensive hardening priority rather than an observed campaign.

Local takeover of Oracle PeopleSoft Enterprise PeopleTools (Cube Manager component) is possible for a low-privileged user who can log on to the infrastructure hosting the product, affecting versions 8.61 through 8.63. Oracle scores this 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a difficult-to-exploit but fully compromising flaw that yields high confidentiality, integrity and availability impact on the PeopleTools instance itself. No public exploit code or CISA KEV listing was identified at time of analysis, so the immediate threat is limited to actors who already hold a valid low-privileged account and interactive access to the PeopleSoft application tier.

A low-privileged, authenticated attacker with HTTP network access can exploit the Cube Manager component in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 to modify or delete critical data and to repeatedly crash or hang the application, producing a complete denial of service. Oracle rates the flaw 8.1 on the CVSS 3.1 scale with high integrity and availability impact but no confidentiality impact, and the vulnerability requires an existing valid account rather than being exploitable pre-authentication. No public proof-of-concept code or evidence of active exploitation was present in the supplied intelligence at the time of analysis.

Low-privileged network attackers can fully take over Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 by exploiting a flaw in the Client Bundle component of Oracle Fusion Middleware, with high confidentiality, integrity, and availability impact. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction, but requires an authenticated low-privileged account (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N). No CISA KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so active exploitation is not confirmed and the practical threat is currently tied to the likelihood of an attacker obtaining a valid low-privilege account.

Unauthenticated remote attackers with HTTP access to Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware can achieve full takeover of the service by exploiting a flaw in the bundled Centralized Thirdparty Jars component. Only versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected by Oracle's advisory. The flaw carries a CVSS 3.1 base score of 8.1 with a High attack complexity rating, and no public exploit code or CISA KEV entry has been identified at time of analysis, so real-world exploitation appears opportunistic rather than widespread.

Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware, Client Bundle component) can be abused by a high-privileged, network-positioned attacker who convinces a second user to interact with a crafted HTTP request, yielding read, creation, modification, and deletion access to critical capture data. Because the CVSS vector carries a scope change (S:C), the impact is not confined to Enterprise Capture itself and can extend to other Fusion Middleware components reachable from the affected deployment. There is no indication of public exploit code or confirmed active exploitation, and no EPSS score was supplied with the source data, so the practical urgency rests mainly on the 8.1 severity, the scope change, and the sensitivity of captured document data.

Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Client Bundle component that a low-privileged, network-positioned attacker can leverage to take over the affected application, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8). Exploitation requires only a low-privileged account and HTTP access to the product — no user interaction and no elevated privileges — making it a serious risk for internet- or broadly reachable deployments. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis, and no EPSS score was provided, so active exploitation is unconfirmed.

Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by an attacker who holds only a low-privileged account but can reach the product's T3 and IIOP network listeners, as described in Oracle's Critical Patch Update advisory. Because the flaw is rated AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8), a single authenticated foothold is enough to gain control of the capture application rather than just read data from it. At the time of analysis there is no CISA KEV listing and no public exploit code identified; EPSS data was not supplied, so exploitation likelihood cannot be quantified.

Low-privileged authenticated users with network access can exploit a flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 to read critical data and modify records, with the impact extending beyond the vulnerable product itself (scope change). Oracle rates the issue CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), driven by high confidentiality impact and cross-component scope change rather than by availability or integrity loss. No public exploit code and no evidence of active exploitation were identified at time of analysis, and no EPSS or CISA KEV data was supplied with the source material.

High-privileged users with network access can take over Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 through the Client Bundle component, yielding full confidentiality, integrity and availability impact plus a scope change (S:C) that lets a compromise of Capture reach beyond that component into other Fusion Middleware resources. The underlying issue is an improper access control weakness (CWE-284) rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); the PR:H prerequisite is the principal limiting factor, so this is not triggerable by an anonymous or low-privileged remote attacker, and no user interaction is required. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is low at 0.46% (39th percentile), so this is a high-severity, low-likelihood-of-opportunistic-exploitation issue that primarily matters to environments where privileged accounts are shared, weakly governed, or externally reachable.

Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by a low-privileged attacker who can reach the product over HTTP, with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw sits in the Client Bundle component of the Oracle Fusion Middleware product and is described by Oracle as easily exploitable, meaning no unusual conditions or user interaction are needed beyond a valid low-privilege account. No public exploit code, EPSS score or CISA KEV listing was present in the provided intelligence, so active exploitation is unconfirmed at time of analysis.

A difficult-to-exploit flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture (12.2.1.4.0 and 14.1.2.0.0) lets an attacker who already holds a low-privileged logon on the host compromise the application, reading and altering critical capture data and potentially affecting interconnected downstream products through a scope change. Exploitation is not trivial: it requires local access, a low-privileged account, high attack complexity, and a second user to perform an interaction. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; Oracle's Critical Security Patch Update advisory is the authoritative source.

Improper authorization on the SOAP-facing Client Bundle interface of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-positioned attacker read all data the application can reach and modify a subset of it. Oracle scores it 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and the Changed scope metric indicates the blast radius can extend beyond Capture into other Fusion Middleware components. No public exploit code or CISA KEV entry was identified at time of analysis; the Oracle Critical Security Patch Update advisory (cspusep2026) is the authoritative source.

Full takeover of Oracle Access Manager is achievable by a low-privileged, network-positioned attacker who can reach the product's HTTP Authentication Engine, affecting supported versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware. The flaw requires valid low-privilege credentials (PR:L) and is rated hard to exploit (AC:H), but its scope-change rating means a successful attack against OAM can cascade into the downstream applications that rely on it for single sign-on. As of analysis, no public exploit code and no CISA KEV listing were identified, and the input contained no EPSS score, so real-world exploitation pressure is unquantified despite the 8.5 base score.

Full takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is achievable by an authenticated, high-privileged attacker who can reach the Authentication Engine over HTTP, with a CVSS 3.1 base score of 9.1 due to low attack complexity, no user interaction, and scope change that can affect integrated identity/SSO products. The PR:H prerequisite means this is realistically an insider or post-compromise privilege-abuse path rather than a remote unauthenticated break-in. No public exploit code was identified at time of analysis and no CISA KEV listing is present in the provided intelligence.

Improper authentication in the Messaging Enabler component of Oracle Fusion Middleware Service Delivery Platform allows unauthenticated remote attackers to bypass authentication and fully take over the product, compromising confidentiality, integrity, and availability. Affected releases are Oracle SDP 12.2.1.4.0 and 14.1.2.0.0, and per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires only network reachability to the Messaging Enabler HTTP interface - no credentials, privileges, or user interaction are needed. There is no public exploit code identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the main real-world limiting factor is exposure, since SDP is niche carrier/telecom middleware typically deployed inside operator networks rather than on the public internet.

Authenticated, low-privileged attackers with network HTTP access to the Messaging Enabler component of Oracle Service Delivery Platform (Fusion Middleware) can achieve full takeover of the platform, and because the CVSS profile carries a scope change (S:C) the compromise can extend to additional connected products beyond SDP itself. Oracle rates the issue CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), affecting SDP 12.2.1.4.0 and 14.1.2.0.0; exploitation needs valid low-privilege credentials but no user interaction, at low attack complexity, and no public exploit code has been identified at time of analysis. The realistic limiting factors are the credential prerequisite, the narrow deployment base of this specialized telecom service-delivery platform rather than general-purpose middleware, and the fact that the vector is well-calibrated rather than inflated.

Takeover of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler component) is achievable by a low-privileged, network-positioned attacker, carrying a CVSS 3.1 base score of 9.9 with a scope change (S:C) that lets a successful compromise spill over into other products. The affected releases are 12.2.1.4.0 and 14.1.2.0.0, and the attack path is the T3 and IIOP listeners; per the assessed vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) the attacker must already hold a valid low-privileged account on the platform, but no user interaction is required and confidentiality, integrity and availability impacts are all High. There is no public exploit code identified at time of analysis and the vulnerability is not listed in CISA KEV, so urgency rests on the near-maximum score and the exposure of internal T3/IIOP ports rather than on observed exploitation; the residual risk drops sharply where those proprietary protocols are firewalled or the platform is segmented away from untrusted users.

Authenticated remote attackers who can reach the WebLogic T3 or IIOP remoting interfaces of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler) can take over the product entirely, with the compromise extending to connected Oracle components because of the scope change. The flaw affects Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - no user interaction is required, but a valid low-privileged account is a prerequisite, so it is exploitable (not unauthenticated). No public exploit code and no confirmed active exploitation were identified at time of analysis; practical exposure is further narrowed because T3/IIOP ports are commonly firewalled or not internet-facing in hardened WebLogic deployments.

Oracle Platform Security for Java (component: Centralized Thirdparty Jars) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with logon access to the host to fully compromise the component, resulting in high confidentiality, integrity, and availability impact. The flaw is locally exploitable (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and requires only a valid low-privileged account on the infrastructure where the component executes. No public exploit code or CISA KEV listing is identified at time of analysis, and the vendor advisory is available via Oracle's Critical Patch Update.

Authentication bypass in Oracle Platform Security for Java (OPSS) 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to reach the affected SOAP interface and achieve full takeover of the OPSS instance, with high confidentiality, integrity, and availability impact (CVSS 9.8). The flaw is classified as CWE-287 improper authentication and is tagged as an authentication bypass; per the Oracle-supplied CVSS vector, no credentials or user interaction are required. No public exploit identified at time of analysis, but any reachable vulnerable OPSS service should be treated as high risk because the practical limiting factor is network exposure of the SOAP endpoint rather than a configuration prerequisite.

Unauthenticated remote attackers who can reach an exposed LDAP authentication path in Oracle Platform Security for Java (OPSS) can achieve complete takeover of the OPSS security framework in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, with full confidentiality, integrity and availability impact (CWE-287 improper authentication, CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the Centralized Thirdparty Jars component and requires no credentials and no user interaction, but exploitability in practice depends on network reachability: OPSS is an embedded security framework consumed by Fusion Middleware applications rather than a standalone internet-facing service, so internal-only or firewalled OPSS/LDAP endpoints substantially reduce exposure. No public exploit code and no CISA KEV entry were identified at time of analysis, and no real-world exploitation telemetry is available, so the 9.8 severity reflects assessed potential rather than observed attack activity.

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 contain a flaw in the Business Interlink component that lets a low-privileged, network-reachable user read or fully compromise PeopleTools-accessible data and modify or delete some of it, with impact extending to other connected products (scope change). Oracle rates it CVSS 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and notes it is 'easily exploitable' by a low-privileged attacker over HTTP. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.

Local privilege escalation in the Installation component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets any low-privileged user who can log on to the host running Siebel CRM Deployment to fully compromise that deployment. Because the flaw is reachable through the local attack surface with no user interaction and yields complete loss of confidentiality, integrity and availability, an attacker with an otherwise ordinary account can effectively take over the CRM environment. No public exploit code or in-the-wild exploitation is identified in the available intelligence at time of analysis, and the vendor advisory from Oracle is the sole reference for affected versions and fixes.

Authentication controls protecting the web-based management interface of HPE Aruba EdgeConnect SD-WAN Orchestrator can reportedly be circumvented by a remote actor, allowing escalation to administrative privileges and full compromise of the orchestrator host that manages the SD-WAN fabric. Reported affected releases span EdgeConnect SD-WAN software 9.4.0 through 9.7.0, with no fix version disclosed in the supplied source data. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so exploitation status is best treated as unconfirmed.

Unauthenticated remote attackers can circumvent the authentication controls exposed by the API of HPE Networking EdgeConnect SD-WAN Orchestrator, escalating to administrative privileges and achieving complete compromise of the orchestrator host. The vendor rates this 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), and EUVD maps the affected code lines to EdgeConnect SD-WAN releases 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0. No CISA KEV listing or public exploit code was identified in the supplied intelligence, and EPSS data was not provided, so the practical exploitation risk rests on the high attack complexity (AC:H) noted in the vendor vector.

Incorrect authorization in the EdgeConnect SD-WAN Orchestrator API lets an authenticated remote user with low privileges retrieve sensitive information beyond what their role permits, and that data can potentially be leveraged to reach the SD-WAN network services the orchestrator manages. The vendor HPE/Aruba rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and ENISA EUVD lists affected EdgeConnect SD-WAN Gateway releases in the 9.4.x, 9.5.x, 9.6.x and 9.7.0 lines. No public exploit code exists and the issue is not in CISA KEV at time of analysis; exploitation requires valid low-privilege credentials, which materially narrows the attacker population.

Unauthenticated remote attackers can bypass authentication controls in the EdgeConnect SD-WAN Orchestrator management API to gain administrative privileges and fully compromise the underlying host, rated 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Affected builds per the EUVD advisory span EdgeConnect SD-WAN 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0, although the description attributes the flaw to the Orchestrator while EUVD lists Gateways, so the exact affected component should be confirmed against HPE advisory hpesbnw05135en_us. No public exploit identified at time of analysis and no CISA KEV entry, but the unauthenticated, network-reachable attack path and total confidentiality, integrity, and availability impact make this a top-priority exposure wherever the management API is internet-facing.

In Oracle Siebel CRM's Marketing module (Siebel Apps - Marketing), supported versions 17.0 through 26.7 expose a network-reachable HTTP flaw that a high-privileged user can leverage to seize full control of the Marketing application, impacting confidentiality, integrity and availability alike (CVSS 3.1 base 7.2). The issue is rated easily exploitable (AC:L) but is gated behind privileged credentials (PR:H), and no user interaction is needed once such access exists. No CISA KEV entry, public exploit code, or EPSS score was supplied with the source data, so active exploitation is unconfirmed at time of analysis.

Unauthenticated remote attackers who can reach the Portlet Services component of Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 over HTTP can bypass authentication and achieve full takeover of the application, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 9.8; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is an improper-authentication defect (CWE-287) and, per the assessed vector, needs no credentials, no user interaction and no non-default configuration, so any instance with Portlet Services reachable is directly at risk. No public exploit code has been identified at time of analysis, and the principal real-world limiter is exposure, since WebCenter Portal is typically deployed behind an enterprise perimeter rather than openly on the internet; this is nevertheless a high-priority issue on every available static signal, with thin real-world exploitation evidence.

Authenticated attackers holding a low-privileged account can exploit the Authentication Engine in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 over HTTPS to read, create, delete, or modify all data reachable through the service, with CVSS 3.1 base score 9.6 reflecting high confidentiality and integrity impact and a scope change. The flaw is remotely reachable with low attack complexity and no user interaction, but it is not pre-authentication: a valid low-tier credential on the OAM instance is required, which is the main limiting factor on exploitation. No public exploit identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); Oracle's Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source.

Unauthenticated takeover of Oracle JDeveloper is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0 through the ADF Faces component, which is exposed over HTTP; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms remote, unauthenticated, low-complexity exploitation requiring no user interaction, with full confidentiality, integrity, and availability impact. The root cause is an authentication bypass (CWE-287) rather than a memory-safety or injection flaw, meaning an attacker who can reach the ADF Faces web tier may be able to act with privileges they were never granted. No public exploit code has been identified at time of analysis and the vulnerability is not listed as confirmed actively exploited (CISA KEV); the main real-world constraint is network exposure, since JDeveloper is primarily a Java development IDE and its ADF Faces web tier is not normally published to untrusted networks.

Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged authenticated attacker with HTTP network access to fully compromise the Portal through the Composer component, resulting in complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8). Exploitation requires only a valid low-privilege account and a reachable HTTP interface - no user interaction and no elevated privileges - making the barrier to abuse relatively low for anyone with any Portal login. There is no public exploit identified, no CISA KEV listing and no EPSS score provided at time of analysis, so this is currently a patch-now vulnerability rather than a confirmed actively exploited one.

Unauthenticated network attackers can achieve full takeover of Oracle Access Manager via a difficult-to-trigger flaw in the Authentication Engine component of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this CVSS 3.1 8.1 with High confidentiality, integrity, and availability impact from a network vector requiring no privileges or user interaction, meaning the identity service itself — and the applications it protects — can be fully compromised. No public exploit code and no CISA KEV entry were identified at time of analysis; the AC:H rating indicates the attack requires precise timing or a specific non-default state rather than a trivial repeatable request.

Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can be taken over by an unauthenticated remote attacker who reaches the Composer component over HTTP, because the component fails to properly enforce authentication (CWE-287). Oracle scores this 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or non-default configuration are required - only network reachability of the WebCenter Portal HTTP interface, with the stated outcome being full takeover of the portal. At time of analysis there is no public exploit identified and the issue is not listed as confirmed actively exploited (CISA KEV), so the practical risk is driven by exposure: internet-facing instances are directly at risk, while deployments confined to internal networks or sitting behind an authenticating reverse proxy or WAF are materially harder to reach. This is assessed as well-calibrated maximum severity rather than an inflated score, since an unauthenticated authentication bypass leading to product takeover justifies the C:H/I:H/A:H impact set.

Improper handling of chart content in the Charting component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a low-privileged, authenticated attacker read and modify critical application data after inducing another user to interact with a crafted HTTP request. Successful exploitation yields high confidentiality and integrity impact across all data the victim's session can reach, though availability is unaffected. No public exploit code has been identified at time of analysis, no CISA KEV listing is present in the supplied data, and no EPSS score was provided.

Unauthenticated attackers with HTTP network access to Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can achieve full takeover of the application via the Business Interlink component, as reflected in a CVSS 3.1 base score of 8.1 with high confidentiality, integrity, and availability impact. The flaw is rated high attack complexity (AC:H) and Oracle describes it as 'difficult to exploit,' meaning a successful attack depends on conditions outside the attacker's direct control - such as a specific Business Interlink configuration, integration state, or timing - which keeps this a serious but not top-tier-urgent issue. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; internet-facing PeopleSoft portals exposing the Business Interlink feature are the highest-risk deployments.

Authentication bypass in the Portlet Services component of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 lets unauthenticated remote attackers reach protected functionality over HTTP and, on success, take over the application (CVSS 3.1 base score 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw maps to CWE-287 (Improper Authentication), meaning the portal's Portlet Services layer fails to properly validate that a request originates from an authenticated session. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; the main exposure driver is network reachability of the WebCenter Portal HTTP interface, so internet-facing or broadly reachable instances behind no WAF or proxy carry the highest risk. Oracle addresses it in the September 2026 Critical Patch Update.

Improper authentication in the Portlet Services component of Oracle WebCenter Portal allows unauthenticated attackers with HTTP network access to the portal to bypass authentication and gain read and write access to all portal-accessible data, including the ability to create, delete, or modify critical content. Only versions 12.2.1.4.0 and 14.1.2.0.0 of this Oracle Fusion Middleware product are affected, and the flaw is rated high severity (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) with no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, so exploitation risk is driven primarily by internet or broad-network exposure of an unpatched portal.

Unauthenticated attackers with network access to the HTTP interface of Oracle WebCenter Portal's Portlet Services component can exploit a hard-to-trigger flaw to fully compromise the application, per Oracle's Critical Security Patch Update (cspusep2026). Impact spans confidentiality, integrity and availability (CVSS 8.1), with the stated outcome being complete takeover of WebCenter Portal. Only supported versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected; no public exploit code or CISA KEV entry was present in the supplied intelligence, and the high attack-complexity metric (AC:H) suggests exploitation requires specific, non-trivial conditions rather than a simple one-shot request.

Authentication bypass in the Oracle Access Manager (Fusion Middleware) Authentication Engine lets unauthenticated remote attackers with HTTP network access compromise OAM instances running 12.2.1.4.0 or 14.1.2.1.0, resulting in complete takeover of the affected service with high confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation of the CWE-287 flaw effectively grants the attacker the identity and authorization context the Authentication Engine is supposed to enforce, so any downstream application trusting OAM for single sign-on or access decisions is exposed to the same session. At the time of analysis there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified; the practical exposure is driven almost entirely by the network reachability of the OAM Authentication Engine endpoint, with internet-facing gateways the highest priority to patch.

Authenticated low-privileged users can fully take over Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 by sending crafted HTTP requests to the Portlet Services component. Oracle's Critical Security Patch Update rates this 8.8 with complete loss of confidentiality, integrity and availability of the portal, meaning an attacker with any valid low-privilege account can seize control of the application. No public exploit code or CISA KEV listing is known at time of analysis, so exploitation is currently limited to attackers who already hold credentials, though the low attack complexity makes weaponization plausible once a proof of concept surfaces.

Low-privileged, authenticated attackers with network access over HTTP to the Composer component of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can fully take over the affected deployment, with the scope change (S:C) meaning impact can extend into other connected Oracle Fusion Middleware products. Oracle rates the flaw as 'easily exploitable' with low attack complexity, no user interaction, and complete loss of confidentiality, integrity, and availability (CVSS 3.1 base score 9.9, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The practical bar is a valid low-privilege account, which makes this a genuine high-priority issue for internet- or broadly reachable WebCenter Portal instances rather than a theoretical high-score artifact; no public proof-of-concept and no CISA KEV entry were identified at time of analysis, so there is no public exploit identified at time of analysis.

Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the affected Access Manager instance, rated CVSS 3.1 9.8 (CWE-287, Improper Authentication) with high confidentiality, integrity, and availability impact. The vulnerable component is the Authentication Engine itself, and the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms no credentials, privileges, or user interaction are required, so any HTTP-reachable OAM deployment of those two versions is a candidate entry point. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); however, Oracle characterizes it as easily exploitable, so internet-exposed OAM instances should be treated as urgent.

Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 contain a flaw in the Authentication Engine component that lets a high-privileged attacker with HTTP network access fully compromise the product, taking over the authentication service itself (CVSS 3.1 base 9.1, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Because the score includes a scope change (S:C), a successful attack can spill over and significantly impact other products and applications that rely on OAM for authentication, turning a single privileged compromise into a broader identity-layer incident. The critical caveat is the PR:H prerequisite: this is a post-authentication, privileged-abuse issue rather than an unauthenticated remote takeover, so realistic exposure centers on malicious insiders, stolen or misused administrative credentials, or chained privilege-escalation paths. No public exploit code or confirmed exploitation was identified at time of analysis, and the weaknesses make it a priority for patch cycles rather than emergency internet-facing response.

Full takeover of Oracle Access Manager (OAM) is achievable by a low-privileged, authenticated attacker who can reach the Authentication Engine component over HTTP, with no user interaction and low attack complexity, yielding a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Only OAM 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware are listed as affected, but the scope-change rating (S:C) means a successful compromise of the Authentication Engine is not contained to OAM and can significantly impact other products that trust OAM for authentication and federation. No CISA KEV listing and no public exploit code were identified at time of analysis; the practical gate is the requirement for a valid low-privileged account rather than exploit sophistication, which makes this a genuine high-priority issue for any internet-reachable or partner-federated OAM deployment.

Unauthenticated remote attackers can bypass authentication in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0, gaining full read and write access to all data managed by the affected component. This easily exploitable vulnerability (CVSS 9.1) requires only network access to the OAM authentication engine over HTTP and no credentials or user interaction. No public exploit code or active exploitation has been observed at the time of analysis, but the lack of authentication and high impact make it a critical risk for exposed instances.

Improper access control in the OIM Legacy UI component of Oracle Identity Manager (12.2.1.4.0 and 14.1.2.1.0) lets a network-positioned attacker who already holds a highly privileged account read and alter identity and provisioning data, with a scope change that can cascade into other connected Oracle products. Oracle rates it 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N), so exploitation is trivial once administrative access is obtained but is gated by that high-privilege requirement. No CISA KEV listing, public exploit code, or EPSS score was supplied with this record, so active exploitation is not confirmed (no public exploit identified at time of analysis).

Low-privileged attackers with network access can achieve full takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 through a flaw in the OIM Legacy UI component of Oracle Fusion Middleware. Successful exploitation compromises confidentiality, integrity, and availability of the identity platform itself, which typically means control over the accounts, roles, and provisioning workflows it governs. The vulnerability is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N), requires only an authenticated low-privilege session, and no public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.

Unauthenticated attackers with network access to Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 can compromise the Authentication Engine component over HTTP, obtaining unauthorized read access to critical data or all data accessible through the product. Oracle rates this CVSS 3.1 8.6 with a scope change (S:C), meaning affected deployments can be leveraged to significantly impact downstream/connected applications that trust OAM identities. At time of analysis there is no public exploit code identified and no CISA KEV listing, but the attack is trivially automatable (AV:N/AC:L/PR:N/UI:N), so internet-exposed OAM consoles and SSO endpoints should be treated as high priority.

Unauthenticated network attackers who can reach the T3 or IIOP listener fronting Oracle Access Manager's Authentication Engine on versions 12.2.1.4.0 or 14.1.2.1.0 can bypass authentication and take full control of the component, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No credentials or user interaction are required; the only meaningful precondition is that the T3/IIOP protocols are reachable from the attacker's position, so deployments that restrict those protocols to trusted internal networks are not externally exploitable. This vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis, but the combination of a perfect-exploitability CVSS vector, an authentication-bypass root cause, and default-exposed WebLogic remoting protocols makes it a high-priority patch target.

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a flaw in the Authentication Engine component that lets a high-privileged, network-positioned attacker read, create, delete, or modify data managed by the OAM deployment — and because the flaw crosses a security scope boundary, downstream applications that trust OAM for identity can be affected as well. The CVSS 3.1 base score is 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting an easily triggered but credentialed attack with high confidentiality and integrity impact and no availability impact. No public exploit code, EPSS score, or CISA KEV listing is present in the supplied intelligence, so it is treated as not yet publicly exploited at time of analysis; Oracle ships fixes through its Critical Patch Update / Security Alert program referenced in the advisory link.

Authentication weaknesses in the Oracle Access Manager Authentication Engine expose deployments running 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware: an attacker with network access over HTTP and only a low-privileged foothold can bypass or subvert authentication to create, delete, or modify critical data and read data across the OAM-accessible estate, while also degrading service availability. Because the CVSS vector carries a scope change (S:C), a compromise of OAM can propagate to other products that rely on it as their single sign-on and identity provider, which is what pushes the base score to 9.9 rather than the more typical 8.x for an authenticated-only flaw. No user interaction is required and attack complexity is low, though the PR:L rating means the attacker must already hold at least minimal valid access or be able to reach an authenticated interface - this is not a fully unauthenticated pre-auth bypass. There is no CISA KEV listing and no public exploit code identified in the available intelligence, so exploitation is not confirmed actively exploited (CISA KEV) and no public exploit identified at time of analysis.

Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated remote attacker with HTTP network access compromise the product's Authentication Engine and take over the affected instance. Rated CVSS 3.1 base 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), the scope-change flag means a successful compromise propagates to downstream applications that trust OAM for authentication, widening impact well beyond the OAM host itself. No public exploit has been identified at time of analysis, but the pre-auth, network-reachable attack path makes this a top-tier priority for any organization running the two named versions.

Full takeover of Oracle Identity Manager is achievable by any low-privileged authenticated user who can reach the application's HTTP interface in versions 12.2.1.4.0 and 14.1.2.1.0 (Oracle Fusion Middleware, Core component). The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), meaning a single authenticated request chain can hand an attacker administrative control over the identity governance platform. No CISA KEV listing, EPSS score, or public proof-of-concept was supplied in the source data, so exploitation status is currently unconfirmed and no public exploit has been identified at time of analysis.

Oracle Identity Manager (OIM), the identity-governance component of Oracle Fusion Middleware, is exposed to a takeover-level flaw in its Core component affecting versions 12.2.1.4.0 and 14.1.2.1.0. An attacker who holds a low-privileged account and can reach the T3 or IIOP listener over the network can exploit the defect to fully compromise the OIM deployment, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). No public exploit code or CISA KEV entry was present in the supplied intelligence, and the accompanying 'Information Disclosure' tag understates the reported impact — the vector's C/I/A metrics are all High.

Unauthenticated, network-positioned attackers can fully take over Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 by bypassing authentication in the Core component (CVE-2026-70913), which carries a CVSS 3.1 base score of 9.8 using the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Oracle characterizes the flaw as easily exploitable over HTTP, meaning no credentials, no user interaction, and no non-default configuration are required - only HTTP reachability to an affected instance - and successful exploitation gives complete loss of confidentiality, integrity, and availability on the identity platform. No public exploit code or confirmed active exploitation was identified at time of analysis, but the zero-prerequisite exploitation profile makes any internet- or broadly reachable OIM deployment a top-priority exposure.

Unauthenticated remote takeover of Oracle WebLogic Server is achievable through its T3 and IIOP protocol listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Classified as CWE-287 (Improper Authentication) and scored CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw allows any network-reachable attacker - no credentials, no user interaction - to gain full confidentiality, integrity, and availability impact over the affected server, which Oracle itself rates 'easily exploitable'. Exploitation hinges on reachability of the T3/IIOP listeners, which are enabled by default on the WebLogic administration and managed-server listen ports, meaning most standard deployments are exposed unless those protocols are filtered, disabled, or network-segmented; no public exploit code or confirmed in-the-wild activity was identified at time of analysis, so exposure should be treated as high-impact and high-priority but not yet observed as actively exploited.

Authentication bypass in Oracle WebLogic Server (Core component) allows unauthenticated, network-positioned attackers to gain full takeover of the server, earning the maximum CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with complete confidentiality, integrity, and availability impact. All four supported branches are affected: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Exploitation requires reachability of the T3 or IIOP protocol listener (commonly port 7001) with no authentication and no user interaction, and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV, so exposure is primarily governed by whether T3/IIOP is reachable from untrusted networks.

Unauthenticated remote takeover of Oracle WebLogic Server is achievable via the T3 and IIOP listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, where an improper-authentication defect (CWE-287) in the Core component of Oracle Fusion Middleware lets a network attacker bypass login and obtain full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The only real precondition is reachability of the T3/IIOP listener, which is enabled by default and usually shares the WebLogic HTTP port (7001); no credentials and no user interaction are required, so environments that firewall, disable, or connection-filter T3/IIOP materially reduce exposure. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but this is a genuine high-priority vulnerability rather than a CVSS-inflated one.

Authentication bypass in the Apache Airflow Keycloak auth manager provider (apache-airflow-providers-keycloak below 0.10.0) lets a remote attacker exchange credentials belonging to any confidential client in a shared Keycloak realm for a signed Airflow session token, even though those credentials have nothing to do with Airflow. The unauthenticated POST /auth/token client_credentials grant performed no allowlist check on client_id, so an unrelated application's service-account secret became a valid Airflow login; the resulting access is limited to whatever that service account is authorized for per subject, plus endpoints gated only on being authenticated. Exploitation requires a non-default topology - a Keycloak auth manager deployment whose realm is shared with at least one other confidential client - and the attacker must already hold valid credentials for one of those clients; no public exploit code has been identified at time of analysis, EPSS is low (0.19%, 9th percentile), and a vendor patch is available in provider version 0.10.0.

HTTP request smuggling in http4s Ember (all releases prior to 0.23.35 and 1.0.0-M47) lets an unauthenticated remote attacker bypass front-end proxy controls by sending duplicate Content-Length headers with differing values, because the Ember HTTP/1.1 parser accepts the conflict and frames the message using the last value instead of rejecting it as a framing error. When Ember runs behind a keep-alive intermediary that selects a different occurrence, the attacker can prepend a smuggled request to a later user's connection, capture that user's headers, or poison a shared cache; the same shared parser can also misframe upstream responses when an http4s client proxies for multiple downstream consumers. No public exploit code or CISA KEV entry was identified at time of analysis, but the CVSS 8.7 scope-changed rating makes this a priority fix for exposed Scala services sitting behind reverse proxies, CDNs, or load balancers.

Request smuggling in the http4s Ember HTTP/1.1 parser lets an unauthenticated, remote attacker bypass front-end access controls, splice a victim request onto an attacker-controlled prefix, or poison a caching layer, but only where ember-server runs as an origin behind a keep-alive intermediary that forwards both Transfer-Encoding and Content-Length headers and frames the body by Content-Length while Ember frames by chunked (a CL.TE mismatch); a standalone Ember server with no fronting proxy is not exploitable, and the client path only desyncs when a malicious or compromised upstream sends both headers over a pooled ember-client connection. The flaw affects http4s-ember-core 0.23.34 and earlier in the 0.23.x line, plus 1.0.0-M1 through 1.0.0-M46, with a parser that fails to treat dual-framed messages as the framing error RFC 9112 §6.1 requires; the vendor-assessed CVSS 4.0 score is 9.2, with the topology dependency captured by the AT:P metric. Fixed in 0.23.35 and 1.0.0-M47 (vendor-released patch); no public exploit identified at time of analysis, and CISA SSVC records exploitation as none.

Permission bypass in the cellular modem firmware of Google Android/Pixel devices allows a nearby unauthenticated attacker to escalate privileges without user interaction, achieving total technical impact (C:H/I:H/A:H) via crafted radio signaling. This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, though exploitation requires radio/RF proximity to the target baseband (adjacent, not Internet-remote) and SSVC deems it non-automatable. EPSS is low at 0.11% (2nd percentile).

Authentication bypass in Android's IP Multimedia Subsystem (IMS) telephony stack lets an attacker who can reach a device's IMS/SIP signaling path escalate privileges remotely, with no user interaction and no prior authentication required per the vendor vector (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is a logic error (CWE-693, Protection Mechanism Failure) affecting unpatched Android builds - the CPE entry covers all Android versions until the 2026-09-01 security patch level is applied. Exploitation in practice most plausibly requires an adjacent or carrier-network foothold, such as a compromised or malicious IMS core or a rogue base station, because the vulnerable path is the telephony signaling channel rather than an arbitrary Internet-facing service; no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low (0.20%, 10th percentile), so the high severity stems from the potential impact if reachable rather than from observed exploitation.

Authorization bypass in Apache ZooKeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 lets remote attackers delete empty persistent, container, and TTL znodes by sending a raw deleteContainer opcode (20) to the client port - 2181 by default - without any credentials or ACL grant, because that code path skips both the session check and the DELETE ACL check enforced by the normal delete path. The official client exposes no API for this internal-only opcode, so exploitation requires hand-crafting the ZooKeeper wire protocol, and non-empty nodes cannot be removed directly. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) the impact is integrity-only, and no public exploit code has been identified at time of analysis with EPSS at 0.24% (16th percentile); practical risk is governed mainly by whether port 2181 is reachable from outside the trusted application or ensemble network.

Missing authentication for a critical function in Dell Wyse Management Suite (WMS) versions prior to 2605.0.3.683 lets a remote attacker reach protected functionality without supplying any credentials, resulting in unauthorized access with high confidentiality and integrity impact per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1). Affected deployments are WMS consoles (CPE cpe:2.3:a:dell:wyse_management_suite) that sit on management networks and expose the unauthenticated endpoint; because exploitation requires no authentication or user interaction, the practical barrier is network reachability rather than attacker capability. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score of 0.25% (17th percentile) indicates low predicted exploitation activity over the next 30 days, so operational urgency is driven primarily by how exposed a given console is.

Account takeover of non-superuser accounts is possible in Concrete CMS 9.2.0 through 9.5.2 because the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password) fail to enforce per-field edit_user_properties permissions. An attacker holding an OAuth token scoped for updates and permission to edit only one non-sensitive field on another user can rewrite that user's password, username, email, and attributes, fully seizing the account; superuser accounts are explicitly out of reach. There is no public exploit identified and no CISA KEV listing at time of analysis, so this currently represents a targeted, credential-gated authorization defect rather than a mass-exploitation event. Concrete CMS rated it CVSS v4.0 7.4 (CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N).

Authenticated users of GitLab CE/EE can read CI/CD variables that are scoped to environments they are not entitled to, because the environment scope pattern matcher fails to validate scope input correctly. The flaw affects all versions from 15.7 up to 19.1.7, 19.2.5, and 19.3.1, with fixes in 19.1.8, 19.2.6, and 19.3.2. Public exploit code exists (referenced via a HackerOne report), the issue carries a CVSS of 7.7 with a confidentiality-only, scope-changed profile, and there is no CISA KEV listing indicating confirmed active exploitation at time of analysis.

Bambuddy, a self-hosted print archive and management system for Bambu Lab 3D printers, fails open when its database is unavailable: versions from 0.1.6 up to (but not including) 0.2.4.4 catch every exception in the authentication probe and treat the failure as 'auth disabled', granting unauthenticated access to every protected endpoint. A remote attacker with no credentials can force the condition by flooding the public /api/v1/auth/login endpoint until the process exhausts its file-descriptor budget so the next SQLite connect() raises, then timing requests into that transient window to create a persistent admin account or API key, download the database backup (hashed passwords, encryption keys, printer access codes, MFA secrets), alter settings, or control printers. Vendor/CISA scoring is critical (CVSS 4.0 9.3; vendor advisory states 9.8), while independent assessment rates it high with high attack complexity because the bypass exists only during the resource-exhaustion window; no public exploit code identified at time of analysis, no KEV listing, and CWE-636 (Failing Open) is the root class.

IBM Verify Identity Access (and its predecessor Security Verify Access) contains an improper authorization flaw that lets an administrator with limited entitlements execute additional commands beyond their granted privileges by supplying specially crafted input to the product's administrative functionality. The flaw carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity and availability impact but requiring an existing privileged account to reach. No public exploit code or CISA KEV entry was identified at time of analysis, and IBM has published a vendor fix via its support advisory.

Improper authorization in Atlassian Jira Service Management Data Center 11.3.0 through 11.3.10 lets an authenticated, low-privileged attacker reach functionality and data they should not be able to access, with the vendor scoring it 7.1 in CVSS 4.0 (AV:N/AC:L/PR:L/UI:N/VI:H). Atlassian states the flaw was discovered through its own penetration-testing program and that the impact could extend from exposure of sensitive resources to arbitrary code execution, though the published CVSS 4.0 vector only credits a high integrity impact and rates confidentiality and availability as none. No CISA KEV listing, EPSS score, or public exploit code was provided in the source data, so at time of analysis this should be treated as a confirmed but not yet observed-in-the-wild authorization bypass; patched versions (11.3.11 and later) are already available.

An improper authorization flaw in Atlassian Confluence Data Center lets an authenticated, low-privileged user reach resources and functionality they should not be able to access, resulting in high confidentiality impact against the affected instance. The defect was introduced across a broad set of release trains — 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 — meaning most currently maintained Data Center deployments built on those lines are exposed until upgraded. Atlassian rates the issue 7.1 (CVSS 4.0, AV:N/AC:L/PR:L/UI:N/VC:H) and has shipped fixes in 9.2.24 and 10.2.17; there is no evidence of public exploit code or confirmed active exploitation at time of analysis.

Stored cross-site scripting in Concrete CMS lets any user holding page-editing permissions — for example Add Block combined with Edit Contents on a single page — plant a crafted external link value in Feature, Feature Link, Hero Image, or Image blocks that breaks out of the link markup and injects JavaScript. Because the payload is persisted and rendered without output escaping, the script executes in the browser session of every user who later views, previews, or edits that page, enabling session hijacking and privilege escalation up to full administrative takeover. The vendor scored this 8.5 (CVSS v4.0, PR:H/UI:P); no public exploit code or CISA KEV entry was provided at time of analysis, so exploitation is currently a realistic internal-threat and low-privileged-editor risk rather than a confirmed internet-wide campaign.

Unauthenticated user enumeration in Concrete CMS 9.0.0 through 9.5.2 allows any anonymous visitor to dump the complete backend account list — including internal user IDs, usernames and email addresses of every administrator and the super-administrator (user ID 1) — by sending an empty search to the /ccm/system/user/autocomplete endpoint and paginating the results. The endpoint enforces only a CSRF-style token that is bound to the selector's display options rather than to caller identity, and that token is handed out to anonymous visitors, so there is no authentication or privilege barrier to clear. No password hashes or session material leak, but the disclosed email and account inventory is a ready-made target list for credential stuffing, phishing and password-spray campaigns against named admins; no public exploit code and no CISA KEV entry are present in the supplied intelligence.

Any authenticated user of a Payload CMS instance running @jhb.software/payload-cloudinary-plugin (0.3.0 through 0.3.x, fixed in 0.4.0) can obtain a cryptographically valid Cloudinary HMAC-SHA1 upload signature for parameters of their choosing, because the client-upload signing endpoint POST /api/cloudinary-generate-signature forwards attacker-controlled 'paramsToSign' straight to cloudinary.utils.api_sign_request() with no key allowlist, folder policy, or timestamp check. With that signature plus the intentionally client-visible Cloudinary API key, an attacker can overwrite existing assets, flip upload visibility with type=private, register notification_url callbacks to attacker-chosen hosts, force cache invalidation, and write files outside the intended upload folder. The issue is only reachable when the plugin's clientUploads option is enabled, and no public exploit code or active-exploitation reporting was present in the supplied intelligence.

Authentication bypass in BookStack social login (all versions before 26.05.5) allows unauthenticated attackers to sign in as arbitrary users, enabling full account takeover of both regular accounts and administrators. The flaw is a provider-confusion bug in SocialAuthService::handleLoginCallback, which retrieves linked-account records by driver_id while ignoring the driver column, so an attacker who authenticates at one enabled social provider using a user ID that collides with a victim's driver_id under a different provider is accepted without credential verification. No public exploit identified at time of analysis (CISA SSVC exploitation: none; no KEV listing), and successful exploitation requires two enabled social providers sharing an overlapping driver_id namespace plus attacker control of a matching provider account, which is why vendor scoring lands at CVSS 9.1 while our independent vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) caps the attack at high complexity.

Authorization bypass flaws in the 'Design Scuole Italia' WordPress theme (design-scuole-wordpress-theme, versions up to and including 2.17.3) let an unauthenticated remote attacker reach content and data that should require a logged-in, authorized user. The faulty routines are the dsi_pdf_generator and dsi_csv_generator functions, and an unauthenticated RSS feed at /circolare/feed/ gives an additional, easily scriptable path to the same restricted 'Circolare' records and registered-user information. With a CVSS 4.0 base score of 8.7, no privileges or user interaction required, and high confidentiality impact, this is a straightforward data-exposure bug in a theme deployed mainly on Italian school websites; no public exploit code or CISA KEV entry was identified at time of analysis.

Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered by the application's anti-brute-force controls, letting a remote unauthenticated attacker send an unlimited number of credential-guessing requests. Successful guessing against password-only accounts yields full read access to the victim's tasks, projects, and feeds data. The vendor has released 2.6.0 as the fix; no public exploit code or active exploitation has been confirmed in the supplied intelligence.

Unauthenticated remote attackers can bypass the RDSTLS-disabling policy on FreeRDP servers 3.0.0 through 3.30.0 by sending incompatible protocol requests that produce a negotiation failure, then completing a TLS handshake and entering RDSTLS anyway, defeating the intended pre-authentication transport restriction. The vendor CVSS 4.0 base score is 9.2, but our independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting a policy bypass with limited confidentiality and integrity impact rather than direct code execution; no public exploit was identified at time of analysis. Only network-reachable FreeRDP server-mode deployments with RDSTLS administratively disabled are affected, while client-side FreeRDP deployments are not impacted.

Broken object-level authorization in Flowise's openai-realtime endpoints lets any authenticated user read tool definitions and execute tools belonging to ChatFlows in other workspaces by supplying an unscoped chatflowid, with both GET and POST requests affected. The flaw is fixed in Flowise 3.1.4 and affects all earlier releases; it is tracked as CWE-639 (authorization bypass through user-controlled key). No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS data was not supplied with this record, so risk should be judged from the authenticated-but-cross-tenant access model rather than from observed exploitation.

Cross-tenant authorization bypass in Flowise Enterprise endpoints (all versions before 3.1.4) allows an authenticated Enterprise user to operate on resources owned by other organizations — deleting arbitrary workspaces, inviting themselves into other tenants, modifying cross-organization roles, and reading or abusing stored SSO secrets. The root cause is CWE-862 (missing authorization): affected endpoints act on caller-supplied resource identifiers without verifying tenant ownership. Rated CVSS 7.6 (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L), reachable over the network but requiring low-privileged Enterprise access; a vendor patch is available in 3.1.4, and no public exploit has been identified at time of analysis.

Session fixation in Dell SmartFabric OS10 Software versions prior to 10.6.1.3 allows remote, unauthenticated attackers to plant or predict a management session identifier and subsequently hijack that session once a legitimate administrator logs in, resulting in session theft with the full privileges of the compromised account. Dell's published CVSS 3.1 vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but that score overstates the issue on two counts: successful exploitation hinges on a victim authenticating into the attacker-controlled session (effectively a user-interaction requirement, UI:R), and the real-world impact is bounded by the privileges of the hijacked account, making confidentiality and integrity exposure meaningful but not unconditional. There is no public exploit identified at time of analysis - CISA SSVC records no observed exploitation and no proof-of-concept code is referenced - and the attacker can only realize impact through a victim-logon step, so the practical risk is lower than the raw 9.8 suggests while still warranting prompt patching of internet- or management-plane-reachable deployments.

An authentication bypass in OpenBMC's phosphor-net-ipmid IPMI stack lets a network attacker with no credentials complete IPMI 2.0 RAKP session authentication and obtain full BMC control. A crafted RAKP Message 1 forces the handler to return before the authentication object's constructor defaults are overwritten, so the service accepts a RAKP Message 3 whose HMAC is keyed with the hard-coded 20-byte 'userKey' derived from the string '0penBmc' combined with an often-predictable 'bmcRandomNum'. The flaw affects downstream vendors that ship phosphor-net-ipmid as their IPMI implementation, including NVIDIA and H3C, and runZero published a public advisory; no CISA KEV entry or EPSS score was supplied, and no patched version was identified in the provided data.

Privilege escalation in OpenBMC's phosphor-net-ipmid IPMI stack allows an attacker who already holds a valid low-privileged IPMI session to redirect that session's authorization context to a different, higher-privileged account while the original integrity and encryption keys stay in place, so no re-authentication ever occurs. Downstream vendors that package phosphor-net-ipmid — NVIDIA and H3C among them — inherit the flaw in their BMC firmware. Rated CVSS 8.8 with high confidentiality, integrity and availability impact; no public exploit code identified at time of analysis, and the issue is not listed in CISA KEV.

Mozilla Firefox builds before 156 (and Firefox ESR builds before 153.3) can be induced to bypass an existing browser security mitigation through attacker-influenced web content that exercises the DOM: Networking component, yielding high confidentiality and integrity impact without granting outright code execution. The vendor rates this 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), but our independent assessment adjusts the vector to UI:R, since the victim must actually load the malicious page for the bypass to trigger - a normal precondition for a client-side browser flaw. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), so near-term real-world risk is limited despite the critical score.

Cross-organization user administration takeover in Casdoor through 4.4.0 allows any holder of a single application's clientId and clientSecret to act on user accounts across all organizations. The flaw is an authorization bypass in the /api/mcp endpoint that exposes password salts, email addresses, and account creation/modification/deletion capabilities. Public exploit documentation exists, but no active exploitation status or EPSS data was provided.