Authentication Bypass

Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic-based Client Bundle component over the T3 or IIOP protocols, yielding complete confidentiality, integrity, and availability compromise. Oracle rates it CVSS 9.9 with a scope change, meaning exploitation can pivot beyond Capture into adjacent Fusion Middleware components. No public exploit identified at time of analysis, but the near-maximum score, low attack complexity, and network reachability make it a top-priority Critical Patch Update item.

Privilege-escalating account takeover in Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged attacker with HTTP network access fully compromise the product and, because of a scope change, significantly impact adjacent products. Rated CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact, it is described by Oracle as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is unproven despite the near-maximal score.

Privilege-abusing information disclosure and data tampering in Oracle WebCenter Content: Imaging (Core component) lets a low-privileged, network-based attacker read all Imaging-accessible data and modify some of it over HTTP. The flaw carries a scope change (CVSS 8.5), meaning a successful attack can reach beyond the Imaging module into other Fusion Middleware components, and Oracle tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' and shipped a fix in the July 2026 Critical Patch Update.

Information disclosure and partial data tampering in the Imaging component (Core) of Oracle WebCenter Content, part of Oracle Fusion Middleware, affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with HTTP network access can compromise the Imaging service, gaining unauthorized read access to all Imaging-accessible data and limited unauthorized update, insert, or delete capability, addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis; the record carries an 'Authentication Bypass' tag despite the CVSS requiring low privileges (PR:L).

Full compromise of Oracle WebCenter Content (Content Server component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker with HTTPS network access can achieve complete takeover of the product. The CVSS 3.1 base score is 8.1 with high confidentiality, integrity, and availability impact, though the flaw is rated difficult to exploit (AC:H). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Unauthorized data access in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets an attacker who already holds a login session on the host infrastructure read or take complete access to all data the product can reach, and because of a scope change the impact can extend to additional connected products. Addressed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.1 with confidentiality-only impact; no public exploit is identified at time of analysis and it is not listed in CISA KEV. The Oracle-supplied tag 'Authentication Bypass' suggests the flaw circumvents application-level access controls once local/infrastructure logon is obtained.

Cross-scope data compromise in Oracle WebCenter Content (Content Server component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a remote unauthenticated attacker over HTTP read, create, delete, or modify all data accessible to the Content Server, with a scope change that can significantly impact other integrated Oracle Fusion Middleware products. Oracle rates it CVSS 3.1 8.7 (high complexity) with confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor tags suggest an authentication-bypass class issue.

Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by a low-privileged attacker sending crafted HTTP requests over the network, per Oracle's July 2026 Critical Patch Update (CVE-2026-60447). The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning a successful attack extends beyond Capture itself to significantly impact additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch item.

Complete remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated network attacker abusing the T3 or IIOP protocols can fully compromise the product with high impact to confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 9.8 and describes it as easily exploitable, but there is no public exploit identified at time of analysis and it is not on CISA KEV. The T3/IIOP attack surface is the same WebLogic RMI channel historically abused via Java deserialization, making it a high-priority patch despite the absence of confirmed in-the-wild activity.

Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible when a low-privileged attacker with network access via the WebLogic T3 or IIOP protocols exploits versions 12.2.1.4.0 and 14.1.2.0.0. Rated CVSS 3.1 9.9 with a scope change, successful attacks compromise confidentiality, integrity and availability and can significantly impact additional connected products beyond Capture itself. No public exploit identified at time of analysis, and the fix ships in Oracle's July 2026 Critical Patch Update.

Sensitive data disclosure and partial data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged, network-based attacker over HTTP to gain complete read access to all data the product can reach and to modify some of that data. Oracle rates the flaw CVSS 3.1 8.5 with a scope change, meaning exploitation can significantly impact adjacent products beyond WebCenter Content itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so treat this as a high-severity but not confirmed-exploited issue.

Scope-changing data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-based attacker read, create, delete, or modify all data accessible to the application. Exploitation is rated easy but requires tricking a separate user into an interaction (UI:R), and the flaw crosses a trust boundary to significantly impact additional products (scope change). No public exploit has been identified at time of analysis and it is not on CISA KEV; EPSS was not provided.

Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible by an unauthenticated remote attacker over the T3 or IIOP protocols, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) the attack is network-reachable, low-complexity, and requires no authentication or user interaction, yielding full confidentiality, integrity, and availability compromise (9.8 Critical). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated pre-auth nature over exposed WebLogic protocols makes this a high-priority patch.

Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) in Oracle Fusion Middleware is achievable by a remote unauthenticated attacker over the T3 and IIOP protocols. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation results in complete takeover of the platform with high confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.

Information disclosure with scope change in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged remote attacker read all data accessible to the platform and impact additional connected products. The flaw is network-exploitable over HTTP with low attack complexity and only minimal existing privileges, and Oracle tags it as an authentication bypass affecting confidentiality only (no integrity or availability impact). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low exploitation barrier and cross-boundary scope change make it a meaningful risk in exposed telecom/messaging deployments.

Unauthenticated compromise of Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 (a Fusion Middleware component) is possible over the network via HTTP against the mod_ssl module, letting a remote attacker read, create, delete or modify all server-accessible data. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact but no availability impact, and tagged as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch.

Data tampering and denial-of-service in Oracle Unified Directory (OUD Core component) let a high-privileged, network-adjacent attacker abuse the LDAP interface to modify or destroy directory data and force a complete crash or hang of the service. Affected supported versions are 12.2.1.4.0 and 14.1.2.1.0, addressed in the Oracle July 2026 Critical Patch Update. The flaw carries a scope change, meaning a successful attack can significantly impact products beyond OUD itself. No public exploit has been identified at time of analysis.

Full remote takeover of Oracle WebCenter Content (Fusion Middleware Content Server) is possible when an unauthenticated attacker reaches the HTTP interface, per Oracle's July 2026 Critical Patch Update (CPU). The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0 and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector and Oracle 'takeover' language make it a top-priority patch.

Unauthorized data disclosure in Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 (Oracle Fusion Middleware, mod_proxy component) lets an unauthenticated remote attacker over HTTP read critical data and, because of a scope change, reach data belonging to other back-end products the proxy fronts. The confidentiality-only impact combined with S:C strongly indicates a proxy-side request-forwarding/SSRF-class weakness that exposes internal resources rather than a code-execution flaw. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full compromise of Oracle Unified Directory (OUD Core component of Oracle Fusion Middleware) is possible when a low-privileged attacker sends malicious traffic over LDAP to affected versions 12.2.1.4.0 and 14.1.2.1.0. Oracle rates this 8.8 (CVSS 3.1) and characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the directory server, breaching confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network-facing LDAP interface make it a high-priority patch item.

Full takeover of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a low-privileged attacker with LDAP network access can compromise the directory service and, because of a scope change, significantly impact additional connected products. Oracle rates this CVSS 9.9 and lists it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not on CISA KEV. The combination of low attack complexity, only low privileges required, and cross-product blast radius makes this one of the highest-severity fixes in the CPU.

Unauthorized data access in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component) lets a remote unauthenticated attacker abuse the LDAP interface to read critical directory data and make limited unauthorized modifications. Rated CVSS 8.2 and flagged by Oracle as easily exploitable, the flaw is tagged as an authentication bypass, meaning directory contents can be reached without valid credentials. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Scope-changing compromise of Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a remote, unauthenticated attacker abuse the LDAP interface to read and alter all directory-accessible data, tagged by Oracle as an authentication bypass. Because OUD brokers identity and access for downstream Fusion Middleware systems, successful attacks carry a CVSS 3.1 scope change (S:C) and can significantly impact other products beyond the directory itself. No public exploit identified at time of analysis; exploitation is rated high-complexity (AC:H), so this is a serious but non-trivial-to-weaponize flaw addressed in Oracle's July 2026 Critical Patch Update.

Elevation-of-scope compromise in Oracle Unified Directory (Fusion Middleware, OUD Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets an authenticated low-privileged attacker with LDAP network access read all OUD-accessible data and modify some of it, with a scope change that can significantly impact additional connected products. Oracle rates it CVSS 3.1 8.5, and the source intelligence tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and scope change make it a meaningful patch priority for Oracle-integrated identity infrastructure.

Full compromise of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a remote attacker interacting over LDAP can take over the directory service and impact other trusting systems due to a scope change. The flaw scores CVSS 9.0 but is rated high attack complexity (AC:H), meaning exploitation is difficult despite requiring no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full compromise of Oracle Unified Directory (OUD Core) is possible when a low-privileged attacker with network access sends malicious traffic over LDAP, per the July 2026 Oracle Critical Patch Update. Affected supported releases are 12.2.1.4.0 and 14.1.2.1.0, and Oracle rates the flaw as easily exploitable with a CVSS 3.1 base score of 8.8, resulting in complete takeover of the directory service. No public exploit identified at time of analysis and the CVE is not on CISA KEV, but authenticated LDAP reachability makes it a strong patching priority for exposed directory servers.

Privilege escalation and data compromise in Oracle Unified Directory 14.1.2.1.0 (OUD Core) lets a low-privileged, authenticated attacker with LDAP network access read, create, modify or delete all OUD-accessible data and cause a partial denial of service. Oracle rates it CVSS 9.9 with a scope change, meaning exploitation can significantly impact additional products beyond the directory itself. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a top patching priority.

Privilege-scoped data compromise in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged, authenticated attacker with LDAP network access read and modify all directory-accessible data, with a scope change that can significantly impact other integrated products. Rated CVSS 3.1 8.2 (C:H/I:H, no availability impact) and tagged as an authentication-bypass class issue, though the attack is rated hard to execute (AC:H). No public exploit identified at time of analysis and it is not on CISA KEV.

Privilege escalation and cross-product data compromise in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core) lets a low-privileged network attacker abuse the LDAP interface to gain complete read access to all directory-accessible data and partial write access. Vendor-tagged as an authentication bypass with a scope change, meaning successful attacks can significantly impact other products that rely on this directory. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the CVSS 3.1 base score of 8.5 with 'easily exploitable' vendor language marks it as a high-priority patch.

Complete takeover of Oracle Unified Directory (OUD Core) is possible when a remote, unauthenticated attacker exploits a flaw reachable over the LDAP protocol in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, per Oracle's July 2026 Critical Patch Update. Oracle rates the attack complexity as high, and a successful attack yields full confidentiality, integrity, and availability compromise (CVSS 8.1). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation would currently be theoretical or targeted rather than commodity.

Full takeover of Oracle Access Manager (Fusion Middleware) is possible via a network-based HTTP attack against the Authentication Engine component in supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated remote attacker (PR:N) can achieve complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), though Oracle rates the attack complexity as high (AC:H), meaning exploitation is difficult and likely requires specific conditions or timing to succeed. This was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege-escalating takeover of Oracle TimesTen In-Memory Database 26.1.1.1.0 is possible through its Kubernetes Operator component, where a low-privileged attacker with network access over HTTPS can fully compromise the database. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond TimesTen itself, and its 9.9 CVSS score reflects complete confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make it a high-priority patch item.

Privilege escalation to full product takeover in Oracle GoldenGate (Admin Server Executable) lets a low-privileged, network-adjacent attacker seize complete control of the GoldenGate instance over HTTPS. Affected releases span the 19c (19.1.0.0.0-19.30.0.0), 21c (21.3-21.21), and 23ai (23.4-23.26.1) branches, and Oracle rates the impact 8.8 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a fix is delivered in the Oracle Critical Patch Update of July 2026.

Full product takeover in Oracle GoldenGate Microservices affects releases 19.1.0.0.0-19.30.0.0, 21.3-21.21, and 23.4-23.26.1, where a low-privileged attacker with HTTP network access can compromise the entire GoldenGate instance. Oracle rates this CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and flags it as easily exploitable, meaning a single authenticated foothold escalates to complete control. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Full takeover of Oracle GoldenGate is possible in versions 21.3-21.21 and 23.4-23.26.1 through the Distribution Server executable, where a high-privileged attacker reaching the server over HTTPS can fully compromise confidentiality, integrity, and availability. The flaw carries a CVSS 3.1 base score of 7.2 and requires existing elevated privileges rather than anonymous access, so it is best characterized as a privileged-user-to-full-compromise escalation within the GoldenGate management plane. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Complete remote takeover of Oracle Service Delivery Platform (a component of Oracle Fusion Middleware, versions 12.2.1.4.0 and 14.1.2.0.0) is possible via the Messaging Enabler component, reachable over HTTP by an unauthenticated attacker. The flaw carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation not only fully compromises the platform's confidentiality, integrity, and availability but can also significantly impact other connected products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a top-priority patch from the Oracle July 2026 Critical Patch Update.

Complete takeover of Oracle Service Delivery Platform (a Fusion Middleware component) is possible when unauthenticated attackers reach the T3 or IIOP protocols exposed by the underlying WebLogic server, per Oracle's July 2026 Critical Patch Update. The Messaging Enabler component in versions 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised (confidentiality, integrity, and availability), earning a CVSS 9.8. No public exploit has been identified at time of analysis, but the T3/IIOP attack surface has a long history of critical WebLogic deserialization exploitation.

Full takeover of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler component) is possible by unauthenticated remote attackers reaching the T3 or IIOP protocols. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects complete loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, but the T3/IIOP attack surface is a historically abused deserialization vector on the underlying WebLogic stack, warranting priority patching.

Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network reach make it a high-priority patching item.

Complete takeover of Oracle Service Delivery Platform (part of Oracle Fusion Middleware) is possible via its Messaging Enabler component, affecting versions 12.2.1.4.0 and 14.1.2.0.0. A remote, unauthenticated attacker reaching the T3 or IIOP protocol ports can fully compromise the platform (full confidentiality, integrity, and availability loss, CVSS 9.8). This was fixed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Complete takeover of Oracle Communications Service Delivery Platform (SDP) 12.2.1.4.0 and 14.1.2.0.0, shipped within Oracle Fusion Middleware, is achievable by a remote unauthenticated attacker reaching the T3 or IIOP protocols exposed by the underlying WebLogic Server (Messaging Enabler component). Rated CVSS 3.1 9.8 with full confidentiality, integrity and availability impact, this was disclosed in the Oracle July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Privilege-scoped data compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged local user with logon access to the host read, create, modify, or delete all SDP-accessible data. Because the flaw carries a scope change (S:C), successful attacks can significantly impact adjacent Oracle products beyond SDP itself. There is no public exploit identified at time of analysis, and no EPSS or KEV signal is available in the provided data; Oracle disclosed it in the July 2026 Critical Patch Update.

Full system takeover in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-authenticated attacker to compromise the platform via the WebLogic T3/IIOP protocols. The flaw carries a CVSS 3.1 score of 9.9 with a scope change, meaning successful exploitation impacts additional downstream products beyond the vulnerable component. Addressed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker can compromise the platform over HTTP. Oracle rates this a CVSS 9.8 with high confidentiality, integrity, and availability impact, and it was disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Complete takeover of Oracle Service Delivery Platform is achievable by an unauthenticated remote attacker via SOAP requests to the Messaging Enabler component, affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. Rated CVSS 10.0 with a scope change, successful exploitation can pivot to compromise additional connected products beyond SDP itself. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the maximum score and trivial exploitation warrant urgent patching via Oracle's July 2026 Critical Patch Update.

Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 allows an unauthenticated remote attacker to take over the platform via crafted HTTP requests. Oracle rates this 9.8 (CVSS 3.1) with full confidentiality, integrity, and availability impact, disclosed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege-abusing remote compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a low-privileged attacker reachable over the WebLogic T3/IIOP protocols read and modify all SDP-accessible data and cause partial denial of service. The CVSS 3.1 base score reaches 9.9 because of a scope change: the flaw sits in SDP but successful attacks significantly impact other products co-hosted in the WebLogic domain. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity over a network-facing T3/IIOP surface makes it a high-priority patch.

Complete takeover of Oracle Communications/Fusion Middleware Service Delivery Platform (versions 12.2.1.4.0 and 14.1.2.0.0, Messaging Enabler component) is possible by an unauthenticated remote attacker reaching the T3 or IIOP protocol. The flaw scores CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and requires no user interaction; no public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the T3/IIOP attack surface historically maps to WebLogic-style deserialization abuse. It was self-reported by Oracle and disclosed in the July 2026 Critical Patch Update.

Complete takeover of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 is possible by an unauthenticated remote attacker reaching the server over the T3 or IIOP protocols. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), placing it among Oracle's most severe July 2026 Critical Patch Update fixes. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of trivially weaponized deserialization exploits.

Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by an unauthenticated remote attacker who reaches the T3 or IIOP protocol endpoints. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, carrying a maximum-severity CVSS 9.8 with full confidentiality, integrity, and availability loss. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the T3/IIOP attack surface is historically a high-value target in the Oracle WebLogic/Fusion stack.

Unauthenticated remote compromise of the Oracle WebLogic Server Proxy Plug-in (version 15.1.1.0.0), a module that fronts WebLogic behind third-party web servers such as Apache HTTP Server and Oracle HTTP Server, allowing a network attacker to read and modify critical data with no credentials or user interaction. Oracle rates this a maximum CVSS 3.1 10.0 because the flaw crosses a trust boundary (scope change), meaning exploitation of the plug-in significantly impacts additional connected products. Vendor tagging identifies it as an authentication bypass; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability warrants urgent patching.

Unauthorized data modification in Oracle WebLogic Server Proxy Plug-in (the proxy module for third-party web servers such as Apache/Oracle HTTP Server) lets a remote, unauthenticated attacker tamper with critical data over HTTP. Oracle's authoritative scoring rates this CVSS 3.1 7.5 with integrity-only impact (I:H, C:N, A:N), disclosed in the July 2026 Critical Patch Update and tagged as an authentication-bypass class issue. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Full compromise of Oracle HTTP Server (Oracle Fusion Middleware) is possible via the bundled Apache Plugin (mod_wl/proxy) component in supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing a network-based unauthenticated attacker to take over the server over HTTP. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, this is one of the highest-severity issues in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the low-complexity, no-privilege, no-interaction profile makes it a top-priority patch.

Complete takeover of Oracle Unified Directory (OUD Core) is achievable by an unauthenticated, network-based attacker communicating over LDAP against supported versions 12.2.1.4.0 and 14.1.2.1.0. Rated CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and marked 'easily exploitable' by Oracle, the flaw yields product compromise without credentials or user interaction. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV, but the trivial exploitation profile makes it a top patching priority.

Privilege escalation to full takeover in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged attacker with LDAP network access completely compromise the directory service, with a scope change that can significantly impact other connected products. Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' characterization make this a high-priority patch from the July 2026 Oracle Critical Patch Update.

Complete takeover of Oracle Unified Directory (OUD) is possible when an unauthenticated remote attacker sends crafted traffic to the LDAP service in supported versions 12.2.1.4.0 and 14.1.2.1.0 of this Oracle Fusion Middleware component. The maximum CVSS 3.1 base score of 10.0 reflects full confidentiality, integrity, and availability loss plus a scope change that can significantly impact adjacent products. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Unauthorized data access in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a remote unauthenticated attacker reach critical directory data over HTTP, with a scope change that can spill impact into other products relying on the directory. Oracle rates it CVSS 3.1 8.6 with high confidentiality impact and no integrity or availability effect, and tags it as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote unauthenticated compromise of Oracle Access Manager (Fusion Middleware Authentication Engine) in supported versions 12.2.1.4.0 and 14.1.2.1.0 allows a network attacker to fully take over the product via HTTP with no credentials or user interaction. Oracle rates this a maximum CVSS 3.1 10.0 because the scope-changing flaw can pivot beyond OAM to impact additional products. No public exploit identified at time of analysis, but as an SSO/identity gatekeeper the impact of takeover is severe.

Unauthenticated authentication-bypass in Oracle Access Manager (Fusion Middleware Authentication Engine, versions 12.2.1.4.0 and 14.1.2.1.0) lets a remote attacker over HTTP compromise the identity/SSO tier and read all data it can access. Because of a CVSS scope change, successful attacks can significantly impact other products that rely on OAM for authentication, magnifying the blast radius. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV; risk is driven by the low-complexity, no-authentication network vector (CVSS 3.1 base 8.6).

Full takeover of Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine component) is achievable by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS data was not provided.

Full compromise of Oracle JDeveloper (Oracle Fusion Middleware) is possible via the ADF Shared Components subcomponent, allowing an authenticated high-privileged attacker with HTTP network access to take over the product with high confidentiality, integrity, and availability impact. It affects supported versions 12.2.1.4.0 and 14.1.2.0.0, is disclosed in Oracle's July 2026 Critical Patch Update, and carries a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Fusion Middleware, Core component) lets a low-privileged attacker with only HTTP network access compromise the entire server. Successful exploitation delivers high confidentiality, integrity, and availability impact (CVSS 3.1 8.8), effectively granting control of the WebLogic instance. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but Oracle rates it 'easily exploitable' and shipped a fix in the July 2026 Critical Patch Update.

Full compromise of Oracle WebCenter Content is possible via the Content Server component in Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0, where an attacker holding high privileges can send crafted HTTP requests to take over the product with confidentiality, integrity, and availability impact. Oracle rates the flaw CVSS 3.1 7.2 and describes it as easily exploitable once the required privilege level is held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the addressing of it in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.

Full compromise of Oracle WebCenter Content (Content Server component) allows a low-privileged, network-based attacker over HTTP to take over the application, impacting confidentiality, integrity, and availability. Affected releases are 12.2.1.4.0 and 14.1.2.0.0, and the flaw is rated CVSS 3.1 8.8 and characterized by Oracle as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.

Privilege escalation to full takeover in Oracle Access Manager (Fusion Middleware) 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged, network-based attacker to compromise the Authentication Engine over HTTP and pivot beyond the product itself (scope change). Because Access Manager brokers single sign-on and authentication for downstream Fusion Middleware applications, its compromise cascades into the identity trust chain. Rated CVSS 3.1 9.9 with full CIA impact; no public exploit identified at time of analysis, and it is addressed in Oracle's July 2026 Critical Patch Update.

Privilege-escalation-to-takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (OIM Legacy UI component) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the product, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 8.5 (High) with full confidentiality, integrity, and availability impact, though the AC:H metric marks it as difficult to exploit. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.

Remote takeover of Oracle Identity Manager (Oracle Fusion Middleware, OIM Legacy UI component) allows an unauthenticated network attacker to fully compromise the identity governance server via the T3 and IIOP protocols. Oracle rates it CVSS 3.1 9.8 with high confidentiality, integrity and availability impact and describes it as 'easily exploitable', meaning a successful attack yields complete product takeover. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low complexity and unauthenticated network vector make it a top-priority patch.

Complete takeover of Oracle Access Manager is possible when an unauthenticated attacker with network access sends crafted HTTP requests to the Authentication Engine component of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0 and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). It was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis.

Unauthorized data access in Oracle Access Manager (Fusion Middleware, Authentication Engine) 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, with a scope change that can significantly impact other Oracle products relying on it for single sign-on. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 score of 8.6 and is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Authentication bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to read and modify all data accessible to the product via crafted HTTP requests. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact, the flaw was disclosed by Oracle in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and the low attack complexity plus no-privilege/no-interaction requirements make it a top-priority patch for any Oracle IAM deployment.

Full takeover of Oracle Access Manager (Authentication Engine component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is possible for a low-privileged attacker positioned on the same physical/adjacent network segment as the host running OAM. Per the CVSS vector (AV:A/AC:L/PR:L), exploitation is low-complexity and requires only some level of existing authenticated access plus adjacent network reachability, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis; addressed in Oracle's July 2026 Critical Patch Update.

Data compromise in Oracle Identity Manager (OIM Legacy UI component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the identity platform. The flaw is tracked in Oracle's July 2026 Critical Patch Update and carries a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact. No public exploit has been identified at time of analysis, but the low attack complexity and network vector make it a strong patching priority for enterprise IAM deployments.

Unauthorized data disclosure in Oracle Data Integrator (Oracle Fusion Middleware, Patchset Assistant component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker read all data accessible to the product over HTTP. The flaw carries a CVSS 3.1 base score of 7.5 with confidentiality-only impact and was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis. Vendor tagging references an authentication-bypass theme, consistent with the PR:N (no-privilege) requirement.

Data compromise in Oracle MySQL Connectors (Connector/Net component) versions 9.7.0 through 9.7.1 allows a remote, unauthenticated attacker with network access via multiple protocols to read, create, delete, or modify all data accessible to the connector. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 base score of 7.4 with full confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and the high attack complexity (AC:H) tempers real-world exploitability.

Full takeover of Oracle MySQL Server and MySQL Cluster is possible through the Server: X Plugin component, allowing a high-privileged attacker with network access via multiple protocols to compromise confidentiality, integrity, and availability. Affected builds include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list, though Oracle rates it as easily exploitable once the required high privileges are held.

Remote code execution / full-server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a low-privileged attacker with network access via the RMI protocol to fully compromise the server. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with CVSS 3.1 base score 8.8 and full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but WebLogic RMI flaws are a historically favored target, so patching from the July 2026 Oracle CPU should be prioritized.

Server takeover in Oracle WebLogic Server (Fusion Middleware, Core component) lets an unauthenticated remote attacker fully compromise affected instances by abusing the proprietary T3 and IIOP remote protocols. Supported releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are vulnerable, and successful exploitation yields complete confidentiality, integrity and availability loss. No public exploit identified at time of analysis; the flaw is rated high complexity (CVSS 8.1) and was disclosed in Oracle's July 2026 Critical Patch Update.

Full takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) is possible by an unauthenticated attacker positioned on the same physical/adjacent network segment as the affected host, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable, though no public exploit identified at time of analysis and it is not listed in CISA KEV. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Full takeover of Oracle Coherence is possible by remote unauthenticated attackers who reach the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the Core component of versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.

Full takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) is achievable by an unauthenticated remote attacker over TCP against affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates it CVSS 9.8 with high impact to confidentiality, integrity, and availability, and describes it as 'easily exploitable,' meaning no authentication, no user interaction, and low attack complexity are required. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the network-facing, unauthenticated nature makes it a high-priority patch item.

Data tampering in Oracle Coherence (Core component) of Oracle Fusion Middleware allows a low-privileged attacker with TCP network access to create, delete, or modify critical data and read a subset of accessible data. Versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected, with Oracle rating the flaw easily exploitable (CVSS 3.1 base 7.1, high integrity impact). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.

Remote takeover of Oracle Coherence (Fusion Middleware Core component) lets an unauthenticated attacker with TCP network access fully compromise the in-memory data grid. Oracle rates this CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning a single crafted network interaction against a reachable cluster node can yield complete control. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low complexity and no-authentication profile make it a high-priority patch in the July 2026 Oracle Critical Patch Update.

Remote takeover of Oracle Coherence (the Core component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected in-memory data grid, per Oracle's July 2026 Critical Patch Update. Oracle rates the flaw CVSS 9.8 with 'easily exploitable' language and complete confidentiality, integrity, and availability impact, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was provided.

Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is achievable by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update, affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates it CVSS 9.8 with full confidentiality, integrity and availability impact and describes it as 'easily exploitable,' meaning no user interaction, privileges, or special preconditions are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity unauthenticated network profile makes it a high-priority patch.

Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible over the network (TCP) by an unauthenticated remote attacker per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 reflects complete confidentiality, integrity, and availability loss (product takeover) with no authentication or user interaction required. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so exploitation is not yet confirmed in the wild.

Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access exploits a Core-component flaw in Oracle Fusion Middleware releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates the issue "easily exploitable" with a CVSS 3.1 base score of 9.8 and full confidentiality, integrity and availability impact, meaning a remote actor can seize control of the in-memory data grid without credentials. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Full takeover of Oracle Coherence (Fusion Middleware Core) is possible by a low-privileged network attacker over TCP in supported versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with a scope change that can significantly impact additional co-located products beyond Coherence itself. Rated CVSS 3.1 8.5 with high confidentiality, integrity and availability impact, though the high attack complexity means exploitation is not trivial. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized data disclosure in Oracle WebLogic Server (WLS Web Services component) lets an unauthenticated remote attacker read all data accessible to the server over HTTP, with a scope change that can significantly impact additional products beyond WebLogic itself. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.6 (confidentiality-only) and tagged as an authentication bypass; no public exploit identified at time of analysis.

Complete takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible by remote, unauthenticated attackers sending crafted HTTP traffic to the Core component, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects trivially exploitable, network-facing compromise with no authentication or user interaction. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but WebLogic's history as a high-value RCE target makes this a top-priority patch.