Authentication Bypass

Unauthenticated attackers with network reach to Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can potentially achieve full takeover of the platform through the BI Foundation component over HTTP, with high impact across confidentiality, integrity and availability (CVSS 3.1 base 8.1). The high attack complexity reflects Oracle's own 'difficult to exploit' classification, meaning success hinges on timing, state or environmental preconditions outside the attacker's direct control rather than a single reliable request. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so practical risk is gated primarily by whether the BI HTTP interface is exposed to untrusted networks.

Oracle BI EE 8.2.0.0.0 and 12.2.1.4.0 can be taken over through a low-complexity Platform Security flaw that an unauthenticated attacker triggers after obtaining interactive logon access to the host and persuading another user to perform an action. The local attack path (AV:L) and user-interaction requirement (UI:R) keep it from being remotely wormable against default internet-facing deployments, despite high confidentiality, integrity, and availability impact and a 7.8 CVSS score. No public exploit was identified at time of analysis, and CISA KEV does not list this CVE.

Unauthenticated HTTP requests to Oracle WebCenter Sites can disclose critical content and site data in versions 12.2.1.4.0 and 14.1.2.0.0 because of an authentication bypass, rated CVSS 7.5 with confidentiality-only impact. Exploitation requires only network reachability to the WebCenter Sites interface - no credentials or user interaction - but the flaw does not permit data modification or service disruption. No public exploit code and no CISA KEV entry were identified at time of analysis.

Authenticated low-privilege users can achieve takeover of Oracle Business Intelligence Enterprise Edition through its BI Search component, with high confidentiality, integrity, and availability impact. Affected deployments include versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0; exploitation requires network access over HTTP and a valid low-privileged account but no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, though low attack complexity makes prompt patching important.

Unauthenticated HTTP requests to the Analytics Web General component of Oracle Business Intelligence Enterprise Edition can drive the service into a hang or repeatable crash, giving a complete denial of service while also permitting limited reads and limited inserts/updates/deletes against a subset of BI EE data. The flaw is rated CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) and affects releases 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0; Oracle characterizes it as easily exploitable by a remote attacker with network access and no credentials. There is no CISA KEV listing and no public exploit identified at time of analysis, so prioritization should be driven by internet or broad-network exposure of the analytics web tier rather than by observed attack activity.

Authenticated low-privileged attackers can take over Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP, with high confidentiality, integrity, and availability impact. The flaw is network-reachable, requires no user interaction, and has low attack complexity, but it is not unauthenticated: an attacker must already hold a valid low-privileged account on the EBS instance. No public exploit was identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; the main barrier to mass exploitation is the authentication prerequisite.

Oracle ZFS Storage Appliance Kit 8.8 can be taken over by a low-privileged, authenticated attacker who can reach the appliance's HTTP management interface, with full confidentiality, integrity, and availability impact. Exploitation is network-reachable, low complexity, and requires no user interaction, but valid low-privilege credentials are required; no public exploit was identified at time of analysis. The authentication prerequisite and the appliance's typical placement on internal management networks are the main practical constraints.

Authenticated low-privileged attackers can achieve full takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 by sending crafted HTTP requests to the Product Quality Management component. The flaw is network-exploitable, requires no user interaction, and yields complete compromise of confidentiality, integrity, and availability (CVSS 8.8). No public exploit code has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.

Authenticated low-privileged users can take over Oracle Agile Product Lifecycle Management for Process 6.2.4 through the Product Quality Management component, achieving full confidentiality, integrity, and availability compromise (CVSS 8.8). Oracle describes the flaw as easily exploitable and requiring no user interaction, so a valid low-tier account or compromised low-privileged credentials is the main prerequisite. No public exploit code or confirmed active exploitation was identified at time of analysis.

Adjacent-network attackers can achieve takeover of Oracle Management Pack for Oracle GoldenGate (EM Plugin) versions 13.4.1.0.1 through 13.5.2.0.6, with high confidentiality, integrity, and availability impact, provided they can reach the communication segment attached to the host and a legitimate operator performs a required interaction. No authentication is required and attack complexity is low, but the AV:A and UI:R requirements sharply limit exposure compared with an internet-reachable flaw. The supplied intelligence contains no public exploit code and no CISA KEV entry, so there is no public exploit identified at time of analysis.

Full application takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible through its Product Quality Management component, with high confidentiality, integrity, and availability impact. The attack path requires network access to the HTTP interface and valid low-privileged credentials, and Oracle rates exploitation as difficult (AC:H), so risk is concentrated in exposed, access-controlled deployments where an attacker already has a foothold. No public exploit was identified at time of analysis; this is a genuine but second-tier priority rather than an emergency patch item.

Oracle Agile Product Lifecycle Management for Process 6.2.4 can be taken over through its Product Quality Management component by an attacker holding high-privilege credentials and network HTTP access. The CVSS 7.2 rating reflects high confidentiality, integrity, and availability impact, but the PR:H prerequisite confines practical exposure to malicious insiders or attackers who have already compromised a privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update.

Unauthorized read of critical Oracle Purchasing data, plus limited insert/update/delete capability, is achievable by a low-privileged authenticated user of Oracle E-Business Suite 12.2.3 through 12.2.15 who can reach the Internal Operations component over HTTP and satisfy non-trivial preconditions (high attack complexity). Scope is changed, so a successful attack can ripple into other Oracle products sharing the EBS deployment rather than staying confined to Purchasing. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, which keeps it a moderate-priority patching item worked through the normal Critical Patch Update cycle rather than an emergency.

Compromise of Oracle EBS Workflow 12.2.3 through 12.2.15 is possible for unauthenticated network attackers via HTTP, with successful exploitation yielding high confidentiality, integrity, and availability impact and takeover of the Workflow component. The flaw is rated CVSS 8.1 but is difficult to exploit (AC:H), meaning success depends on a server condition or timing window the attacker cannot fully control. No public exploit code or CISA KEV active-exploitation signal is present at time of analysis, so exposure is primarily a function of whether Workflow Notification Mailer HTTP endpoints are reachable from untrusted networks.

Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible for authenticated low-privileged attackers with network access via HTTP, according to Oracle's October 2026 Critical Patch Update. The Content Portal Suite component flaw is rated CVSS 7.5 with high attack complexity and no user interaction, giving high confidentiality, integrity, and availability impact; it is serious but not top-tier urgent. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.

Oracle Database Server in versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 lets an authenticated low-privileged user who holds the Create Table privilege subvert the Virtual Private Database (VPD) row-level security feature over Oracle Net, gaining unauthorized read, creation, modification, and deletion access to data those VPD policies are supposed to protect. Successful exploitation yields high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no user interaction required; the attacker must already have a valid database account and network reachability to the database listener. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the source data, so the practical risk is concentrated in environments where low-privilege accounts are routinely granted Create Table.

Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contains a Core component flaw that unauthenticated network attackers can reach through the TLS listener, allowing limited read, update/insert/delete, and partial denial-of-service impact (CVSS 7.3). Oracle describes the issue as easily exploitable with no user interaction; exposure is greatest for internet-facing or broadly reachable WebLogic instances, while segmented admin/TLS interfaces materially reduce risk. No public exploit identified at time of analysis.

Authenticated low-privileged users can take over Oracle E-Business Suite Workflow (versions 12.2.3 through 12.2.15) by attacking the Workflow Notification Mailer component over HTTP, with high impact across confidentiality, integrity, and availability (CVSS 3.1 base score 7.5). Oracle rates the flaw difficult to exploit, and the CVSS vector's high attack complexity (AC:H) indicates a specific server state or precondition must be met rather than a simple request being sufficient, although no user interaction is required. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Oracle addresses the issue in its October 2026 Critical Patch Update. This is a moderate-priority item for EBS estates that expose the notification mailer, not an emergency unauthenticated remote compromise.

Remote, unauthenticated takeover of Oracle WebCenter Content is possible through the Content Server component over HTTP, with CVSS 3.1 score 9.8 affecting versions 12.2.1.4.0 and 14.1.2.0.0. The attack requires only network reachability to the Content Server endpoint and no credentials or user interaction, yielding high confidentiality, integrity and availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, but the exposure is serious for internet-facing instances and should be prioritized.

Unauthenticated network attackers can potentially read and modify critical data handled by Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 through the LDAP Gateway component, with no user interaction required. Oracle rates the flaw as 'difficult to exploit' (CVSS 7.4, AC:H), meaning the attacker must satisfy preconditions outside their direct control before a reliable attack is possible; confidentiality and integrity of all connector-accessible data are both fully impacted, while availability is unaffected. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a genuine but second-tier priority that should be remediated in the normal Critical Patch Update cycle.

Unauthenticated LDAP requests to the LDAP Gateway in Oracle IDM Connector 12.2.1.4.0 and 14.1.2.1.0 can expose critical connector-accessible data, giving remote attackers a confidentiality-only read primitive rated CVSS 7.5. The flaw is network-reachable and requires no credentials or user interaction, but exploitation depends on the gateway being deployed and accessible over LDAP. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is bounded by network exposure rather than by confirmed active exploitation.

Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0, specifically the SAP ERP+ component, exposes an unauthenticated HTTP attack surface that can lead to authentication bypass and unauthorized creation, deletion, modification, or access of critical connector data, with scope change potentially affecting connected systems. The issue is serious but constrained: exploitation is difficult (AC:H) and requires reachable HTTP access to a deployment that actually uses the SAP ERP+ connector. No public exploit identified at time of analysis, and no CISA KEV confirmation was supplied.

Unauthenticated network access to the LDAP Gateway in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can result in full compromise of the connector, with high confidentiality, integrity, and availability impact (CVSS 9.8). The vector is AV:N/AC:L/PR:N/UI:N, so reachability of the LDAP service is the main prerequisite; deployments that expose it only to trusted networks materially reduce exposure. No CISA KEV status is supplied and no public exploit identified at time of analysis, but the severity and ease of exploitation warrant urgent patching or network restriction.

Unauthenticated network attackers can read and modify critical data through the LDAP Gateway component of Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0, which permits LDAP operations without enforcing authentication. With a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H), exploitation requires only reachability to the exposed LDAP listener and no user interaction. Oracle's October 2026 Critical Patch Update references the fix; no public exploit code or confirmed active exploitation was identified at time of analysis, so risk is concentrated in environments where the LDAP Gateway is network-accessible.

Oracle Identity Manager Connector (LDAP Gateway component) in versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged user who already has interactive logon to the connector host to read, create, delete, or modify all data reachable through the LDAP Gateway, per Oracle's October 2026 Critical Patch Update. The 7.1 score reflects high confidentiality and integrity impact with no availability impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), so exploitation is straightforward but strictly gated behind existing local access and low-level privileges, making this a bounded insider or post-compromise risk rather than a remote threat. No public exploit code and no confirmed active exploitation were identified at time of analysis.

Oracle IDM Connector 12.2.1.4.0 and 14.1.2.1.0 contains a locally exploitable flaw in its Generic REST component that lets an attacker with an existing low-privileged logon on the connector host read, create, delete, or modify critical connector-accessible data (CVSS 3.1 base 7.1; C:H/I:H). The vector is AV:L/PR:L/UI:N, so exploitation is not remote or unauthenticated; the 'Authentication Bypass' tag is inconsistent with the PR:L requirement and should be verified against Oracle's advisory. No public exploit code or CISA KEV entry was identified at time of analysis.

Java sandbox boundary flaw in Oracle Java SE 8u503 and 8u503-perf client deployments can let a low-privileged local attacker obtain high confidentiality and integrity impact, with scope change to additional products, but only in legacy sandboxed Java Web Start or applet scenarios that execute untrusted code. The 7.5 HIGH score is tempered by the local attack vector, high attack complexity, and required low-privileged logon; server deployments running only trusted administrator-installed code are explicitly out of scope. No public exploit identified at time of analysis, and exploitation is not confirmed in CISA KEV.

Authenticated low-privilege users of Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 can achieve full takeover of the Strategic Sourcing component over HTTP, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). Exploitation requires only network reachability to the application tier and a valid low-privilege PeopleSoft account - no user interaction and no elevated privileges - so any provisioned user who can reach the Strategic Sourcing interface could attempt it. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vulnerability is addressed in Oracle's October 2026 Critical Patch Update advisory, and risk is concentrated in internet-exposed or broadly provisioned instances.

Unauthenticated data disclosure in PeopleSoft FIN Common Objects Argentina 9.1 allows network attackers using Oracle Net to read critical or complete application data. The Integration component flaw requires only network reachability to the Oracle Net endpoint, with no credentials or user interaction, and its impact is limited to confidentiality. No public exploit code or CISA KEV entry was identified at time of analysis, and exposure is sharply reduced where Oracle Net is restricted to trusted internal segments.

Unauthenticated, remote attackers can read and modify critical data in the Server Infrastructure component of Oracle Siebel CRM Deployment across supported versions 17.0 through 26.9, with a CVSS 3.1 base score of 7.4 (High) driven entirely by high confidentiality and integrity impact. Oracle rates the flaw as 'difficult to exploit' (AC:H), meaning success depends on conditions outside the attacker's control - server state, timing, or an unspecified precondition - which tempers the headline score and argues for a lower real-world priority than the 7.4 suggests; no public exploit code and no KEV listing were identified at time of analysis. Authentication and user interaction are not required (PR:N, UI:N), and the advisory metadata tags the issue as an authentication bypass, so exposure should be scoped by network reachability to the deployment server rather than by credential controls. The fix is delivered through Oracle's October 2026 Critical Patch Update.

Unauthenticated remote attackers who can reach the Siebel HTTP interface can read, create, delete, or modify critical data held in Oracle Siebel CRM Deployment versions 17.0 through 26.9, although Oracle rates the issue as difficult to exploit (AC:H), meaning successful abuse depends on conditions outside the attacker's direct control such as specific server configuration, state, or timing rather than a single deterministic request against a default install. Confidentiality and integrity of Deployment-accessible data are both fully compromised, while availability is unaffected and no scope change to other systems occurs. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a genuine but second-tier priority to be scheduled alongside the October 2026 Oracle Critical Patch Update rather than treated as an emergency.

Unauthenticated remote attackers can read critical data from Oracle Siebel CRM Deployment (Server Infrastructure component) in supported versions 17.0 through 26.9 via HTTP, with low attack complexity and no user interaction, yielding a CVSS 3.1 score of 7.5 (High) and confidentiality-only impact. No public exploit identified at time of analysis, and no CISA KEV active exploitation is reported. Remediate by applying Oracle's October 2026 Critical Patch Update referenced in the vendor advisory.

Unauthenticated remote attackers can read critical data from Oracle Siebel CRM Deployment (Server Infrastructure component) in supported versions 17.0 through 26.9 by sending HTTP requests, due to an authentication bypass flaw (CVSS 3.1 base score 7.5). The vulnerability is network-reachable with low complexity and no user interaction, but impacts only confidentiality (C:H/I:N/A:N), so it enables data disclosure rather than data modification, denial of service, or code execution. No public exploit code or active exploitation (CISA KEV) was identified at time of analysis; exposure is limited to deployments whose Siebel HTTP endpoint is reachable from the attacker's network position.

Unauthenticated network attackers can access critical data and perform limited data modification in Oracle Siebel CRM End User versions 17.0 through 26.9 via the Communications Panel/Dashboard component. The vulnerability is easily exploitable (CVSS 8.2, AV:N/AC:L/PR:N/UI:N) and requires only HTTP reachability to the Siebel web tier. No public exploit code or active exploitation has been identified at time of analysis, but internet- or intranet-exposed deployments should prioritize patching.

Authenticated low-privileged users can achieve takeover of Oracle Siebel CRM Deployment (Server Infrastructure) in versions 17.0 through 26.9 through the HTTP interface, with high impact to confidentiality, integrity, and availability (CVSS 8.8). The requirement for a valid low-tier CRM session is the main barrier, but no user interaction or special attack complexity is indicated; no public exploit was identified at time of analysis.

Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 allow a low-privileged authenticated user with HTTP network access to read critical data and partially modify records they should not be able to touch, yielding a CVSS 3.1 score of 7.1 (C:H/I:L/A:N). The weakness is an authorization/access-control failure rather than an authentication bypass, so exploitation requires the attacker to already hold a valid low-privileged account; no user interaction is needed and attack complexity is low. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, so exposure is bounded by the number of provisioned accounts and whether the Siebel HTTP interface is reachable from untrusted networks.

High-privileged attackers who can reach Oracle Siebel CRM's Deployment Server Infrastructure over HTTP can create, delete, or modify critical data and read all data accessible through that component, with the scope change (S:C) meaning successful exploitation can also affect other connected Oracle products beyond Siebel CRM. Supported releases 17.0 through 26.9 are affected; Oracle rates the flaw CVSS 3.1 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), with confidentiality and integrity fully compromised but no availability impact. The pre-existing administrative privilege requirement (PR:H) is the principal limiting factor, making malicious insiders or already-compromised admin accounts the realistic threat actors; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.

Oracle Siebel CRM Field Service (Smart Answer) versions 17.0 through 26.9 can be fully taken over by an authenticated, high-privileged attacker with HTTP access, with high confidentiality, integrity, and availability impact (CVSS 7.2). The vector requires existing high privileges (PR:H) and low complexity with no user interaction, so real-world exposure is concentrated in insider or post-compromise escalation scenarios rather than unauthenticated attacks. No CISA KEV confirmation and no public exploit identified at time of analysis.

Remote, unauthenticated takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 is possible when attackers can reach the T3 or IIOP listener used by the End User Self Service component. Oracle rates this 9.8 with no credentials, no user interaction, and no non-default configuration required, so default deployments are exposed if those protocols are network-reachable. No public exploit was identified at time of analysis, but risk is highest where T3/IIOP are internet-facing or broadly reachable from untrusted segments.

Privilege escalation through the REST WebServices component of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged authenticated attacker with HTTP network access to take over the OIM deployment, with high confidentiality, integrity and availability impact (CVSS 8.8). Exploitation requires a valid low-privilege account on the target instance (PR:L) but no user interaction and only low attack complexity, so exposure hinges on whether the REST interface is reachable by untrusted networks. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied with the source data.

Unauthenticated network attackers can read critical data from Oracle Siebel CRM Integration's Open Integration component in versions 25.12 through 26.9 over HTTP, with CVSS 3.1 base score 7.5 reflecting high confidentiality impact and no integrity or availability impact. Exploitation requires only that the integration HTTP endpoint be reachable, since the assessed vector is PR:N/UI:N with low attack complexity. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.

Oracle BPM Suite 12.2.1.4.0 and 14.1.2.0.0 expose the Case Management Service (11g+) to unauthenticated, low-complexity HTTP attacks that can read critical data and make limited unauthorized changes. Oracle rates the issue 8.2 (High) with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, meaning no credentials or user interaction are required against a reachable instance. No public exploit was identified at time of analysis, so exposure is primarily a function of whether the BPM Suite HTTP interface is reachable from untrusted networks.

Oracle Outside In Technology 8.5.8 contains a high-severity flaw in the Outside In Clean Content SDK that becomes exploitable when the SDK is embedded in an HTTP-facing service accepting attacker-supplied files for parsing or conversion. A low-privileged authenticated network attacker can exploit it without user interaction to achieve high confidentiality, integrity, and availability impact, with scope change extending the impact to the host product. No public exploit code or CISA KEV entry was identified at time of analysis.

Oracle Outside In Technology 8.5.8 can expose sensitive data to unauthenticated remote attackers when a host application embedding the Outside In Clean Content SDK parses an attacker-supplied document, producing high confidentiality impact and a scope change into the hosting product. The vendor CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), and no public exploit code or CISA KEV entry was identified at time of analysis.

Authenticated low-privileged attackers with HTTP access can exploit Oracle iSupport in E-Business Suite 12.2.3 through 12.2.15 to create, delete, or modify critical Service Request data and cause partial denial of service, with scope change potentially affecting other EBS products. The flaw is easily exploitable (CVSS 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L), and because iSupport is a customer-facing self-service portal, the required credentials may be broadly available. No public exploit was identified at the time of analysis.

Crafted-document processing in Oracle Outside In Technology 8.5.8 can let a remote unauthenticated attacker access or alter sensitive data when a victim opens or processes a malicious file in an application that embeds the Outside In Clean Content SDK. The CVSS 8.2 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, so HTTP delivery needs no credentials but exploitation depends on victim-side parsing, and the scope change means the real impact tracks the privileges of the host product. No public exploit was identified at time of analysis, and no KEV entry is indicated.

Oracle Outside In Clean Content SDK 8.5.8, as embedded in Oracle Fusion Middleware and integrating products, can be made to create, modify, or delete critical data by unauthenticated remote attackers who can supply documents over HTTP to an application that parses them with the SDK. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) indicates no authentication or user interaction, with scope change extending impact to the integrating product, although confidentiality and availability are unaffected. No public exploit identified at time of analysis, and no CISA KEV listing is provided.

Oracle Outside In Technology 8.5.8, specifically the Outside In Clean Content SDK, can be compromised by a crafted document delivered over HTTP, enabling an unauthenticated remote attacker to create, delete, or modify critical data and read a limited subset of accessible data when a victim opens, uploads, or triggers conversion of the malicious file. The scope-change rating means exploitation can affect host applications and other products that embed the SDK, not just Outside In itself, although mandatory user interaction prevents unattended mass exploitation. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a credible mid-to-high priority issue rather than an emergency.

Unauthenticated network attackers can corrupt or destroy data and trigger a hang or repeated crash in Oracle Outside In Technology 8.5.8 through the Outside In Clean Content SDK when an embedding application parses attacker-supplied documents. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), with high integrity and availability impact but no confidentiality impact; no public exploit code was identified at time of analysis. Real-world exposure depends on whether a product embedding the SDK accepts untrusted files for ingestion, conversion, indexing, or preview.

Low-privileged authenticated remote attackers can achieve full takeover of applications that embed Oracle Outside In Clean Content SDK 8.5.8 by sending crafted content over HTTP, with high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw affects Oracle Fusion Middleware's Outside In Technology component, and real exposure depends on whether an integrating product accepts attacker-supplied files and passes them to the SDK. All available intelligence is vendor-sourced from Oracle's October 2026 Critical Patch Update; no public exploit code or confirmed active exploitation was identified at time of analysis.

Improper authorization in Oracle E-Business Suite iSupport (12.2.3 through 12.2.15) allows a low-privileged, authenticated user with HTTP network access to create, delete, or modify critical iSupport data and to read a limited subset of that data, yielding a CVSS 3.1 base score of 7.1 (C:L/I:H/A:N). Exploitation is considered easy (AC:L, UI:N) but is not pre-authentication: the attacker must already hold a valid low-privilege account, such as a registered self-service/customer user, despite the 'Authentication Bypass' tagging seen in intelligence feeds. No public exploit code or CISA KEV listing was identified at time of analysis, so this is a mid-to-high priority patching item rather than an emergency.

Unauthenticated network attackers can create, delete, modify, or read critical data in Oracle E-Business Suite iProcurement versions 12.2.3 through 12.2.15 by reaching the Internal Operations component over HTTPS. Oracle rates the issue difficult to exploit because of high attack complexity, meaning successful exploitation likely requires a specific server-side condition rather than a single deterministic request. No public exploit code or confirmed active exploitation was identified at time of analysis.

Unauthenticated attackers positioned on the same physical network segment as a JD Edwards EnterpriseOne Tools host can potentially achieve full takeover of the product (confidentiality, integrity and availability all High) by exploiting a flaw in the Installation Security component of supported releases 9.2.0.0 through 9.2.26.5. The vendor-supplied CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N) means exploitation is not possible from the internet and is further gated by high attack complexity, so real-world priority is materially lower than the 7.5 base score suggests. No public exploit code, CISA KEV entry, or EPSS score was present in the available intelligence at time of analysis, and Oracle addresses the issue through its October 2026 Critical Patch Update advisory.

Adjacent-network attackers can exploit an installation-security weakness in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.4 to take over the product, provided a person other than the attacker performs a required interaction; no authentication is needed and the scope change means connected products may also be affected. The CVSS 3.1 score is 8.8, but exploitation is constrained by the AV:A adjacency requirement and UI:R human interaction. No public exploit identified at time of analysis and no CISA KEV entry is present in the available data.

Unauthenticated information disclosure in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 allows a network attacker to read critical data through the Installation Security component, with a CVSS 3.1 base score of 7.5. The flaw is low complexity and requires no credentials or user interaction, but impact is limited to confidentiality, with no integrity or availability effect. No public exploit was identified at time of analysis, and practical risk is concentrated on instances reachable over HTTP from an attacker's network position because JD Edwards EnterpriseOne is typically an internally deployed ERP.

Unauthenticated remote takeover of Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 is possible through the Core component, with a CVSS 9.8 vector requiring only HTTP network access and no credentials or user interaction. Successful exploitation yields high confidentiality, integrity, and availability impact, effectively handing the attacker control of the server. No public exploit identified at time of analysis, and no EPSS score was provided; Oracle's October 2026 Critical Patch Update advisory is the authoritative remediation source.

Low-privileged authenticated attackers can achieve full takeover of the Oracle iProcurement application (E-Business Suite 12.2.3 through 12.2.15) by reaching the Requisition Management component over HTTP, with high impact to confidentiality, integrity, and availability. The flaw is rated high complexity (AC:H) - Oracle describes it as 'difficult to exploit', meaning success depends on conditions such as specific configuration, timing, or data state rather than a single deterministic request - and requires a valid low-privileged session, so anonymous users cannot trigger it. No public exploit code has been identified and there is no CISA KEV listing at time of analysis, but because a compromised account yields application-level takeover, any provisioned iProcurement user should be treated as a potential launch point.

Oracle iProcurement's E-Content Manager Catalog component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes a high-privilege attack path: an authenticated attacker who already holds an elevated account can use HTTPS network access to take over the iProcurement application, with high confidentiality, integrity, and availability impact. CVSS 3.1 scores this 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting reliable exploitation once privileged credentials are obtained, with no user interaction required. No public exploit code or CISA KEV entry was identified in the provided intelligence, so the practical threat is a malicious or compromised privileged insider rather than an anonymous remote attacker.

Full compromise of JD Edwards EnterpriseOne Tools can be achieved by an attacker who can log on locally to the host running the Tools installation, provided a separate user or administrator performs a required action. This affects Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 and is scored CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis, and no CISA KEV entry was supplied; the local-access plus human-interaction prerequisites substantially narrow practical risk compared with a network-reachable flaw.

Takeover of JD Edwards EnterpriseOne Tools (Installation Security component, supported versions 9.2.0.0 through 9.2.26.5) is achievable by an attacker who already holds a logon on the host where the tooling executes, provided a second person - an operator or administrator - is tricked into a user-interaction step such as opening or processing attacker-supplied content. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but the combination of a local attack vector plus a mandatory human victim makes this a high-severity rather than high-urgency issue at this moment. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied with the source data.

Unauthenticated network attackers can achieve takeover of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.4 by exploiting a high-complexity flaw in the Installation Security component exposed over HTTP. Oracle rates the issue 8.1 with full confidentiality, integrity, and availability impact, but characterizes exploitation as difficult because additional conditions beyond the attacker's control must be met; no public exploit identified at time of analysis, and no CISA KEV entry was provided. Exposure is greatest where the Tools HTTP interface is broadly reachable.

An authenticated, low-privileged attacker with network access to the JDENET service can fully compromise JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5, gaining high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The defect sits in the Installation SEC component, and successful exploitation is described by Oracle as enabling takeover of the EnterpriseOne Tools instance. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low attack complexity and the fact that JDENET is frequently reachable across enterprise networks make this a credible operational priority rather than an inflated high-CVSS score.

Unauthenticated network attackers can read critical data from Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 via the Oracle Net communication layer (CVE-2026-91308), which Oracle rates as easily exploitable and assigns CVSS 3.1 7.5 HIGH. The flaw is a confidentiality-only authentication bypass in the Installation Security component: PR:N/UI:N with C:H, while integrity and availability are unaffected. No CISA KEV entry or public exploit code was identified in the supplied intelligence at time of analysis, so risk is highest where the Oracle Net listener is reachable from untrusted networks.

Unauthenticated network attackers can access critical data in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 by exploiting an Installation Security flaw reachable over Oracle Net. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) describes a low-complexity confidentiality-only issue with no integrity or availability impact. No public exploit code was identified at time of analysis, and the primary exposure constraint is whether Oracle Net/listener access is reachable from untrusted networks.

Unauthenticated attackers with HTTPS reachability to the Installation Security component in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can read and modify critical EnterpriseOne Tools data; availability is not impacted. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N), and Oracle's October 2026 Critical Patch Update is the cited advisory. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is highest for internet-exposed instances.

Local attackers who already hold logon access to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can achieve full takeover of the application through its Installation Security component, provided a legitimate operator is induced to perform an interactive step such as running an installer or configuration action. The 7.8 High CVSS 3.1 score (AV:L/AC:L/PR:N/UI:R) reflects high confidentiality, integrity and availability impact with no application-level credentials required, but the local-access and victim-interaction prerequisites confine realistic exploitation to insider or post-foothold scenarios rather than remote mass exploitation. No public exploit code and no CISA KEV entry were identified at time of analysis, so this sits well below network-facing criticals in prioritization.

Oracle JD Edwards EnterpriseOne Tools (Installation Security component) versions 9.2.0.0 through 9.2.26.5 can be taken over by a remote, unauthenticated attacker who convinces another user to interact with attacker-supplied content delivered over HTTP, yielding high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). The mandatory victim interaction (UI:R) means delivery depends on social engineering rather than a direct server-side hit, which limits automated mass exploitation. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible high-priority item rather than a drop-everything emergency; the fix ships in Oracle's October 2026 Critical Patch Update.

Unauthenticated remote takeover of JD Edwards EnterpriseOne Orchestrator affects versions 9.2.0.0 through 9.2.26.5, where a network attacker can compromise the E1 IOT Orchestrator Security component over HTTP without credentials or user interaction. The CVSS 3.1 score is 10.0 with scope change, meaning a successful attack can extend beyond the Orchestrator into additional connected EnterpriseOne products. No public exploit code or CISA KEV entry is identified at time of analysis, but the maximum severity, unauthenticated network vector, and broad version range make this a top remediation priority for exposed deployments.

JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 contain a takeover-class vulnerability in the Enterprise Infrastructure SEC component that a low-privileged, network-positioned attacker can exploit over HTTP with no user interaction, yielding full confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8). Oracle's CPU October 2026 advisory frames it as easily exploitable, but the PR:L vector means valid low-privilege credentials are a prerequisite, so exposure is concentrated among insiders or attackers who already hold a foothold or stolen account. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied; an attacker who clears the authentication bar can compromise the JD Edwards EnterpriseOne Tools deployment itself.

JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 exposes an Interoperability SEC weakness over JDENET that can let unauthenticated network attackers read and alter critical application data. Oracle describes exploitation as difficult, with high attack complexity as the main barrier, and no public exploit identified at time of analysis or confirmed active exploitation (CISA KEV). Availability is not affected, but confidentiality and integrity impacts are high.

Unauthenticated attackers positioned on the same network segment as an Oracle JD Edwards EnterpriseOne Tools host can read and tamper with protected data through the Enterprise Infrastructure SEC component in supported releases 9.2.0.0 through 9.2.26.5. The flaw scores CVSS 3.1 base 8.1 (AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:N): once an attacker has layer-2 adjacency to the EnterpriseOne hardware, no credentials, user interaction, or special conditions are required, and the result is full loss of confidentiality and integrity of EnterpriseOne-accessible data with no availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven less by exploit maturity than by whether an organization exposes its EnterpriseOne host segment to untrusted or flat internal networks.

Compromise of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 allows unauthenticated attackers on the adjacent network segment to read critical data and make limited unauthorized modifications through the Monitoring and Diagnostics SEC component. The CVSS 8.2 severity reflects no credentials or user interaction and a scope change that can affect connected products, but exploitation requires Layer 2 adjacency rather than public-network reachability; no public exploit identified at time of analysis.

Unauthenticated remote attackers can read critical data from Oracle JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 through the component tracked as Object and Env Tech SEC, with the flaw classified as an authentication bypass affecting the HTTP-facing web tier. The CVSS 3.1 score of 8.6 reflects a network-reachable, low-complexity, no-privileges, no-user-interaction attack that is confidentiality-only but carries a scope change, so downstream systems trusting the Tools layer may also be exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, but the exposure-based risk is high where the JD Edwards HTTP interface is internet-facing or reachable from untrusted segments.

Oracle JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 expose an unauthenticated, network-reachable weakness in the Interoperability 'SEC' component that can let a remote attacker read, create, delete, or modify critical data over HTTPS, with no user interaction required and no availability impact. Oracle characterizes the flaw as 'difficult to exploit' (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning success depends on conditions outside the attacker's full control rather than a single deterministic request. No public exploit code has been identified at time of analysis, and the issue is addressed through the Oracle Critical Patch Update referenced in the advisory (October 2026).

Authentication bypass in Oracle JD Edwards EnterpriseOne Tools (Monitoring and Diagnostics SEC) lets a low-privileged attacker with network access over HTTP read and modify critical application data in versions 9.2.0.0 through 9.2.26.5. Exploitation requires a valid low-privileged account (PR:L), no user interaction, and low attack complexity, with high confidentiality and integrity impact but no availability impact. The provided intelligence identifies no public exploit code and no confirmed active exploitation; internet-exposed EnterpriseOne web tiers are the highest-risk deployments.

Low-privileged authenticated users can achieve full takeover of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) by sending crafted HTTP requests to the Monitoring and Diagnostics SEC component, gaining high impact across confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). No user interaction or elevated privileges are required - only a valid low-tier account and network reachability to the EnterpriseOne Tools HTTP interface - making any compromised or over-provisioned service account a viable launch point. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the low attack complexity and the pre-authentication-free path from a standard account to full compromise warrant prompt patching.

JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) allows a low-privileged authenticated attacker with HTTP network access to read and modify critical data through a flaw in the Enterprise Infrastructure SEC component, according to Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), with high confidentiality and integrity impact and no availability impact. No public exploit code or active exploitation has been identified at time of analysis, though the "Authentication Bypass" tag conflicts with the PR:L vector and should be confirmed with Oracle.

Authenticated low-privileged users with HTTP reachability to the JD Edwards EnterpriseOne Tools web tier can take full control of the Web Runtime SEC component in versions 9.2.0.0 through 9.2.26.5, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The barrier to entry is low: any valid non-administrative EnterpriseOne account plus network access to the HTML/web runtime is sufficient, with no user interaction and no non-default configuration precondition cited by Oracle. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but EPSS scoring was not available in the supplied intelligence, so prevalence-weighted risk should be treated as unquantified rather than low.

Unauthenticated SOAP requests to the JD Edwards EnterpriseOne Tools Interoperability SEC component can expose critical data in versions 9.2.0.0 through 9.2.26.5, with a scope change that may extend impact to connected products. The CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), and only confidentiality is affected; no public exploit identified at time of analysis. Risk is highest where the SOAP Interoperability service is deployed and reachable from untrusted networks.

Low-privileged local users with logon access to a JD Edwards EnterpriseOne Tools host can bypass authentication in the Monitoring and Diagnostics (SEC) component and gain read/write control over critical data. Affected releases are Tools 9.2.0.0 through 9.2.26.5; exploitation requires an existing interactive account on the server (CVSS vector AV:L/PR:L), so the realistic threat is insider abuse or an attacker operating after an initial foothold, not a remote mass-exploitation campaign. Impact is rated CVSS 8.4 because a scope change (S:C) lets the compromise spill into connected products and the underlying ERP data, though no public exploit code and no confirmed active exploitation were identified at time of analysis.

Unauthenticated HTTP access to JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can allow a remote attacker to read and alter critical application data, with CVSS 9.1 reflecting high confidentiality and integrity impact but no availability impact. The flaw is in the Enterprise Infrastructure SEC component and is rated PR:N/AC:L/UI:N, so the main practical barrier is network reachability to an affected instance; no public exploit was identified at time of analysis and no CISA KEV confirmation was provided. Oracle's October 2026 Critical Patch Update is the reference advisory for remediation.

Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 can be fully taken over by a low-privileged authenticated attacker who reaches the OIM Legacy UI over HTTP. The flaw is network-reachable, low complexity, and requires no user interaction, but it is not unauthenticated: any valid low-privilege account is enough. No public exploit was identified at the time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the available vendor reference.

Remote takeover of Oracle SOA Suite is possible for low-privileged, authenticated attackers who can reach the Adapters component over HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0; Oracle rates it CVSS 9.9 because successful exploitation can also significantly affect connected products through scope change. No public exploit was identified at time of analysis, but the combination of low attack complexity, no user interaction, and high confidentiality, integrity, and availability impact makes this a high-priority patch target.

Authenticated low-privileged attackers with network access to the Fabric Layer component of Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 can achieve high confidentiality and integrity impact, including creation, deletion, or modification of critical data and full read access to BPM Suite data, with scope change extending impact to additional Oracle products. The flaw requires a valid account (CVSS PR:L) but no user interaction and low attack complexity, making it easily exploitable once credentials are obtained. No public exploit code or active exploitation has been identified at time of analysis.

Oracle Solaris 11.4 exposes a local attack path through its Plugins component in which an attacker who already holds high-privileged logon access must also obtain interaction from a different user, after which the attacker can read and modify critical Solaris data and potentially affect other products because the scope changes. CVSS 3.1 scores this at 7.4 with high confidentiality and integrity impact but no availability impact, making it serious for privileged local environments while remaining constrained by the PR:H and UI:R prerequisites. No public exploit was identified at time of analysis, and the Oracle October 2026 Critical Patch Update advisory is the available remediation reference.

Authenticated high-privileged attackers with network access can achieve full takeover of Oracle Business Intelligence Enterprise Edition 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 through the Analytics Web Administration component, with scope change extending impact to connected products. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); no public exploit identified at time of analysis.

Oracle SOA Suite Fabric Layer can be taken over by low-privileged remote attackers with network access, affecting releases 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 score of 8.8 reflects full confidentiality, integrity, and availability impact; exploitation requires a valid low-privilege account (PR:L), but no user interaction and low attack complexity make it straightforward once credentials or a session are obtained. Available intelligence does not identify public exploit code or CISA KEV active exploitation at time of analysis.

Unauthenticated HTTP access to the Oracle SOA Suite Fabric Layer can disclose critical data in Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0. The flaw is network-reachable with low complexity and requires no privileges or user interaction (CVSS 3.1 base 7.5, confidentiality-only), and no public exploit code was identified at time of analysis. Real-world exposure is limited to deployments whose SOA Suite HTTP interface is reachable by untrusted networks.

Remote unauthenticated attackers can achieve takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer over HTTP, with the 9.8 CVSS reflecting high confidentiality, integrity, and availability impact and no privileges or user interaction required. No public exploit identified at time of analysis and no CISA KEV confirmation is present in the supplied data, but internet-reachable SOA Suite instances should be treated as high priority because the assessed vector is pre-authentication network exploitation.

Oracle SOA Suite releases 12.2.1.4.0 and 14.1.2.0.0 contain a critical flaw in the Fabric Layer component that can be reached over HTTP without any credentials, letting a remote attacker seize full control of the SOA Suite deployment. With a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation yields complete loss of confidentiality, integrity, and availability of the affected middleware, effectively a takeover of the product. There is no KEV listing and no public exploit identified at time of analysis, but the pre-authentication network vector and the fact that Oracle's Fabric Layer normally sits on an internet- or partner-facing service bus make this a top-tier patch priority; EPSS data was not supplied, and our independent assessment confirms the unauthenticated remote exploitation path with network reachability as the primary practical barrier.