Authentication Bypass

Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware Core component) lets network attackers read, create, delete, or modify any server-accessible data over HTTP. Tagged as an authentication bypass and scored CVSS 3.1 9.1, it affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitability (AC:L/PR:N/UI:N) makes it a high-priority patch for internet-facing deployments.

Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network HTTP access to fully compromise confidentiality, integrity, and availability of the server. Rated CVSS 3.1 8.8 (High) and disclosed in Oracle's July 2026 Critical Patch Update, the flaw requires only low-level authenticated access and no user interaction, making it attractive for post-authentication lateral movement. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.

Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) is achievable by a low-privileged, network-adjacent attacker abusing the SAML authentication path, with a scope change that can propagate impact into additional connected products. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; the CVSS 9.9 rating reflects complete loss of confidentiality, integrity and availability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the low complexity and low privilege requirement make it a top-priority patching item.

Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing a remote unauthenticated attacker with only TCP network access to fully compromise the server. The maximum-severity CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) reflects that successful exploitation yields complete confidentiality, integrity, and availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but WebLogic's history as a mass-exploited target makes this a high-priority patch.

Remote takeover of Oracle WebLogic Server (Fusion Middleware, Core component) lets an unauthenticated network attacker fully compromise the server by sending crafted requests over the T3 or IIOP protocols. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact and calls it 'easily exploitable,' affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit is identified at time of analysis and it is not in CISA KEV, but this class of unauthenticated T3/IIOP takeover has historically been rapidly weaponized in WebLogic.

Server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a low-privileged, remote attacker with HTTP network access to fully compromise the server, per the Oracle July 2026 Critical Patch Update. Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and Oracle rates the flaw 'easily exploitable' with high confidentiality, integrity and availability impact (CVSS 3.1 8.8). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-network vector make it a high-priority patch item.

Complete server takeover in Oracle WebLogic Server (Fusion Middleware Core component) lets an unauthenticated remote attacker fully compromise affected instances by sending crafted traffic over the T3 or IIOP protocols. It carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected; no public exploit identified at time of analysis and it is not currently listed in CISA KEV.

Remote takeover of Oracle WebLogic Server (Fusion Middleware, Core component) is possible by an unauthenticated attacker sending crafted traffic over the T3 or IIOP protocols against versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates it CVSS 3.1 8.1 with full confidentiality, integrity, and availability compromise, but flags high attack complexity (AC:H), meaning the flaw is difficult to exploit despite requiring no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is currently a patch-priority based on impact rather than confirmed exploitation.

Remote takeover of Oracle WebLogic Server (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the server via a crafted SOAP request. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected, and Oracle rates it easily exploitable with complete confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit was identified at time of analysis, but given WebLogic's history as a mass-exploitation target, this warrants immediate patching from the July 2026 Critical Patch Update.

Remote takeover of Oracle WebLogic Server (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the server via HTTP, per Oracle's July 2026 Critical Patch Update. Affected releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, all carrying a maximum-severity CVSS 3.1 score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis, but WebLogic's history as a repeated exploitation target makes this a high-priority patch.

Complete server takeover in Oracle WebLogic Server (Fusion Middleware, Core component) is possible by unauthenticated attackers who reach the T3 or IIOP remoting protocols over the network. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning any exposed T3/IIOP listener on affected 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 builds can be commandeered without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of weaponized deserialization exploits, so patch urgency is high.

Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated remote attacker with TCP network access to compromise the affected instance, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' Affected releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.2.0.0 (Core component) allows a high-privileged attacker positioned on the adjacent physical communication segment to compromise the server and, due to a scope change, significantly impact additional connected products. Successful exploitation yields complete loss of confidentiality, integrity, and availability. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.

Full takeover of Oracle MySQL Connector/Net (versions 9.7.0 and 9.7.1) is possible by a low-privileged network attacker who wins a high-complexity attack, with a scope change that lets the compromise significantly impact products beyond the connector itself. Oracle rates this CVSS 3.1 8.5 with high confidentiality, integrity, and availability impact, and it is addressed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full compromise ("takeover") of Oracle's MySQL Connector/NET client library affects the ADO.NET data provider in MySQL Connectors versions 9.7.0 and 9.7.1, where an unauthenticated network attacker can seize control of the connector, impacting confidentiality, integrity, and availability of any .NET application relying on it. Rated CVSS 3.1 8.1 (High) with high attack complexity, this is a client-side flaw disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized data access and modification in Oracle MySQL Connectors (Connector/C++) versions 9.7.0 through 9.7.1 lets an unauthenticated remote attacker reach and tamper with all data accessible to the connector. The flaw is rated CVSS 7.4 with high confidentiality and integrity impact but no availability impact, and is described by Oracle as difficult to exploit (high attack complexity). No public exploit has been identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.

Sensitive-data disclosure and partial denial of service in Oracle Payments (Oracle E-Business Suite File Transmission component, versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read all Oracle Payments-accessible data and partially disrupt the service. Oracle rates it CVSS 3.1 7.1 (C:H/A:L), and intelligence tags flag an authentication-bypass characteristic, though the CVSS vector confirms some privilege is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full compromise of Oracle BI Publisher (part of Oracle Analytics, BI Platform Security component) is achievable by a remote, unauthenticated attacker sending crafted HTTP requests, per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N scoring 9.8. Affected releases are the 8.2.0.0.0 and 12.2.1.4.0 versions, and Oracle rates successful attacks as resulting in complete takeover of the BI Publisher instance with high confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so risk is currently driven by the ease and severity of the flaw rather than confirmed active exploitation.

Unauthorized data disclosure in Oracle Hospitality Simphony POS (versions 19.8-19.8.5, 19.9-19.9.3, and 19.10) lets a remote, unauthenticated attacker reach all data accessible to the application over HTTP. Oracle rates it CVSS 7.5 with confidentiality-only impact and describes it as 'easily exploitable,' and the vendor tags it as an Authentication Bypass. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full compromise (takeover) of Oracle Hospitality Simphony is possible when an unauthenticated attacker with network access reaches the POS component over HTTP, affecting supported versions 19.8-19.8.5, 19.9-19.9.3, and 19.10. Oracle rates this CVSS 3.1 8.1 with high confidentiality, integrity, and availability impact, but flags the attack as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control such as timing, specific state, or reconnaissance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.

Data tampering and denial of service in Oracle Hospitality Simphony (POS component) versions 19.8-19.8.5, 19.9-19.9.3 and 19.10 allow a remote unauthenticated attacker to compromise the point-of-sale platform over HTTP. Successful attacks can create, delete or modify all Simphony-accessible critical data and can hang or repeatedly crash the service for a complete denial of service. Rated CVSS 3.1 9.1 with no confidentiality impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized data disclosure in Oracle Hospitality Simphony (POS component) versions 19.8-19.8.5, 19.9-19.9.3, and 19.10 lets a remote, unauthenticated attacker read all data accessible to the application over HTTP. The flaw, tagged as an authentication bypass, requires no privileges or user interaction and yields high confidentiality impact (CVSS 3.1 base 7.5) with no impact to integrity or availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is currently theoretical but the low attack complexity makes it a real patching priority.

Full takeover of Oracle MySQL Server and MySQL Cluster is possible through the Server: Group Replication Plugin, where a local attacker holding only a logon to the host running the database can compromise the instance without any database credentials. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1, and carries a CVSS 3.1 base score of 8.4 with high confidentiality, integrity and availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is already logged into the infrastructure running VirtualBox to compromise the hypervisor, with a scope change (CVSS S:C) indicating impact beyond VirtualBox itself - consistent with a guest-to-host or component-crossing escape. Oracle rates it CVSS 3.1 7.5 with full confidentiality, integrity, and availability impact, though exploitation is difficult (AC:H, PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege escalation to full takeover in Oracle GoldenGate Service Manager lets a low-privileged attacker with HTTP network access fully compromise the product across versions 19.1.0.0.0-19.29.0.0, 21.3-21.21, and 23.4-23.26.1.0.0. Oracle rates this easily exploitable with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attacker with a logon to the host take over the VirtualBox hypervisor and, because of a scope change, impact additional products beyond VirtualBox itself. The flaw carries full confidentiality, integrity, and availability impact but is rated difficult to exploit, requiring high privileges and high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized data access and partial denial of service in Oracle E-Business Suite's Oracle Workflow component (Workflow Notification Mailer), versions 12.2.3 through 12.2.15, lets a remote unauthenticated attacker read a subset of Workflow data, perform limited update/insert/delete operations, and partially disrupt the service over HTTP. Oracle rates it CVSS 3.1 7.3 and flags it as 'easily exploitable' with no authentication required. No public exploit is identified at time of analysis and it is not listed in CISA KEV, though its low-friction network vector warrants prompt patching in the July 2026 Critical Patch Update.

Unauthorized data modification in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition (Libraries component) lets a remote, unauthenticated attacker corrupt, create, or delete critical data by feeding crafted input to affected Java APIs, for example through a web service that passes data to those APIs. It carries CVSS 3.1 7.5 with an integrity-only impact (C:N/I:H/A:N) and is described by Oracle as easily exploitable over multiple network protocols. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of the Java runtime makes patching a priority.

Unauthorized data access and modification in the Scripting component of Oracle Java SE 8u491, 8u491-perf, and 11.0.31 allows a remote unauthenticated attacker to compromise the confidentiality and integrity of all Java-accessible data via APIs reachable over multiple network protocols. Rated CVSS 3.1 7.4 (High) by Oracle, the flaw is difficult to exploit (AC:H) and carries no availability impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It also affects sandboxed Java Web Start/applet deployments that run untrusted code and rely on the Java sandbox.

Complete takeover of Oracle Data Integrator (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a remote, unauthenticated attacker sending crafted HTTP requests to the REST Service component. Because the CVSS scope is changed (S:C), successful exploitation can pivot beyond ODI to significantly impact other integrated Fusion Middleware products, and the maximum 10.0 base score reflects full loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, but the trivial exploitability and network reach make this a top-priority patch from Oracle's July 2026 Critical Patch Update.

Integrity and availability compromise in Oracle VM VirtualBox 7.2.8 (Core component) allows a high-privileged local user, with the aid of a separate tricked user, to modify or destroy critical data and force a complete denial of service, with impact crossing into additional products due to a scope change. Rated CVSS 3.1 7.4 and disclosed in Oracle's July 2026 Critical Patch Update, it carries no confidentiality impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthenticated remote compromise of Oracle Net Services affects Oracle Database Server versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2, letting a network attacker reaching the database listener over Oracle Net (typically TCP 1521) read all data accessible to the component and hang or repeatedly crash it for a complete denial of service. Rated CVSS 3.1 9.1 with high confidentiality and availability impact and no integrity impact, it requires no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network-facing nature make it a high remediation priority.

Full compromise of Oracle Access Manager 14.1.2.1.0 (Oracle Fusion Middleware) is possible through its Authentication Engine, allowing a low-privileged attacker with HTTP network access to take over the identity and access management platform. Oracle rates this CVSS 3.1 8.8 with high impact to confidentiality, integrity, and availability, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote takeover of Oracle Siebel CRM (Siebel CRM Development, Siebel Approval Manager component) is possible by an unauthenticated attacker sending crafted HTTP requests, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, affecting supported versions 17.0 through 26.3. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list, but the unauthenticated network-facing profile makes it a high-priority patch item.

Privilege escalation and full component takeover affects Oracle Contracts Integration within Oracle E-Business Suite (Internal Operations component), versions 12.2.3 through 12.2.15, where a low-privileged, network-authenticated attacker can compromise the component and, due to a scope change (S:C), significantly impact additional connected products. Rated CVSS 3.1 8.5 (High) with full confidentiality, integrity, and availability loss, though the attack is flagged as difficult to exploit (AC:H). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Product takeover in Oracle Bills of Material (Bill Issues component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access fully compromise the module, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 8.8 with high impact across confidentiality, integrity, and availability, meaning an authenticated user can read, alter, and destroy Bills of Material data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle EBS is a recurring high-value target for post-authentication attacks.

Data compromise in Oracle E-Business Suite's Document Management and Collaboration module (Attachments component) lets a low-privileged, network-adjacent attacker read, create, modify, or delete all data accessible to the module across supported releases 12.2.3 through 12.2.15. Oracle rates it CVSS 8.1 with high confidentiality and integrity impact but no availability effect, and flags it as 'easily exploitable' - meaning any authenticated EBS user can weaponize it over HTTP. There is no public exploit identified at time of analysis and it is not on CISA KEV, but Oracle EBS Attachments flaws have historically been high-value targets.

Unauthorized access to critical data in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible via the bundled OpenSearch Dashboards component, where a remote unauthenticated attacker can compromise confidentiality by luring a victim into interacting with attacker-supplied content (UI:R). The scope-change and confidentiality-only vector (S:C/C:H/I:N/A:N), combined with the vendor's 'Authentication Bypass' tag, is characteristic of a client-side flaw such as cross-site scripting in the Dashboards UI that lets an attacker read data across products the victim can reach. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it is addressed in Oracle's July 2026 Critical Patch Update.

Data compromise in Oracle Product Hub (Oracle E-Business Suite Item Catalog component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all Product Hub-accessible data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle E-Business Suite flaws are attractive targets and this issue is fixed in the July 2026 Critical Patch Update.

Data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (Process Scheduler component) lets a low-privileged, network-reachable attacker read and modify critical data after luring a legitimate user into an interaction, with a scope change that can spill impact onto additional connected products. Oracle rates it CVSS 3.1 8.7 (C:H/I:H, no availability impact). No public exploit is identified at time of analysis and it is not in CISA KEV, but ease of exploitation and the cross-boundary scope change make it a notable item in the July 2026 Oracle Critical Patch Update.

Compromise of Oracle Product Workbench (a Security component of Oracle E-Business Suite) allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the application, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and affects EBS versions 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle rates it 'easily exploitable.'

Privilege-boundary compromise in Oracle Communications Pricing Design Center 15.0.0.0.0 through 15.2.0.0.0 (On-premise Deployment) lets a low-privileged attacker who already has a logon to the host infrastructure read all data accessible to the product and modify a subset of it, with a scope change that can significantly affect additional products. Oracle rates it CVSS 3.1 7.3 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Self Update Framework component, where an authenticated high-privileged attacker reaching the console over HTTPS can compromise the confidentiality, integrity and availability of the entire management platform. Oracle rates it CVSS 3.1 7.2 and describes it as easily exploitable once the required privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full compromise of the Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through its Self Update Framework component, allowing an already high-privileged, authenticated attacker with network/HTTPS access to escalate to complete takeover of the platform with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Enterprise Manager centrally administers large Oracle estates, a takeover here is a high-value pivot despite the elevated privilege prerequisite.

Full compromise of Oracle Enterprise Manager Base Platform is possible through the Self Update Framework component in versions 13.5 and 24.1, where a low-privileged attacker with network access over HTTPS can escalate to complete takeover of the platform. The CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.

Data tampering and information disclosure in Oracle Enterprise Manager Base Platform (Discovery Framework component, versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the console over HTTPS and, if the difficult-to-exploit conditions are met, create, delete, or modify critical data and read a subset of application data, plus cause a partial denial of service. Oracle rates this CVSS 3.1 7.0 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Data manipulation in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Metadata Plugin component) allows a low-privileged attacker with HTTPS network access to create, delete, or modify critical data and read a subset of data across the platform. Rated CVSS 3.1 7.1 by Oracle, the flaw is described as easily exploitable and tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Complete product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows an unauthenticated remote attacker to fully compromise the management platform via the Agent Next Gen component over HTTPS. The CVSS 3.1 base score of 9.8 reflects total loss of confidentiality, integrity, and availability with no privileges or user interaction required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial exploitability and full-takeover impact make this a high-priority patch item from Oracle's July 2026 Critical Patch Update.

Privileged data compromise in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1), via the Agent Next Gen component, lets a low-privileged, network-authenticated attacker read and modify all EM-accessible data over HTTPS. The scope-changing flaw (S:C) means impact extends beyond EM into other managed products, and the Oracle-supplied 'Authentication Bypass' tag suggests trust/privilege boundaries can be crossed. No public exploit identified at time of analysis; high attack complexity (AC:H) tempers real-world exploitability.

Product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Enterprise Config Management component) allows an authenticated low-privileged attacker with network access over HTTPS to fully compromise the platform. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, the flaw requires only low privileges and no user interaction, making it readily exploitable once an attacker holds any valid EM account. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.

Unauthorized data access and partial denial of service in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows a remote, unauthenticated attacker to reach the Enterprise Config Management component over HTTP and read, insert, update, or delete a subset of EM-accessible data. Oracle rates it CVSS 3.1 7.3 and describes it as 'easily exploitable' with no authentication or user interaction, so it is a high-priority patch for internet- or intranet-reachable EM consoles. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege-abusing compromise of the Oracle Enterprise Manager Base Platform UI Framework lets a low-privileged, network-adjacent attacker read all EM-accessible data and partially tamper with or degrade the platform over HTTPS. The scope-changing flaw (CVSS 9.1) means a successful attack can spill beyond EM into other managed products, and Oracle's own tags flag authentication-bypass and denial-of-service behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a high patch priority.

Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible via the Connector Framework component, allowing an attacker who already holds high privileges to fully compromise confidentiality, integrity, and availability over the network via HTTPS. Oracle rates this CVSS 7.2 and, despite the 'Information Disclosure' tag, the described impact is complete product takeover (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Information disclosure with scope change in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Application Service Level Management component) lets a low-privileged, network-authenticated attacker read all data accessible to the platform over HTTPS. Oracle rates it CVSS 3.1 7.7 with a scope change, so a successful attack can significantly impact products beyond Enterprise Manager itself. No public exploit is identified at time of analysis and it is not in CISA KEV, but low attack complexity plus total confidentiality loss make it a meaningful priority in Oracle-managed estates.

Full takeover of Oracle Retail Integration Bus 16.0.3 (RIB Kernel component) is achievable by an unauthenticated remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact reflects complete compromise of the RIB instance with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially low attack complexity makes it a high-priority patch target.

Full compromise of Oracle Retail Integration Bus 14.1.3.2 (RIB Kernel component) allows a remote, unauthenticated attacker to take over the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Unauthenticated network compromise of Oracle Utilities Network Management System (Mobile component) allows remote attackers to gain partial read access and partial write (insert/update/delete) access to NMS-accessible data over HTTP, with a scope change that can significantly impact adjacent products. Oracle tags this as an Authentication Bypass and rates it CVSS 7.2; no public exploit was identified at time of analysis, and it is not listed in CISA KEV. Affected releases span the 2.5.x, 2.6.x, and 25.12.x branches, fixed in the Oracle Critical Patch Update of July 2026.

Full compromise of Oracle Human Resources (part of Oracle E-Business Suite) is possible via the Data Removal Tool component, where a high-privileged attacker with HTTP network access can take over the module across supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, and Oracle classifies it as easily exploitable. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Data compromise in Oracle Retail EFTLink (versions 21.0.0 through 25.0.0) allows a remote unauthenticated attacker with HTTPS network access to read, create, delete, or modify all data accessible to the EFTLink service, despite a high attack-complexity barrier. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.4 (C:H/I:H, no availability impact); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full compromise of Oracle Cost Management (the Cost Maintenance component of Oracle E-Business Suite) is achievable over HTTP by a low-privileged, authenticated attacker, per Oracle's July 2026 Critical Patch Update. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact, though Oracle rates it difficult to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Remote takeover of Oracle Application Testing Suite 13.3.0.1 allows an unauthenticated attacker with TCP network access to fully compromise the product without any user interaction. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.

Full compromise (takeover) of the Oracle Public Sector Financials (International) module in Oracle E-Business Suite is possible via its Authorization component, affecting supported versions 12.2.3 through 12.2.15. A high-privileged attacker with network access over HTTP can, under difficult-to-exploit conditions, breach the module and, because of a scope change, significantly impact additional connected products. There is no public exploit identified at time of analysis and the issue is not on CISA KEV.

Complete compromise of Oracle Application Testing Suite version 13.3.0.1 is possible by remote, unauthenticated attackers over the Oracle Net protocol, per Oracle's July 2026 Critical Patch Update. Oracle rates this 'easily exploitable' with a CVSS 3.1 base score of 9.8, and a successful attack results in full takeover of the product with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patching target.

Complete takeover of Oracle Application Testing Suite 13.3.0.1 is possible by unauthenticated attackers over the network via TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was supplied.

Unauthenticated data disclosure in Oracle Application Testing Suite 13.3.0.1 lets a remote attacker with only TCP network access read critical application data, potentially gaining complete access to all data reachable by the product. The flaw is tagged as an authentication bypass and was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is confined to confidentiality - integrity and availability are unaffected per the CVSS vector.

Cross-job-group log disclosure in XXL-Job 2.4.2 lets an authenticated low-privilege user read execution log content belonging to job groups they have no rights to, by calling the logDetailCat endpoint with incremented sequential logId values. The flaw is an insecure direct object reference (IDOR): logDetailCat omits the authorization check that its sibling logDetailPage endpoint enforces, so any logged-in account can enumerate and harvest sensitive log output across the entire scheduler. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthenticated denial of service in Gitea's Locale middleware allows any remote attacker to consume ~2 seconds of server CPU per HTTP request by crafting a ~1 MiB Accept-Language header composed of underscore separators, bypassing the existing CVE-2022-32149 guard in golang.org/x/text which only counts dash characters. All Gitea releases from 1.22.x through 1.26.x are affected because the middleware at modules/web/middleware/locale.go:38 passes the raw, unfiltered header directly to the quadratic-time ParseAcceptLanguage parser; ten concurrent attackers consuming ~10 MiB/s of upstream bandwidth can saturate all cores of a ten-core host indefinitely. Publicly available exploit code exists in the GHSA advisory; no active exploitation has been confirmed by CISA KEV at time of analysis.

Authentication bypass in Autel MaxiCharger Single EV charging stations running firmware up to and including V1.03.51 lets remote, unauthenticated attackers invoke privileged management endpoints by supplying a hard-coded token baked into the firmware. Because the token is static and shared across devices, anyone who extracts it once (publicly available exploit code exists via CyberDanube) can control the charger's management functions on any unpatched unit. The CVSS 4.0 base score is 10.0, and the flaw affords full compromise of the device with no user interaction.

Repository visibility and template status in Gitea (self-hosted Git service) before 1.27.0 can be silently toggled by any repository owner or admin-collaborator through undocumented git push options (repo.private, repo.template) processed by the post-receive hook, bypassing all audit logging, webhooks, and notifications. An insider can flip a private repository to public long enough to clone proprietary code, then revert it, leaving only two ordinary push events in the activity feed. No CISA KEV listing and no separately published exploit tool exist, but the GHSA advisory ships full working reproduction commands, and the CVSS 3.1 base score is 7.1 (High).

Improper authorization in Gitea before 1.27.0 lets an administrator-deactivated user (IsActive=false) silently reactivate their own account by signing in through an OAuth2/OIDC source that issues no refresh token - notably GitHub, or any OIDC source without offline_access. The reactivation gate added in PR #38009 uses an empty stored refresh token as its signal for 'disabled by auto-sync cron,' but for these sources every user has an empty refresh token, so an administrator's deliberate deactivation is indistinguishable from a cron disable and gets undone on the next login, granting a full session (including regained admin rights, since deactivation does not clear IsAdmin). No public exploit code is packaged, but a detailed, reproducible proof-of-concept is published in the vendor advisory; not listed in CISA KEV.

Authentication bypass via hard-coded backdoor accounts in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets remote attackers gain administrative control of the web management interface. Two undocumented privileged accounts use a vendor-defined password derivation tied to device-specific values, so anyone who knows the algorithm and inputs can authenticate as admin without legitimate credentials. Publicly available exploit code exists (CyberDanube); no public evidence of active exploitation at time of analysis.

Cross-tenant IDOR (broken authorization) in Shelf (shelf.nu) asset-tracking platform before version 1.20.2 allows an authenticated user in one organization to read, update, or connect records belonging to a different organization by supplying entity IDs that are never validated against the caller's workspace. Because Shelf is multi-tenant with per-organization data isolation, this breaks the core tenant boundary; a low-privilege user in Org A who learns or guesses an ID from Org B can act on Org B's data, and a loader-only restriction on personal-workspace bookings is bypassable via a crafted POST. No public exploit identified at time of analysis and the issue is not on CISA KEV, but the flaw is straightforward to abuse once a foreign ID is known.

Missing authorization in FOG Project (fogproject) before 1.5.10.1832 and 1.6.0-beta.2313 lets a remote unauthenticated attacker invoke the clearAES and clearPMTasks methods of FOGPage through the public 'client' node endpoint using a single HTTP GET, wiping host AES imaging-encryption credentials and deleting all power-management scheduled tasks. No login, session, or CSRF token is required, so any attacker who can reach the FOG web server can degrade imaging integrity and disrupt scheduled operations. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the trivial GET-based trigger makes weaponization straightforward.

Broken authorization in Gitea (self-hosted Git server) versions before 1.27.0 lets a token scoped as public-only,write:repository push commits into a private pull-request head branch it should never touch. Because Gitea only evaluates the public-only restriction against the public base repository named in the route (POST /api/v1/repos/{owner}/{repo}/pulls/{index}/update) and never re-applies it to the private head repository, an attacker holding such a token can force a server-side write into the private repo and, where Actions is enabled, trigger its push workflow. This is CWE-863 incorrect authorization; a publicly available exploit code exists in the vendor advisory, EPSS is low at 0.24%, and it is not listed in CISA KEV.

Broken access control in Gitea's issue-dependency removal endpoint allows any authenticated user with issue-write access on one repository to delete cross-repository dependency links and inject attacker-authored comments into private repositories they have no read or write access to. All Gitea releases through v1.26.4 are affected; the sibling AddDependency function in the same source file performs the correct cross-repository permission check that RemoveDependency entirely omits. A working proof-of-concept curl command is published in the GitHub Security Advisory GHSA-xv9x-fj9g-vj6h, though no confirmed active exploitation (CISA KEV) has been identified and EPSS sits at 0.15% (4th percentile).

Broken authorization in MediaCMS 8.2.0 lets any authenticated user read private media metadata belonging to other users by injecting arbitrary media tokens into their own playlist. Because the playlist API skips ownership and state validation on PUT, an attacker who knows or guesses a target media token can then fetch their playlist and read otherwise-private fields (title, description, view/like counts, file size, author username, encoding status) via the unfiltered owner branch of the playlist detail view. No public exploit identified at time of analysis and the flaw is not in CISA KEV; a vendor patch is reported as available.

Privilege escalation in Gitea's self-hosted Git service (all versions ≤ 1.26.4) lets an attacker holding a narrowly-scoped Personal Access Token mint a new token with any scope, including full 'all' access, without the account password. The POST /users/{username}/tokens endpoint is guarded by reqBasicOrRevProxyAuth, which is meant to force password auth, but supplying the token as Authorization: Basic base64(<token>:x-oauth-basic) tricks the guard into setting IsBasicAuth=true, and the token-creation handler enforces no scope ceiling. A working proof-of-concept integration test is published in the advisory, though there is no public exploit identified in the wild and EPSS is low (0.16%).

Authorization bypass in Gitea before 1.27.0 lets a public-only Personal Access Token read internal content owned by Limited-visibility users and organizations, exceeding the reach the scope is meant to grant. The Repository and Package scope categories only test repo.IsPrivate / Owner.Visibility.IsPrivate(), which return false for VisibleTypeLimited, so an authenticated attacker with a public-only PAT can fetch READMEs, repo content, packages from all 24 registries, and even perform full git-upload-pack clones of instance-internal projects. A vendor-verified end-to-end Docker PoC exists (publicly available exploit code exists); it is not in CISA KEV and EPSS is low at 0.17% (6th percentile). This is the residual gap left after CVE-2026-25714 / PR #37118 fixed the sibling User/Org/ActivityPub cases.

Unauthorized information disclosure and case-attachment tampering in Elastic Kibana lets a low-privileged authenticated user with limited file-management permissions read, alter, or delete case attachments belonging to feature areas they should not reach, including sensitive Security Solution cases. The flaw stems from Kibana's file-access authorization check and its resource retrieval using two different resolution mechanisms, allowing the authorization gate to be bypassed. No public exploit identified at time of analysis; not listed in CISA KEV, and EPSS was not provided.

Branch protection bypass in Gitea versions prior to 1.27.0 allows a user with write (non-admin) access to merge unauthorized code into a protected branch by exploiting a stale approval flag. When a pull request is retargeted from an unprotected branch to a protected one via ChangeTargetBranch, Gitea fails to re-evaluate the stored official=true flag on existing approvals, so an approval that was never valid under the protected branch's whitelist still satisfies its required-approvals gate. Publicly available exploit code exists (a detailed step-by-step PoC in the GHSA advisory); no public exploit identified as actively used and it is not in CISA KEV.

Broken access control in HumHub 1.13.0 through 1.18.2 lets any authenticated user delete every member of any Space, regardless of whether they belong to or hold any role in that Space. The flaw is a missing authorization rule on the Space member-management controller's 'remove-all' action (CWE-862), fixed in 1.18.3. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial-to-trigger, authenticated-only nature makes it a realistic insider/low-privilege abuse risk.

Privilege escalation to root/code execution in SolarWinds Serv-U (managed/secure file transfer server) arises from a broken access control flaw that grants arbitrary file read and write on the host. An attacker already holding domain administrator access can abuse this to overwrite privileged files and run code as root, with reduced impact on Windows installations. Reported by SolarWinds with no public exploit identified at time of analysis, though the 9.1 CVSS reflects the high confidentiality, integrity, and availability impact once the precondition is met.

Privilege escalation in SolarWinds Serv-U file transfer server arises from an insecure direct object reference (IDOR) that lets an actor already holding domain administrator access reference and manipulate objects across an authorization boundary. The flaw is fixed in the Serv-U 2026-3 release and has no public exploit identified at time of analysis; SolarWinds itself reported it. Impact is reduced in Windows deployments, which tempers real-world severity despite the 9.1 CVSS score.

Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure direct object reference (IDOR) and elevate to a system administrator, ultimately executing commands as the root user on the underlying host. The flaw affects Serv-U file transfer server deployments, with a reduced impact on Windows installations, and carries a CVSS 9.1 rating driven by a scope change from application admin to OS-level root. There is no public exploit identified at time of analysis and no CISA KEV listing, but SolarWinds self-reported and shipped a fix in the Serv-U 2026-3 release.

Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other users' accounts through an insecure direct object reference (CWE-639), where user-controlled identifiers are not properly authorization-checked. Any valid low-effort authenticated session can be leveraged to reach objects belonging to other accounts, with the vendor noting reduced impact on Windows deployments (implying greater exposure on non-Windows/Linux installs). No public exploit has been identified at time of analysis; the issue was reported by SolarWinds and is fixed in the Serv-U 2026-3 release.

Account takeover in SolarWinds Serv-U is enabled by an insecure direct object reference (IDOR) that lets an authenticated user hijack the SMTP/email flow and seize arbitrary accounts, per SolarWinds' own advisory. Because the flaw crosses a trust boundary (CVSS scope-changed) with high confidentiality, integrity, and availability impact, a single privileged account can be leveraged against other users' accounts; Windows deployments are described by the vendor as lower-impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Privilege escalation in SolarWinds Serv-U lets an authenticated group member elevate their access to system administrator and execute code as root on Linux/Unix deployments, with reduced impact on Windows. The root cause is improper authorization (CWE-285) reachable over the network; the vendor rates it CVSS 9.1 due to a scope change and full CIA impact, but there is no public exploit identified at time of analysis and it is not in CISA KEV. Fixed in the Serv-U 2026-3 release.

Privilege escalation in SolarWinds Serv-U managed file transfer server allows an existing domain administrator to elevate their Serv-U account from a standard user type to a full system administrator, granting complete control over the file transfer service and its data. The flaw stems from missing authorization (CWE-862) and carries a CVSS 9.1 rating, driven by a scope change and high confidentiality, integrity, and availability impact. SolarWinds notes the impact is lower in Windows deployments, and there is no public exploit identified at time of analysis.

Privilege escalation in SolarWinds Serv-U managed file transfer allows a user holding domain administrator privileges to create Serv-U system administrator accounts, crossing an authorization boundary the product is expected to enforce independently. Tracked as CVE-2026-28309 (CWE-862, Missing Authorization) and reported by SolarWinds, it carries a 9.1 CVSS due to scope change and full C/I/A impact, though the vendor notes the impact is lower in Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct object reference that lets an authenticated domain administrator reference objects outside their intended authorization boundary to run code on the host. The flaw carries a 9.1 CVSS due to network reach, scope change, and full confidentiality/integrity/availability impact, though the practical bar is high because domain administrator access is a prerequisite, and impact is reduced on Windows deployments. No public exploit is identified at time of analysis and it is not listed in CISA KEV.