Authentication Bypass

Unauthenticated HTTP requests against Oracle Helidon deployments that use the helidon-dbclient-mongodb component can let a remote attacker read or modify MongoDB-backed data and cause a partial denial of service in versions 3.0.0–3.2.20 and 4.0.0–4.5.4. Oracle rates this CVSS 3.1 base 7.0 with high attack complexity (AV:N/AC:H/PR:N/UI:N), meaning successful exploitation depends on conditions that are difficult for an attacker to arrange. No public exploit code or CISA KEV listing was provided at time of analysis, so this should be treated as a patch-priority issue rather than an emergency.

Oracle Siebel CRM Deployment (Siebel Management Console) in versions 17.0 through 26.7 fails to properly restrict what a low-privileged, network-connected user can reach, letting that user read critical deployment data and make limited unauthorized changes. Exploitation is trivial once a valid low-privilege account exists: CVSS 3.1 scores it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N), with the confidentiality impact rated High and integrity impact Low. There is no public exploit code and no CISA KEV listing at time of analysis, so this is currently a patch-on-schedule item for Siebel shops rather than an emergency, though EPSS data was not supplied and the untrusted-network exposure of the management console should drive prioritization.

Oracle Siebel CRM Deployment (Server Infrastructure component) in supported releases 17.0 through 26.7 exposes critical CRM data to a low-privileged, network-positioned attacker who can reach the deployment service over HTTP, and also allows that attacker to partially degrade availability. Oracle rates it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/A:L) and describes it as easily exploitable in its cspusep2026 security alert; there is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the source data.

Oracle Siebel CRM Integration (EAI component) versions 17.0 through 26.7 expose a network-reachable SOAP interface that fails to properly restrict operations for authenticated low-privileged users, letting an attacker read critical CRM data and perform limited unauthorized inserts, updates, or deletions. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N) and is rated 'easily exploitable' by the vendor, requiring only a valid low-privilege account and network reachability to the EAI endpoint. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.

Oracle Siebel CRM Integration versions 23.6 through 26.7 expose the Event Publish and Subscribe component to unauthenticated attackers who can reach the server from the same network segment, allowing them to read, create, delete, or modify critical CRM data (CVSS 3.1 base 8.1, AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:N). Because the attack vector is adjacent network rather than internet-facing, exposure is gated by network topology rather than by credentials, and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis. Exploitation probability scoring (EPSS) was not supplied with the source data, so prioritization should rest on asset criticality and segment reachability.

Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.7, allows an attacker who already holds a low-privileged logon on the host where the deployment component runs to read, create, modify, and delete all data accessible to that deployment. The vulnerability is locally exploitable with low complexity and no user interaction, but it does not grant entry to the host itself — it escalates what an existing low-privileged account can reach across the Siebel deployment layer, producing high confidentiality and integrity impact (CVSS 3.1 base 7.1) with no availability impact. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score, CWE mapping, or confirmed fix version was supplied with the source data.

Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contain an authentication-related flaw that lets a remote, unauthenticated attacker over HTTP read, create, delete, or modify critical deployment data - CVSS 3.1 base 7.4 with high confidentiality and integrity impact. Exploitation is rated difficult (AC:H), presumably because the attacker must meet a hard-to-satisfy protocol or timing condition, but no privileges or user interaction are required if that condition is met. Oracle has published a fix via its Critical Security Patch Update advisory; active exploitation is not confirmed and no public exploit code was identified in the supplied intelligence.

Improper access control in the Open UI component of Oracle Siebel CRM (End User) versions 17.0 through 26.7 lets an authenticated low-privilege user issue crafted HTTP requests that expose and modify data beyond their authorized scope. Successful exploitation yields high confidentiality impact — unauthorized read of critical Siebel data — plus limited integrity impact via unauthorized insert, update or delete operations; availability is unaffected (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). No CISA KEV listing, public exploit code or EPSS signal is present in the supplied intelligence, so this is currently a patch-cycle priority rather than a confirmed actively exploited issue.

Unauthenticated attackers with HTTP network reachability to the Siebel CRM Deployment component of Oracle Siebel CRM can bypass authentication and gain unauthorized access to critical data, plus limited ability to update, insert, or delete records. The flaw affects supported Siebel CRM versions 17.0 through 26.7 and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N). No public exploit code or active exploitation has been identified from the available intelligence at time of analysis.

Unauthenticated remote attackers with HTTP access to the Reports component of Oracle Siebel CRM End User (versions 17.0 through 26.7) can bypass intended access controls and read data they should not be able to reach, giving them unauthorized access to critical data or the full set of data accessible to the Siebel CRM End User application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), meaning it is trivially reachable and requires no credentials or user interaction, but it does not permit data modification or denial of service. No public proof-of-concept, EPSS score, or CISA KEV listing was supplied with this report, so active exploitation is not confirmed at time of analysis.

Unauthenticated network attackers can reach the Open UI component of Oracle Siebel CRM End User (versions 17.0 through 26.7) over HTTP and gain unauthorized read access to critical data, limited insert/update/delete access, and the ability to partially degrade availability. Oracle rates the issue CVSS 3.1 base 8.6 (AV:N/AC:L/PR:N/UI:N), meaning no credentials or user interaction are needed; the accompanying tags indicate an authentication-bypass class flaw. There is no CISA KEV entry, no EPSS score, and no public exploit identified at time of analysis, and Oracle has published the fix through its Critical Security Patch Update advisory.

We need answer in JSON only. Need synthesize. Let's inspect input carefully. CVE: CVE-2026-83202. Description: Vulnerability in Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions affected 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 9.1 (C/I impacts). Vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. CWE-287 authentication bypass? Actually CWE-287 Improper Authentication. Tags: Authentication Bypass, Oracle. Reported by Oracle. SSVC Exploitation none, Automatable yes, Technical Impact total. ENVD EUVD ID. References Oracle security alert cspusep2026.html and NVD. No KEV listed? Not given. EPSS? not given. POC? not given. Patch? Not explicitly but Oracle advisory. Need synthesize. We need obey: product_name 1-3 words. "Siebel CRM Deployment" maybe 3 words? Oracle Siebel CRM? Product is Siebel CRM Deployment. product_name could "Siebel CRM Deployment" (3 words) or "Siebel CRM" maybe. It says product of Oracle Siebel CRM. Use "Siebel CRM Deployment". summary: must not copy description. Start with specific impact verb and product. e.g. "Unauthenticated HTTP access to Oracle Siebel CRM Deployment 17.0–26.7 can lead to complete compromise of data confidentiality and integrity via an authentication bypass in Server Infrastructure." Mention no KEV/POC? "No public exploit identified at time of analysis" maybe. Need mention CVSS 9.1, EPSS absent? Since no EPSS data. "No EPSS score supplied." Its not necessary? Summary should mention if actively exploited (KEV), if POC exists, EPSS risk if notable. Since not available, can state no public exploit identi

We need answer as JSON. Need synthesize. Need be careful. We have CVE Oracle Siebel CRM Deployment. Description says affects 17.0-26.7. Easily exploitable unauthenticated network via HTTP compromise. Impact unauthorized create/delete/mod and unauthorized access critical/all data. CVSS 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. No CWE. Tags: Authentication Bypass, Oracle. Reference Oracle advisory. No KEV mentioned, no EPSS, no POC. Need produce all fields strings. product_name: "Siebel CRM Deployment" (1-3 words? Siebel CRM Deployment is 3). Summary original, not copy description, mention no active exploitation, no public exploit, CVSS 9.1, unauth HTTP. Technical context: Oracle Siebel CRM Deployment component Server Infrastructure, HTTP protocol, likely authentication bypass allows unauthorized access. CPE absent? We have affected product names, no CPE strings. Mention no CPE data provided maybe. CWE N/A, but Tags authentication bypass. Root cause class likely missing authentication/authorization, possibly CWE-306 or 287 but not confirmed. We can say data doesn't specify. Risk assessment: Use CVSS vector. EPSS not provided, so state missing. KEV not listed, no POC. SSVC: exploitation none, automatable? AV:N AC:L PR:N UI:N likely automatable; technical impact partial? Oracle says critical data breach integrity, availability none. Real priority? CVSS 9.1 high, but without EPSS/POC/KEV unknown. Compare. State conflicts/missing: no EPSS score, no KEV status, no POC; CWE N/A; CVSS suggests unauthenticated network, description matches. Maybe "EPSS data missing — cannot compare to CVSS; no public exploit identified at time of analysis" etc. "Authentication Bypass" tag suggests root cause but not official CWE. Affected products: Siebel CRM Deployment versions 17.0 through 26.7 (inclusive? Description says 17.0-26.7 supported affected). Advisory: Oracle security alert cspusep2026. No CPE provided. Mention no explicit CPE in data. Need include link. Remediation: Oracle advis

We need answer as JSON. Need synthesize. We have CVE description. Need produce all fields. Let's inspect data. CVE-2026-83197. Product: Siebel Apps - Financial Services from Oracle Siebel CRM. Component: Financial Accounts. Supported versions affected 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise. Successful attacks result in unauthorized access to critical data or complete access to all Siebel Apps - Financial Services accessible data and unauthorized ability to cause hang or frequently repeatable crash (complete DOS). CVSS 3.1 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. CWE N/A. Tags: Authentication Bypass, Oracle. EUVD. References Oracle security alert, NVD. Need fields: product_name: "Oracle Siebel CRM" perhaps product specifically "Siebel Apps - Financial Services". 1-3 words. Could be "Siebel Financial Services" or "Oracle Siebel CRM". The description says product of Oracle Siebel CRM, component Financial Accounts. Specific product: Siebel Apps - Financial Services. That's 3 words? "Siebel Apps Financial Services" maybe. Let's choose "Siebel Apps - Financial Services"? It's 3 words? Actually "Siebel Apps - Financial Services" 3 tokens maybe okay. Or "Oracle Siebel CRM". The product_name should be specific affected product: "Siebel Apps - Financial Services". I think okay. Summary: Original synthesis. Need avoid starting "A vulnerability". Start with specific impact verb and product. "Unauthorized data access and denial of service in Oracle Siebel Apps - Financial Services 17.0 through 26.7 allows unauthenticated HTTP attackers to read critical or all accessible data and crash/hang the Financial Accounts component." Mention actively? KEV not in input, so no. POC not in data, so no public exploit identified. EPSS? no EPSS given. CVSS 9.1 high. Tags authentication bypass maybe implies auth bypass? Need synthesize. Say authentication bypass tag. Don't copy description. 2-3 sentences. Need not

Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an application-layer access-control weakness that lets a low-privileged user with network access to the EBS HTTP interface create, delete or modify critical calendar data and read a subset of calendar records. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), meaning no user interaction is needed but a valid low-privileged account is a prerequisite. No public exploit code or CISA KEV listing was provided in the source data, and no EPSS score was supplied, so active exploitation is currently unconfirmed.

Oracle Common Applications, a shared framework component of Oracle E-Business Suite (CRM User Management Framework), fails to properly restrict actions for low-privileged users in versions 12.2.3 through 12.2.15, allowing them to create, delete, or modify critical CRM data and read data they should not access. Exploitation is network-based over HTTP with low complexity, but requires the attacker to already hold a valid low-privileged account and to persuade another user to interact with a crafted request (CVSS 7.3, AV:N/AC:L/PR:L/UI:R). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was provided in the source data.

Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Core component of the Application Object Library that allows a remote, unauthenticated attacker with HTTP access to bypass authentication and gain unauthorized read and write access to critical application data. Oracle rates the issue 7.4 with a high attack complexity, reflecting that exploitation is possible over the network without credentials but requires conditions an attacker must engineer or discover. No public exploit code has been identified and the issue is not listed in CISA KEV, so at time of analysis this is a patch-now, high-impact confidentiality and integrity risk rather than a confirmed active campaign.

Unauthenticated remote attackers can reach the Workspaces component of Oracle Siebel CRM Development over HTTP and obtain unauthorized read access to critical application data while also degrading service availability (CVSS 3.1 base 8.2, AV:N/AC:L/PR:N/UI:N). Affected are all Siebel CRM Development releases from 17.0 through 26.7. There is no public exploit code or CISA KEV listing confirmed in the supplied intelligence, so the practical priority depends on whether the Workspaces HTTP interface is exposed beyond trusted internal networks.

Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker who already holds a valid account and can reach the application over HTTP. Successful exploitation gives the attacker unauthorized read, creation, modification, and deletion access to Calendar data and can also cause a partial denial of service, though Oracle rates the flaw as difficult to exploit (CVSS 3.1 7.1, AV:N/AC:H/PR:L/UI:N). No public exploit code or CISA KEV entry was provided in the intelligence feed, and the only authoritative reference is Oracle's Critical Patch Update advisory cspusep2026.

Low-privileged users of Oracle One-to-One Fulfillment (the Documents component of Oracle E-Business Suite 12.2.3 through 12.2.15) can read, create, delete, or modify critical fulfillment and document data over HTTP without any user interaction. Oracle assigns it a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning the attacker only needs network reachability plus a low-privileged account, not administrative rights. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data.

Improper authorization in the Application Framework component of Oracle CRM Technical Foundation (Oracle E-Business Suite 12.2.3–12.2.15) lets a low-privileged user with ordinary HTTP access to the instance read and alter critical CRM data that should be restricted to higher-privileged roles — integrity and confidentiality are both rated High, availability is unaffected. Oracle scores it 8.1 (AV:N/AC:L/PR:L/UI:N), meaning exploitation is straightforward but requires a valid low-privilege account rather than anonymous access. No public exploit code or active exploitation has been reported in the supplied intelligence, and no EPSS value was provided, so it should be treated as a patch-priority issue rather than an emergency.

Oracle One-to-One Fulfillment, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes unauthorized access to critical data and can be partially disrupted by an attacker holding only a low-privileged account with HTTP access to the application. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/A:L), the issue requires authentication but no user interaction, and yields high confidentiality loss plus a limited availability impact. There is no public exploit code and no CISA KEV entry at time of analysis, and no EPSS score was supplied; the vendor patch is published in the September 2026 Critical Patch Update advisory.

Oracle Sales Online, a component of Oracle E-Business Suite, is affected by an easily exploitable flaw in versions 12.2.3 through 12.2.15 that lets a low-privileged attacker with HTTP network access compromise the application and reach data outside its intended boundary (scope change). Successful exploitation can expose critical data or all Oracle Sales Online-accessible data, plus allow unauthorized insert, update, or delete of some records. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle's Critical Security Patch Update advisory (cspusep2026.html) is the authoritative fix reference and the CVSS 3.1 base score of 8.5 reflects high confidentiality and low integrity impact.

Authenticated low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the One-to-One Fulfillment 'Documents' component to read critical data outside their authorized scope and partially degrade availability of the module. The vendor-assigned CVSS 3.1 base score is 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L), reflecting high confidentiality impact with no integrity impact and only partial denial of service; the scope-change flag indicates that exploitation can significantly affect resources beyond the vulnerable component. There is no CISA KEV listing, no public proof-of-concept identified, and no EPSS data supplied, so exploitation is not confirmed to be active at time of analysis.

An unauthenticated remote attacker with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can bypass access controls in the Oracle Application Object Library (FND) Core component and read critical application data, per Oracle's own disclosure (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/C:H/I:N/AN). The flaw is fully automatable — no credentials, no user interaction, low complexity — making it attractive for mass scanning, though its impact is limited to confidentiality (no integrity or availability loss). No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, but no EPSS score was supplied, so real-world exploitation probability is unquantified.

Oracle E-Business Suite 12.2.3 through 12.2.15 contains a broken-authorization flaw in the Customer Interaction History module (Outcome-Result component) that allows a low-privileged user with HTTP access to read data well outside their intended privileges. Exploitation is trivial once an attacker holds any valid low-privileged EBS account, and Oracle's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) marks it as an easily exploitable, confidentiality-only issue whose scope change means other EBS modules can be affected. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical risk is driven by the enormous blast radius of an ERP holding financial, HR and customer records rather than by confirmed active exploitation.

Unauthenticated attackers able to reach the HTTPS interface of Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the Oracle Application Object Library (Core component) to create, delete, or modify critical data and to read data they should never see. The CVSS 3.1 base score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), meaning no credentials or user interaction are needed but successful exploitation depends on conditions the attacker must satisfy. No public exploit code has been identified and the flaw is not listed in CISA KEV, so it should be treated as a high-severity patch obligation rather than an actively exploited emergency.

Authenticated low-privileged users can compromise Oracle Project Intelligence within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) over HTTP, gaining unauthorized create, delete, and modify access to critical data along with read access to a subset of application data. Oracle rates the issue CVSS 3.1 base 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), reflecting a trivial-to-execute, low-privilege attack whose dominant impact is data integrity rather than availability or broad disclosure. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so exploitation status is unconfirmed.

Oracle E-Business Suite Applications Manager 12.2.3 through 12.2.15 lets a low-privileged attacker who already holds a logon on the host running Applications Manager read and tamper with critical data through the Command Line - RapidClone component. The flaw is a local-only, low-complexity authorization weakness (CVSS 7.1, AV:L/PR:L/UI:N) that yields high confidentiality and integrity impact with no availability impact, and no scoped privilege escalation beyond the component. No public exploit code has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.

Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contains an easily exploitable flaw that lets a low-privileged attacker positioned on the physical communication segment adjacent to the Siebel Deployment host read critical data and repeatedly crash the service. Successful exploitation yields complete confidentiality loss of all data accessible to Siebel CRM Deployment plus a repeatable denial-of-service condition, per the Oracle CPU advisory. No public exploit code or CISA KEV listing was identified at time of analysis, and EPSS data was not supplied for this CVE.

We need answer JSON only. Need synthesize. Need follow instructions. CVE-2026-83154 Oracle Siebel CRM End User Open UI SOAP vulnerability. Need produce fields. Need careful. We need use all data. Product_name: "Siebel CRM End User" probably. Single 1-3 words? "Siebel CRM End User" is 4 words but maybe product name. They said specific product name. Could use "Siebel CRM" maybe? Affected product is Siebel CRM End User. Use "Siebel CRM" (2 words). But product_name should specific. hmm. Input product: "Siebel CRM End User". 4 words; instruction 1-3 words. Could "Siebel CRM" or "Siebel CRM End User"? Need obey 1-3 words. Maybe "Siebel CRM" is primary product suite but affected is End User. Use "Siebel CRM". Summary: Need not copy description. Mention remote unauth network via SOAP, critical data read/write, no availability impact, CVSS 9.1. No KEV, no POC? Input no KEV/POC. EPSS? Not provided. Need mention POC absent and EPSS unknown/not available. "no public exploit identified..." Use phrase. Start with specific impact verb and product. E.g. "Unauthorized read and write access to critical data in Oracle Siebel CRM End User versions 17.0 through 26.7 can be achieved by an unauthenticated attacker sending SOAP requests over the network." That's good. Include if KEV no. Data: tags Authentication Bypass, Oracle, ENISA. No CWE. Need mention no patch? References has Oracle advisory URL. Likely patch available but not explicit version? We can infer Oracle security alert may include fixes but data no exact fix version. Need remediation maybe advise apply Oracle CPU July 2026? Wait URL cspusep2026 maybe Critical Patch Update? Use vendor advisory. The URL is https://www.oracle.com/security-alerts/cspusep2026.html. "cspusep2026" maybe maybe? Need not invent. We can say "Vendor advisory available; apply Oracle's recommended Siebel CRM fixes from July 2026 Critical Patch Update" even if no exact version. Need avoid inventing exact. "Patch available per vendor advisory" maybe patch

Improper authorization control in the Oracle Project Intelligence module of Oracle E-Business Suite allows a low-privileged authenticated user with network access to read, create, modify, or delete data across the module, including records the account should never reach. Affected releases are 12.2.3 through 12.2.15; the vendor's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N, base 8.1) indicates the flaw is trivially automatable once credentials exist, because no user interaction is needed. No public exploit code, KEV listing, or EPSS estimate was supplied with the available intelligence, so active exploitation should be treated as unconfirmed rather than assumed.

We need answer JSON only. Need synthesize. Need follow all requirements. Need parse input: CVE-2026-83151, description Oracle Fusion Middleware Service Delivery Platform component Messaging Enabler, affected 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable unauthenticated network via SOAP to compromise, takeover. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. Reported by Oracle. ENISA. References: nvd None? Actually reference URL oracle security alerts cspusep2026.html. Need cross-reference. Need produce fields. Need determine product_name: "Service Delivery Platform" maybe primary product, Oracle Fusion Middleware. 1-3 words only. Could be "Oracle Service Delivery Platform" (3 words). Good. Summary: not copy description. Need original synthesis. Include actively exploited? KEV? Not provided. Input has no KEV field. We must infer KEV status? There's no KEV status in provided. Need use only data. So likely no KEV. POC? not provided. EPSS? not provided. Need say no public exploit identified, EPSS not available perhaps. Summary: remote unauthenticated takeover via SOAP in Oracle Fusion Middleware Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0; CVSS 9.8; component Messaging Enabler. Need not start "A vulnerability". Start with specific impact verb: "Remote unauthenticated attackers can take over Oracle Service Delivery Platform via SOAP requests..." Use no "A vulnerability". Mention no KEV/POC/EPSS? Maybe "No CISA KEV entry or public exploit details were provided in the source data." Good. Technical_context: Underlying SOAP web service in Oracle Fusion Middleware Service Delivery Platform Messaging Enabler. CWE N/A, but maybe CWE unspecified. Use CPE? Input has not explicit CPE strings, just affected versions. Need say no CPE provided in source; version scope from ENVA. Root cause class not identified (CWE N/A). Could mention SOAP interface likely accepts untrusted XML/SOAP leading to compromise; CWE missing, but impact

We need answer JSON only. Need synthesize. Let's inspect input. CVE-2026-83149. Description says Oracle Application Testing Suite supported version affected 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker with Test Manager for Web Apps privilege with network access via HTTP. Scope change. Impacts confidentiality high, integrity low, availability low. CVSS 9.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L. Tags: Authentication Bypass, Denial Of Service, Oracle. References oracle advisory cspusep2026. No patch info? "Affected versions EUVD". No KEV, no POC, no EPSS? Not provided. Need mention missing. Product name: Oracle Application Testing Suite. Summary original synthesis. Need not copy description. Start impact verb and product. "Critical data exposure and limited integrity/availability impact in Oracle Application Testing Suite 13.3.0.1 allows a low-privileged user with Test Manager for Web Apps privilege to access all application data via HTTP, with scope change affecting additional products. No active exploitation or public exploit is identified; patch details are in Oracle CPU." Need mention no KEV, no POC, EPSS missing. Technical context: Oracle Application Testing Suite, HTTP, CWE N/A but likely? Tags authentication bypass. Need explain root cause? We don't have CWE. Use CPE? Not provided but EUVD affected. Oracle ATS. Need educational: web application, privilege/authorization issue? But do not infer too much? Can state "CWE not specified by NVD, but tag Authentication Bypass suggests missing/inadequate authorization checks; root cause class not confirmed." Mention CVSS scope change indicates vulnerable component may be the Test Manager for Web Apps privilege or module, impacting additional products. Risk assessment: Signals: CVSS 9.1 with AV:N AC:L PR:L UI:N S:C C:H I:L A:L. EPSS not provided. KEV absent. POC absent. So compare: high CVSS due to network low complexity and scope change; but requires low privileged with specific Test

Oracle Siebel CRM 17.0 through 26.7 exposes a flaw in the Open UI component that lets a low-privileged, network-positioned attacker compromise a victim's Siebel CRM End User session once that victim is persuaded to interact with attacker-supplied content. Successful exploitation yields unauthorized read, creation, deletion or modification of critical and otherwise inaccessible CRM data, and the scope-change (S:C) rating means the fallout can extend to products beyond Siebel CRM End User itself. Rated CVSS 7.7 with high attack complexity, the bug is difficult to exploit reliably, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Low-privileged attackers with network access to the Siebel Apps - Customer Order Management module (Order Management component) in Oracle Siebel CRM versions 17.0 through 26.7 can craft HTTP requests that, once a second user is induced to interact, allow unauthorized read, creation, modification, and deletion of critical order data, with a scope change that can propagate impact to connected products. The flaw carries a CVSS 3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), but no EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so active exploitation is not confirmed (no public exploit identified at time of analysis). It is an easily exploitable, low-complexity issue, making patch deployment a high priority for any organization running an affected Siebel release.

We need to produce JSON. Need to include "walbrzych" only in risk_assessment, lowercase, woven naturally once. Let's craft. Let's think about CVE-2026-83144. Oracle Siebel CRM, Siebel Apps - Customer Order Management, component Order Management. Versions 17.0-26.7. CVSS 8.7 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. Low privileged attacker with network access via HTTP, requires human interaction from a person other than attacker, scope change. Tags: Authentication Bypass, Oracle. Hmm "Authentication Bypass" tag though CVSS PR:L (low privileged) — so maybe mislabeled? Actually PR:L means authenticated low privilege. Authentication Bypass tag might be mislabeled? The vulnerability might allow bypass but CVSS says PR:L. It's Oracle CPU (Critical Patch Update) - cspusep2026.html maybe "Oracle Siebel CRM" something. Reference: https://www.oracle.com/security-alerts/cspusep2026.html. Note "cspusep2026" — likely "Oracle Critical Patch Update Advisory - ..." Hmm, the URL pattern for Oracle is like https://www.oracle.com/security-alerts/cpujan2026.html. "cspusep2026" unusual. Actually might be a typo in input "cspusep2026". Anyway. CWE: N/A. Description says unauthorized creation, deletion, modification + unauthorized access to critical data. C:H/I:H/A:N. So confidentiality and integrity high, availability none. Product name: "Oracle Siebel CRM" or "Siebel CRM"? 1-3 words. "Oracle Siebel CRM" is 3 words. Good. Summary: Must not start with "A vulnerability". Start with impact + product. "Low-privileged attackers with HTTP access to Oracle Siebel CRM's Customer Order Management module 17.0 through 26.7 can exploit an order management flaw requiring victim interaction to read and modify critical data, with scope change impacting other products." Mention KEV? No KEV. POC? No POC. EPSS? No EPSS provided. So mention no public exploit identified at time of analysis. Maybe: "No public exploit code or CISA KEV listing is currently associated with this CVE, though the CVSS score of 8.7

Unauthenticated network attackers can bypass authentication in the eDetailing component of the Siebel Apps - Life Sciences module shipped with Oracle Siebel CRM, affecting versions 17.0 through 26.7, and gain both read and write access to critical CRM data — provided a human other than the attacker is induced to interact with a crafted HTTP request. Oracle scores this 8.1 (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:N), reflecting full confidentiality and integrity compromise but no availability impact and only the Life Sciences vertical exposed. No public exploit code or active exploitation has been identified at time of analysis, and the vendor advisory is Oracle's September 2026 Critical Security Patch Update (cspusep2026.html).

Improper access control in Oracle Proposals, a module of Oracle E-Business Suite (component: Internal Operations), lets a low-privileged, authenticated attacker reach data outside their authorization boundary over HTTP. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields unauthorized read access to critical Oracle Proposals data with a scope change that can extend impact to other EBS-backed products. Oracle rates the issue 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code or CISA KEV entry is present in the supplied intelligence, so it should be treated as an unpatched-window exposure rather than a confirmed in-the-wild campaign.

Low-privileged, network-reachable users of Oracle Field Service can read data far beyond their authorized scope in Oracle E-Business Suite releases 12.2.3 through 12.2.15, potentially reaching critical data across additional products because the flaw crosses a security scope boundary (CVSS 3.1 7.7, C:H only). The vulnerability is exploitable over HTTP with no user interaction once a low-privileged session exists, and no public exploit code or active exploitation is identified at time of analysis. Oracle has published a Critical Security Patch Update advisory covering this issue; there is no CISA KEV listing and no EPSS score was supplied in the source data.

Oracle iStore, the e-commerce/shopping cart module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exposed to a cross-site style attack in which a low-privileged authenticated attacker with HTTP network access can induce a second user to interact with crafted content and thereby gain unauthorized read, create, modify, and delete access to iStore data — with the vendor warning the impact can extend to other EBS products. With CVSS 3.1 base 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), the flaw is trivially automatable once an attacker holds any low-privileged account, but exploitation still hinges on victim interaction, which materially lowers real-world risk. No public proof-of-concept, EPSS estimate, or CISA KEV entry was present in the supplied intelligence, so exploitation is assessed as not confirmed in the wild at time of analysis.

Low-privileged users of Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can reach data they should not be able to read through the Shopping Cart component over HTTP. Successful exploitation results in unauthorized access to critical data or complete read access to everything the iStore application can reach, and because the flaw carries a scope change it can also significantly affect other E-Business Suite products. Oracle rates it CVSS 3.1 7.7 (confidentiality only, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code and no CISA KEV entry were identified at time of analysis.

Unauthenticated information disclosure in Oracle iStore (Shopping Cart component) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a remote attacker with plain HTTP access read critical data exposed through the storefront, up to and including all data reachable by the iStore application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is trivially automatable given the network vector and lack of credentials or user interaction. No CISA KEV entry, EPSS score, or public proof-of-concept was present in the supplied intelligence, so exploitation is assessed as possible but not confirmed in the wild at time of analysis.

Authenticated, low-privileged attackers with HTTP access to Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can read, create, modify, or delete critical shopping-cart, order, and customer data, giving them full read and write reach into all iStore-accessible records. The flaw sits in the Shopping Cart component and is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is remotely reachable over HTTP with no user interaction and only a low-privilege account. No CISA KEV listing and no public exploit code were identified at time of analysis, so exploitation is currently presumed opportunistic rather than confirmed in the wild.

Oracle Web Applications Desktop Integrator (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) exposes a file download weakness that lets a low-privileged, network-connected user retrieve data they should not be able to reach. Exploitation is rated 'easily exploitable' by Oracle — HTTPS network vector, low complexity, no user interaction — and because the flaw can cross a security boundary (CVSS scope change), successful abuse may expose critical data belonging to other EBS components, not just the Desktop Integrator. CVSS 3.1 base score is 7.7 with confidentiality-only impact; no public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.

We need to produce a JSON object with the specified fields. Need to include "legnica" in risk_assessment field only, as lowercase, woven naturally. Let me parse the data: CVE-2026-83130: Oracle Site Hub product of Oracle E-Business Suite, component: Internal Operations. Affected versions 12.2.3-12.2.15. CVSS 3.1 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. CWE: N/A. Tags: Authentication Bypass, Oracle. EUVD ID EUVD-2026-79458. References: nvd link to Oracle security alert cspusep2026.html. No EPSS, no KEV, no POC mentioned. Need product_name: 1-3 words. "Oracle Site Hub" (3 words). Or "Oracle E-Business Suite"? The specific product is Oracle Site Hub, part of E-Business Suite. I'd pick "Oracle Site Hub". Summary: 2-3 sentences plain-language for security professionals, original synthesis, not copy description. Start with specific impact verb and product. E.g., "Low-privileged attackers with network access can modify or delete critical Oracle Site Hub data..." Mention no KEV, no POC. EPSS not provided, so can't mention. But note EPSS risk if notable — none provided. Technical context: Oracle Site Hub within Oracle E-Business Suite 12.2, component Internal Operations, versions 12.2.3 to 12.2.15. CWE N/A — likely access control issue given Authentication Bypass tag. Explain E-Business Suite is a large ERP, Site Hub is a real estate/lease management module? Actually Oracle Site Hub is part of EBS for site/location management. The vulnerability allows low privileged attacker with network access via HTTP to compromise. Root cause probably improper authorization/access control (CWE-284 or CWE-863) leading to integrity impact. But CWE is N/A in input, so note that. Risk assessment: CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N — network attack vector, low complexity, low privileges required (authenticated as low-priv user), no user interaction, scope unchanged, low confidentiality, high integrity, no availability. EPSS not provided. KEV not listed. POC not mentioned. SS

Oracle Sales, the sales module of Oracle E-Business Suite (supported versions 12.2.3 through 12.2.15), exposes critical business data to any low-privileged authenticated user who can reach its HTTP interface. A crafted request against the Internal Operations component bypasses the intended access boundary, and because the CVSS vector carries a scope change (S:C), the exposure is not limited to Oracle Sales — data reachable through additional Oracle products can be read as well. Oracle classifies it as 'easily exploitable' (AV:N/AC:L/PR:L/UI:N, CVSS 3.1 base 7.7, confidentiality-only impact); no public exploit code, EPSS score, or CISA KEV entry was provided in the source data.

Unauthenticated remote attackers with HTTP access to Oracle Sales Offline, a module of Oracle E-Business Suite, can read any data the application exposes on affected versions 12.2.3 through 12.2.15. The flaw sits in the Internal Operations component and requires no credentials, no user interaction and no non-default configuration, yielding a 7.5 confidentiality-only CVSS base score. Exploitation is highly automatable and attractive for bulk data theft, though at the time of analysis there is no public exploit code and no confirmed exploitation (no CISA KEV listing); EPSS is not available in the supplied intelligence.

Oracle Sales Offline, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged authenticated user with HTTP access read critical data far beyond their intended authorization, and Oracle's own scoring marks the impact as a scope change, meaning the flaw in this component can also reach data owned by other EBS products. The CVSS 3.1 base score is 7.7 with high confidentiality impact and no integrity or availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis.

Low-privileged attackers with network access over HTTP can compromise Oracle Sales Online in Oracle E-Business Suite releases 12.2.3 through 12.2.15, exposing critical sales data and allowing limited modification of records. Exploitation requires that a low-privileged account already be held and that a second person (not the attacker) be induced to interact with the application, yet the flaw's scope change means a successful attack can ripple into other E-Business Suite components beyond Sales Online itself. It carries a CVSS 3.1 base score of 7.6, but there is no CISA KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied in the intelligence feed.

Oracle Report Manager, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes an internal-operations flaw that lets a low-privileged attacker with HTTPS network access read critical data and degrade service availability. Successful exploitation yields high confidentiality impact against all Report Manager-accessible data plus partial denial of service, giving the flaw a 7.1 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is not confirmed to be active; risk is concentrated in internet- or broadly-reachable EBS Report Manager deployments where ordinary authenticated users exist.

Oracle E-Business Suite Order Management (versions 12.2.5 through 12.2.15) exposes order data through its Product Diagnostic Tools component to any low-privileged user who can reach the HTTP interface. The flaw is easily exploitable — network vector, low complexity, no user interaction — and Oracle notes the impact can spread beyond Order Management into interconnected products, resulting in unauthorized access to critical data or complete access to all Order Management data. No public exploit code or CISA KEV listing was provided at time of analysis; no patch version is specified in the available references beyond the linked Oracle advisory.

Unauthenticated remote attackers can read sensitive data from Oracle Applications Manager within Oracle E-Business Suite 12.2.3 through 12.2.15 by sending crafted HTTP requests to the RapidClone command-line component. The issue is scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning exploitation needs no credentials, no user interaction, and only affects confidentiality — an attacker gains unauthorized access to critical data or all data reachable through Applications Manager. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis, so exploitation appears opportunistic rather than confirmed in the wild.

Low-privileged authenticated users with HTTP access to Oracle Quality in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Quality records and make limited unauthorized changes to them, because the Internal Operations component fails to enforce proper authorization on its requests. Oracle scores this 7.1 with a network vector, low attack complexity and no user interaction, so exploitation is straightforward for anyone who already holds any valid EBS account. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied in the input.

Low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can leverage a hard-to-reach flaw in the Oracle Partner Management module (Internal Operations component) to read critical data and modify records far beyond their authorization, with the impact crossing into other EBS components because the vulnerability carries a scope change. Oracle rates it CVSS 7.1 and characterizes it as difficult to exploit, and a fix is published in the 2026 Critical Patch Update. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Unauthenticated remote attackers can read any data reachable through the Audience component of Oracle Marketing in Oracle E-Business Suite versions 12.2.3 through 12.2.15 by sending crafted HTTP requests, with no user interaction required. The flaw is scored 7.5 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N) and is confidentiality-only - integrity and availability of the affected module are unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS probability was supplied with the source data.

Unrestricted network access to Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows unauthenticated attackers to bypass authentication in the Forms Services C/S/Charmode component and take over the application, with CVSS 9.8 and no user interaction. No public exploit or CISA KEV listing is present in the supplied intelligence, but the Oracle advisory confirms the affected versions. Organizations running these releases should treat the flaw as critical and patch immediately.

We need answer JSON only. Need follow all instructions. Need parse input. Need produce fields. Let's carefully analyze CVE. CVE-2026-83104: Oracle Forms product of Oracle Fusion Middleware, component Forms Services, C/S, Charmode. Supported versions affected 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Forms. Successful attacks can result in unauthorized creation, deletion or modification access to critical data or all Oracle Forms accessible data as well as unauthorized access to critical data or complete access to all Oracle Forms accessible data. CVSS 3.1 Base Score 9.1 (C/I impacts). Vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. CWE-287. Tags: Authentication Bypass, Oracle ENISA EUVD ID. References: Oracle security alert cspusep2026.html, NVD link. Need product_name: "Oracle Forms" (1-3 words). Could be "Oracle Forms". Good. Summary: Original synthesis, not copy description. Start with specific impact verb and product. E.g. "Unauthenticated remote attackers can exploit an authentication bypass in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 over TCP to read and modify all Oracle Forms accessible data." Mention CVSS 9.1, EPSS? Input has no EPSS, no KEV, no POC. Need state no public exploit identified at time of analysis. KEV not mentioned, POC not mentioned. Need be cautious: "no public exploit identified at time of analysis" as per rules. Also mention CWE-287 authentication bypass. "No KEV listing in supplied data." Summary 2-3 sentences. Good. Technical_context: Explain underlying tech/library/protocol involved. CPE data? Actually input not explicit CPE strings but affected versions. We can mention Oracle Forms part of Fusion Middleware, Forms Services C/S Charmode component, TCP-based communication, CWE-287 authentication bypass root cause. Be educational. Need reference exact versions. No CPE data provided. We can say "The input does not include explicit CPE strings

Unauthenticated network attackers can reach Oracle Forms Services (including the C/S and Charmode components) over HTTP and achieve unauthorized access to, or modification and deletion of, critical data held in the application, in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. Oracle rates the issue 7.4 with high confidentiality and integrity impact but explicitly characterizes it as difficult to exploit (AC:H), meaning a favorable timing or state condition is required rather than simple request replay. At the time of analysis there is no confirmed CISA KEV listing and no public exploit code identified; exploitability details remain largely undisclosed by the vendor.

We need answer JSON only. Need synthesize. Let's inspect CVE data. CVE-2026-83100 Oracle Forms Oracle Fusion Middleware. Description: vulnerability in Oracle Forms product of Oracle Fusion Middleware component Forms Services, C/S, Charmode. Versions affected 12.2.1.19.0, 14.1.2.0.0. Easily exploitable unauthenticated attacker network via HTTP compromise Oracle Forms. Successful attacks result in takeover. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. ENISA EUVD. Reference Oracle advisory. Need fields: product_name: "Oracle Forms" (specific). summary: original synthesis. Mention critical unauthenticated HTTP vulnerability in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows complete takeover. No KEV, no POC in input — must say no public exploit identified? We have only references. EPSS not provided. Should mention EPSS unknown? risk assessment. Summary: "Critical unauthenticated compromise in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows remote attackers with HTTP access to fully take over affected instances; CISA KEV is not reporting active exploitation and no public exploit code is identified in the provided data." That avoids starts with A vulnerability. Need product. Use active? "Remote takeover of Oracle Forms is possible via HTTP..." Good. technical_context: Underlying technology: Oracle Forms part of Oracle Fusion Middleware, Forms Services, client/server/charmode runtime. Component. CWE N/A. No CPE strings provided. Explain root cause class not specified; likely issue in Forms Services that allows unauthenticated takeover. We cannot speculate. CPE absent, affected versions from EUVD. Reference CWE N/A. Be educational: Oracle Forms is long-standing application framework; Forms Services handles HTTP/HTTPS communication for web deployed forms. C/S and charmode maybe character mode. Root cause not disclosed. We can say CVSS indicates network exploitable no privileges user interaction, scope unchanged, high impact all

We need produce JSON. Need follow user. We need synthesize. Need analyze CVE. Data: CVE-2026-83099 Oracle Forms, Fusion Middleware, Forms Services C/S Charmode. Versions 12.2.1.19.0 and 14.1.2.0.0. Description: easily exploitable unauthenticated network via HTTP compromise Oracle Forms, scope change, takeover. CVSS 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. CWE-287 improper authentication. Tags Authentication Bypass, Oracle. ENISA EUVD. References oracle security alert cspusep2026, nvd link. No KEV, no EPSS, no POC? In input there is no KEV/POC/EPSS/CPE? Actually tags and references. Need craft fields. Need plain text strings. Need include all. Need check: CVE ID maybe future 2026. Product name "Oracle Forms" (1-3 words) OK. Summary: Original synthesis, not copy. Start impact verb and product: "Critical authentication bypass in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows unauthenticated attackers..." Mention CVSS 10.0, network HTTP, scope change, CWE-287. No KEV/POC info because not given; say no public exploit identified, not in KEV? We can mention no active exploitation data? We should say "no public exploit identified at time of analysis" if neither. But exploitation status phrase required. Since no KEV, no POC, use phrase. But maybe no data, so yes. Summary must mention if actively exploited (KEV) if present, not. mention CVSS, EPSS if notable (none). "Critical authentication bypass vulnerability in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 enables unauthenticated HTTP attackers to completely compromise the Forms Services component, resulting in high confidentiality, integrity, and availability impact and potential takeover of Oracle Forms; Oracle's CVSS base score is 10.0 due to network attack vector, low complexity, no privileges or user interaction, and changed scope. No public exploit or active exploitation was identified in the provided intelligence." Good. Technical_context: Explain underlying technology: Oracle Forms part of Fusion Middleware, componen

We need answer with JSON only. Need synthesize. We have CVE, description Oracle Forms product of Oracle Fusion Middleware, component Forms Services, C/S, Charmode. Versions 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable unauthenticated network via HTTP compromise Oracle Forms, takeover. CVSS 9.8 vector. CWE N/A. Tags Information Disclosure, Oracle. ENISA. References Oracle advisory. Need produce fields. Need obey all rules. product_name: Oracle Forms. summary original not copy desc; start impact verb and product. Could say "Takeover of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 via unauthenticated HTTP attacks allows attackers to fully compromise affected instances." Maybe mention tags information disclosure? But summary who affected what attacker can do. KEV? Input no KEV field. POC unknown. EPSS? Not provided. Need no mention? "No public exploit identified at time of analysis" maybe. Could mention "EPSS not available" maybe. Since critical to include if notable. Let's craft 2-3 sentences. Technical_context: Oracle Forms, part of Fusion Middleware, component Forms Services C/S Charmode, HTTP; CPE absent but affected versions identified. CWE N/A. We can say root cause class not disclosed in CVE data, but advisory suggests critical HTTP-accessible component. Need be educational. Mention C/S (client/server) and Charmode deployments; Forms Services runtime accessible over HTTP. The CWE missing. No CPE data actually absent. We can mention no CPE strings provided in source data, so product/version boundaries rely on advisory. Could mention issue affects Oracle Forms Services component including C/S architecture and character-mode deployments. Risk_assessment: CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS not provided. KEV not specified. POC no. SSVC? We need use signals. Need compare contrast. Since no KEV/POC/EPSS, say no public exploit identified but critical due to network unauthenticated low complexity. "CVSS indicates network vector, unauthenticated, no user in

Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 (Fusion Middleware, components Forms Services, C/S and Charmode) can be compromised by a low-privileged attacker with network access over HTTP, resulting in full read/write access to Forms-accessible data plus a partial denial of service. Exploitation is difficult (AC:H) and depends on a victim other than the attacker performing some action (UI:R), but the flaw carries a scope change, meaning a successful attack can significantly affect products beyond the vulnerable component itself. Oracle rates it CVSS 3.1 7.9; no public exploit code, KEV listing or EPSS score was present in the supplied intelligence at time of analysis.

We need answer JSON only. Need synthesize. We need parse input. CVE-2026-83095 Oracle Forms. Description. CVSS. Multi-source has reported, tags, EUVD ID, affected versions, refs. No CWE, no KEV, no EPSS, no POC. Need produce fields. Need obey rules. product_name: Oracle Forms. Summary: must original, not copy description. Mention unauthenticated network HTTP, takeover Oracle Forms, versions, no active exploitation/POC? Need use exact phrases. Since no KEV/POC, "no public exploit identified at time of analysis". EPSS absent, no mention notable? Could say no EPSS data provided. Need not include. Technical_context: underlying Oracle Forms Services, C/S, Charmode. CWE N/A so can't reference. CPE? none explicitly. Could mention Oracle Fusion Middleware Forms Services. Root cause class unknown; no CWE. Educational. Risk_assessment: Compare signals. CVSS 9.8 AV:N AC:L PR:N UI:N critical. KEV absent, no POC, no EPSS. Need state missing. SSVC: exploitation status none? We can reason: no public exploit identified at analysis, not automatable? Actually Oracle Forms common? We should not assume. We can say CVSS max severity but real-world priority depends on deployment; not in CISA KEV. Missing EPSS. Need be explicit. affected_products: Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. Link advisory https://www.oracle.com/security-alerts/cspusep2026.html. No CPE. remediation: Oracle advisory. Exact patch version? Input has supported affected versions, but no fix version in references. Patch status? We have no patch info. Need not invent exact version. Use "Patch available per vendor advisory" if patch data says available? Input doesn't include patch availability field. It has vendor advisory link, and affected versions. Could phrase "Review Oracle Critical Patch Update ... apply security patches as recommended; no exact patched version listed in provided data." But rule says patch status use most specific. Since no patch data, "No vendor-released patch identified at time of analysis"??

We need answer JSON only. Need synthesize. Let's carefully parse. CVE-2026-83094 Oracle Forms, Oracle Fusion Middleware component Forms Services C/S Charmode. Affected 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable unauth network via HTTP compromise Oracle Forms takeover. CVSS 9.8 AV:N AC:L PR:N UI:N S:U C:H I:H A:H. CWE-287 authentication bypass. Tags Authentication Bypass, Oracle. References Oracle advisory and EUVD. No KEV mentioned => no active exploitation. No POC mentioned. Patch? Advisory likely has patches. We need maybe patch available per vendor advisory, exact version? Affected versions are 12.2.1.19.0 and 14.1.2.0.0; likely patched later? But no exact fix in input. Need be careful: patch data? Not explicitly provided except vendor advisory URL. "Patch available per vendor advisory" maybe. We cannot invent version numbers. Need product_name 1-3 words: "Oracle Forms". Summary original: "Unauthenticated network attackers can fully compromise Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 through an authentication bypass in Forms Services..." Need mention no active exploitation? Start with impact verb. Maybe "Complete takeover of Oracle Forms via HTTP is possible for unauthenticated attackers due to an authentication bypass (CWE-287) in Forms Services; affected versions are 12.2.1.19.0 and 14.1.2.0.0. No public exploit or CISA KEV listing was identified at time of analysis, but the CVSS 9.8 vector reflects network, low complexity, no privileges, and high impact." Need technical_context: Overview Oracle Forms part of Fusion Middleware, runs forms over web via Forms Services/C/S/Charmode. CWE-287 authentication bypass means flaw in authentication logic enabling attacker to bypass. CPE? Input does not provide CPE strings, except affected versions from EUVD. Need mention no CPE in input? We can say EUVD lists affected versions. Explain components: Forms Services, client/server, charmode. Maybe network via HTTP. Root cause class: improper authentication. Do not halluci

Authentication bypass in Oracle Forms (component: Forms Services, C/S, Charmode) allows an unauthenticated remote attacker with HTTP access to reach data and functionality that should require a valid session, affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 8.6 with a scope-change flag, meaning a compromise of Oracle Forms can pivot to impact other products connected to or served by the Forms tier. Only high confidentiality impact is documented (no integrity or availability impact per the vector), and there is no public exploit code or CISA KEV listing at time of analysis.

Low-privileged attackers with network access to Oracle Field Service can read and modify critical data and cause a partial denial of service, exploiting a difficult-to-trigger flaw in the Internal Operations component of Oracle E-Business Suite. All supported Oracle Field Service releases from 12.2.3 through 12.2.15 are affected. No public exploit code was identified and there is no CISA KEV listing at time of analysis, but the CVSS 3.1 base score of 7.1 with high confidentiality and integrity impact makes this a candidate for prioritization once patch data is verified.

Oracle Field Service, a component of Oracle E-Business Suite (Internal Operations module), is affected by an easily exploitable flaw in versions 12.2.3 through 12.2.15 that lets a low-privileged attacker with HTTP network access read critical data, modify or delete records, and partially disrupt service availability. The vulnerability carries a CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L), indicating high confidentiality impact with limited integrity and availability effects, and it does not require user interaction. No public exploit code or CISA KEV entry was present in the supplied intelligence, and there is no confirmed evidence of active exploitation at time of analysis.

Oracle Alert, a component of Oracle E-Business Suite (12.2.3 through 12.2.15), exposes an authorization weakness in its Internal Operations component that lets a low-privileged, network-positioned attacker read and manipulate critical Alert data over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:N), reflecting high confidentiality and integrity impact with no user interaction required. No public exploit code has been identified at time of analysis, and the issue has not been confirmed as actively exploited (CISA KEV); remediation is available through Oracle's Critical Security Patch Update cycle, so patching should be prioritized for internet- or partner-facing EBS deployments.

Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 contain a flaw in the Siebel Cloud Manager component that lets a low-privileged, network-positioned user read and modify critical CRM data, with impact extending beyond the vulnerable component (scope change). The CVSS 3.1 base score is 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), reflecting high attack complexity and the need for a valid low-privileged account rather than anonymity. No public exploit code and no CISA KEV entry were identified at time of analysis, so exploitation is confirmed only as theoretically practical, not known to be active.

Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 expose a flaw in the Siebel Cloud Manager component that lets an attacker already holding a low-privileged account on the platform, and positioned on the same physical/adjacent network segment as the hosting hardware, read essentially all CRM data, modify or delete some of it, and partially disrupt service. The CVSS 3.1 base score is 8.2 (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L), and the scope-change metric indicates the compromise can spill over into additional products beyond Siebel itself. No public exploit code has been identified and the issue is not listed in CISA KEV, but it should not be ignored: the confidentiality impact is total, Oracle rates exploitability as 'easily exploitable', and no EPSS score or CWE mapping was supplied to further refine the risk picture.

Oracle E-Business Suite's Marketing module (Audience component) in versions 12.2.3 through 12.2.15 exposes critical data to any attacker holding a low-privileged, authenticated account, who can reach the vulnerable component over HTTP and read information well beyond their intended authorization boundary. Oracle scores it 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — a scope-changing, confidentiality-only flaw with no integrity or availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the immediate driver is the breadth of affected enterprise deployments rather than confirmed in-the-wild activity.

Oracle Marketing, a module of Oracle E-Business Suite (Audience component), versions 12.2.3 through 12.2.15, exposes an easily exploitable flaw that lets a low-privileged, network-connected attacker read critical data and modify some records through the HTTP interface — with a scope change that can extend impact to other EBS products. Oracle rates it CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and released a fix in its Critical Security Patch Update (cspusep2026.html). No public exploit code or CISA KEV listing was present in the supplied intelligence, so exploitation is currently assessed as opportunistic rather than confirmed active.

Oracle Banking Corporate Lending versions 14.5.0.0.0 through 14.9.0.0.0 contain an unauthenticated, hard-to-trigger flaw in the Core component that lets an attacker positioned on an adjacent network segment read and modify critical lending data, with a scope change that can extend impact to connected Oracle Financial Services products. The CVSS 3.1 base score is 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact on a non-internet-exposed attack surface. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unconfirmed.

Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 contain a flaw in the Siebel Cloud Manager component that a high-privileged attacker with a logon to the underlying infrastructure can use to read and modify critical Siebel data and, through a scope change, impact additional products. The CVSS 3.1 base score is 7.9 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), so exploitation is rated easy once the attacker already holds elevated local access — this is an insider/privileged-tenant risk rather than a remotely reachable pre-auth bug. No public exploit code and no CISA KEV entry were present in the supplied intelligence, and no EPSS data was provided, so active exploitation is not confirmed.

Unauthenticated attackers who can reach the HTTP interface of Oracle Siebel CRM Cloud Applications, specifically the Siebel Cloud Manager component, can bypass authentication and gain full read access to critical CRM data plus limited ability to insert, update or delete records. The flaw affects supported releases 22.3 through 26.7 and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N), meaning it is remotely reachable, low complexity and requires no credentials or user interaction. No public exploit code or CISA KEV listing was present in the supplied intelligence, so exploitation status is unconfirmed at time of analysis.

Unauthenticated attackers with HTTP network access can read critical data from Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 by exploiting an authentication bypass in the Siebel Cloud Manager component. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact only - integrity and availability are unaffected - meaning a successful hit exposes all data reachable through the affected component. No public exploit code, EPSS score, or CISA KEV entry was supplied in the intelligence feed, so active exploitation is currently unconfirmed.

Unauthenticated attackers with network reachability to the SSH interface of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.7) can bypass authentication and gain unauthorized access to critical CRM data through the Siebel Cloud Manager component. Oracle scores the flaw 8.6 with a scope change, meaning a successful compromise can extend beyond the Siebel deployment to affect additional products. No public exploit code, EPSS score, or CISA KEV entry was provided at the time of analysis, although the low-complexity, no-credentials attack profile makes rapid weaponization plausible.

Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 expose the Siebel Cloud Manager component to unauthenticated attackers who can reach the host over an adjacent network segment, allowing full read and write access to critical CRM data. The flaw is rated CVSS 8.1 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:N) and is tagged as an authentication bypass, meaning no credentials or user interaction are required once an attacker is positioned on the same physical or logical communication segment as the affected service. There is no CISA KEV listing and no public exploit identified at time of analysis, but the low attack complexity and lack of authentication make the vulnerability highly automatable for anyone who already holds a foothold inside the hosting network or cloud subnet.

Authenticated low-privileged users of Oracle E-Business Suite 12.2.3 through 12.2.15 can abuse the Applications Framework 'Search Bean' component to read, create, delete, or modify critical data they should not be able to touch, giving an attacker with a basic application account broad confidentiality and integrity impact across the framework. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1), so any valid low-privilege credential is effectively a stepping stone to full data compromise. There is no public exploit code and no CISA KEV listing at time of analysis, but the Oracle quarterly patch referenced in the advisory is the only reliable fix.

Oracle PeopleSoft Enterprise PRTL Interaction Hub 9.1 (Enterprise Portal component) permits a low-privileged user with HTTP access to the portal to read data well beyond their assigned role, exposing critical enterprise data and, because the flaw crosses a trust boundary, potentially data held in other PeopleSoft products reachable through the portal. Oracle scores it 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — confidentiality-only with a scope change — and fixed it in the 2026 Critical Patch Update. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data.

Missing authorization enforcement in the Core component of Oracle Enterprise Manager for Oracle Database 24.1 allows an authenticated, low-privileged attacker with HTTP access to read any data the management platform can reach, including data belonging to managed database targets, a confidentiality-only compromise that also changes scope (CVSS 3.1: 7.7). Oracle rates it easily exploitable because it needs only a valid low-privilege account and network reach to the console, and no public exploit identified at time of analysis. Oracle has published a fix in its Critical Security Patch Update advisory for the affected 24.1 release.

We need answer only valid JSON. Need follow instructions. Need synthesize. Let's inspect input. CVE-2026-83066 Oracle Internet Directory. Description: vulnerability in OID product of Fusion Middleware component OID LDAP Server. Supported versions affected 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Internet Directory. Successful attacks result in takeover. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. Reported by Oracle. ENISA EUVD ID. Affected versions. References oracle security alert cspusep2026. No KEV, no POC, no EPSS provided. Need output fields all strings. Data quality flags maybe [] unless wrong. Need assess risk. Need plain text strings, not arrays. product_name "Oracle Internet Directory". summary original synthesis, no copying description. Start with impact verb and product. Mention unauthenticated via T3/IIOP, takeover, CVSS 9.8, no KEV/POC. technical_context: OID LDAP server, Oracle Fusion Middleware, T3/IIOP protocols, possibly deserialization? CWE N/A. CVSS network. CPE? None provided besides affected versions. Could mention exact products. CWE unknown. risk_assessment: include zabrze once. Need compare signals: CVSS 9.8 critical, no EPSS score, no KEV, no POC. SSVC? Exploitation none, automatable likely, technical impact total. Need note conflicting/missing: EPSS missing, CWE missing, no KEV. Use CVSS says network via T3/IIOP unauthenticated no interaction, but we have no exploit known. Risk priority perhaps high for Oracle Internet Directory especially if exposed. Mention zabrze. affected_products: paragraph listing 12.2.1.4.0 and 14.1.2.1.0, CPE maybe absent. Say vendor advisory URL. remediation: consult Oracle advisory, apply quarterly CPU, restrict T3/IIOP access, etc. Need exact patch? Input has advisory but no exact patch version. Use "Patch available per vendor advisory" maybe. No patch version. Need specific

We need answer in JSON only. Need synthesize. Let's inspect input. CVE-2026-83062: Oracle Internet Directory product of Oracle Fusion Middleware, component OID LDAP Server. Supported versions 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable allows unauthenticated attacker with network access via LDAP to compromise OID. Successful attacks can result in takeover. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. Reported by Oracle. Reference Oracle security-alerts/cspusep2026.html. EUVD. CWE N/A. No KEV, no POC, no patch info except vendor advisory. Need fields. Product_name: Oracle Internet Directory. Summary: original synthesis. Must not copy description. Start with impact verb and product. "Unauthenticated remote takeover of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 is possible via LDAP attacks against the OID LDAP Server component." Mention easily exploitable, critical, no KEV/POC. Need avoid "A vulnerability..." Start "Remote code execution/takeover..." Actually vulnerability type not specified beyond takeover. Use "Complete compromise of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 can be achieved by unauthenticated attackers who can reach the OID LDAP Server over LDAP." CVSS 9.8. "No KEV listing and no public exploit code identified at time of analysis, but Oracle has published a security alert." Technical_context: LDAP server component of Oracle Fusion Middleware. CWE N/A; root cause class unknown. CPE absent in input. Affected versions. Protocol LDAP. Unauthenticated network. Explain potential cause? Since CWE N/A, cannot specify. "The vulnerability resides in OID LDAP Server, the LDAP directory service component..." Root cause not disclosed by Oracle? Actually Oracle typically doesn't disclose details until later. We can say root cause not specified, but exploitability indicates pre-auth flaw in LDAP handling. Need educational. Use CPE data? None provided. Can say exact CPE not provided but affected product

We need answer JSON only. Need synthesize. We need parse input. Need follow fields. We have CVE description Oracle Internet Directory. Need use all data. Need be careful product_name 1-3 words: Oracle Internet Directory. Summary original. Technical context CWE N/A. Need mention CWE missing maybe root cause unknown. Risk assessment signals: CVSS 9.8 AV:N AC:L PR:N UI:N S:U C:H/I:H/A:H. EPSS not provided. KEV not provided (likely no). POC not provided? No POC field. Tags Information Disclosure, Oracle. References advisory. Affected versions 12.2.1.4.0 and 14.1.2.1.0. Need risk: high CVSS but no KEV/EPSS/POC data. Mention absence. Need SSVC maybe inferred: exploitation none, automatable perhaps yes? We can say no public exploit identified, EPSS unknown, KEV absent. Need not overstate. Need assess cvss vector. Provided vector is plausible. Our own independent vector grounded. Use same maybe AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Need CVSS 4.0 vector consistent. Need map. CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Maybe if scope unchanged. Need rationale. Need fields: product_name: "Oracle Internet Directory" summary: 2-3 sentences. Cannot start with "A vulnerability". Start with impact verb and product. Need mention takeover, unauthenticated LDAP network access, versions, CVSS 9.8, no active exploitation data. Eg "Critical takeover risk exists in Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 via the OID LDAP Server: an unauthenticated attacker with network access over LDAP can fully compromise the directory, obtaining confidentiality, integrity, and availability impacts. Oracle's April 2026 CPU advisory reports it as easily exploitable with CVSS 9.8; no KEV or public exploit data was supplied." Need technical_context: Explain Oracle Internet Directory, LDAP, Fusion Middleware, CWE N/A. Root cause class not specified. CPE? None provided. EUVD affected versions. Need mention CWE missing. "The vulnerable component is the OID LDAP Server within

We need answer JSON only. Need follow all instructions. Need parse CVE. Let's inventory data. CVE ID: CVE-2026-83060 Description: Vulnerability in Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions affected 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Internet Directory. Successful attacks can result in takeover of Oracle Internet Directory. CVSS 3.1 9.8 C/I/A H. Vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE N/A. Reported by secalert_us@oracle.com. Tags: Information Disclosure, Oracle ENISA EUVD ID Affected versions EUVD: same References: [nvd] (None) https://www.oracle.com/security-alerts/cspusep2026.html Need produce fields: product_name: 1-3 words. Oracle Internet Directory. summary: original synthesis, not copy. Must start with impact verb and product. e.g. "Unchecked network-accessible LDAP attack can fully compromise Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0, allowing remote takeover of the directory service." Need include KEV? Input no KEV. POC no. EPSS absent. Need no active exploitation? Use "no public exploit identified at time of analysis" maybe in summary? could mention. Need not start with "A vulnerability". "Remote takeover of Oracle Internet Directory is possible via LDAP by unauthenticated attackers..." Good. technical_context: explain Oracle Internet Directory, LDAP, CVSS vector no auth network. CWE N/A. CPE not provided? affected products EUVD. Root cause class unknown. Use CWE N/A but explain likely insufficient auth/access control? But should not invent. Could say CWE not assigned, root cause class not specified. Explain LDAP protocol, Oracle Fusion Middleware identity management. CPE strings not actually input aside from product names. Use affected versions. risk_assessment: use all signals CVSS 9.8 AV:N/AC:L/PR:N/UI:N. EPSS not provided, KEV not listed, POC not indicated. SSVC

Takeover of Oracle Internet Directory via its LDAP server component allows unauthenticated remote attackers to fully compromise the directory service. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is rated CVSS 10.0 with scope change; no public exploit or CISA KEV listing was identified in the provided data.

We need answer JSON only. Need analyze CVE. Need follow instructions. Let's inspect input. CVE-2026-83054 Oracle Internet Directory Fusion Middleware OID LDAP Server. Versions affected 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable unauthenticated network access via LDAP to compromise, result takeover. CVSS 9.8 AV:N AC:L PR:N UI:N S:U C:H I:H A:H. CWE-287 Authentication Bypass. Tags Authentication Bypass, Oracle. ENISA EUVD. References oracle security alert. Need synthesize all data. Fields. Need product_name: "Oracle Internet Directory" likely. Summary: 2-3 sentence. Not copy description. Start with impact verb and product. Remote unauthenticated takeover of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 via LDAP due to authentication bypass. Public? No KEV, no POC. EPSS? Not provided. We can mention no public exploit identified, no KEV. "Remote takeover of Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers to completely compromise the LDAP server via network access. The flaw stems from improper authentication in the OID LDAP Server component and carries a CVSS 9.8 base score. At time of analysis, no public exploit code or active exploitation was identified in the supplied data." Need careful: CVSS says unauth PR:N. Good. Technical_context: Explain underlying technology/library/protocol: Oracle Internet Directory is LDAP directory server component of Oracle Fusion Middleware. CWE-287 authentication bypass means flaw in authentication mechanism of OID LDAP Server. Affected versions from CPE? input doesn't give CPE strings, only affected versions. We can infer CPE? Need use CPE data to identify exact affected products, but no CPE strings in input. We can mention CPE not supplied, but affected versions. "Exact CPE strings were not included in this input, but vendor advisory identifies Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0." Underlying LDAP protocol. Root cause class CWE-287 improper authentication. Be e

Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Runtime Tools component that allows an attacker who already controls a high-privileged account to reach past that account's authorization boundary over HTTP, gaining unauthorized read access to critical portal data and limited ability to modify it, with a documented scope change that can affect connected products. Oracle rates it CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) — network-reachable but gated behind strong privileges. No public exploit code and no CISA KEV listing were identified at time of analysis, so this reads as a post-compromise privilege escalation and data-exposure issue rather than a remotely exploitable pre-auth break.

Unauthenticated attackers with HTTP network access to Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 can read data they should not be able to reach, including critical application data, via a flaw in the Runtime Tools component. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), making it trivially automatable against any internet- or intranet-exposed instance that has not applied the referenced Oracle Critical Security Patch Update. There is no public exploit code identified at time of analysis and no CISA KEV listing, so exploitation appears opportunistic rather than confirmed in the wild.