Authentication Bypass

Unauthenticated remote compromise of Oracle SOA Suite's Fabric Layer can lead to full takeover of the affected installation. The flaw affects SOA Suite 12.2.1.4.0 and 14.1.2.0.0 and is rated CVSS 9.8 with complete confidentiality, integrity, and availability impact; exploitation requires network access to the SOA Suite HTTP interface. No public exploit identified at time of analysis, and the main practical constraint is reachability rather than authentication or user interaction.

Oracle SOA Suite's Enterprise Scheduling System exposes a SOAP interface that unauthenticated remote attackers can reach on versions 12.2.1.4.0 and 14.1.2.0.0, allowing takeover of the product with high confidentiality, integrity, and availability impact. The 9.8 CVSS score and AV:N/AC:L/PR:N/UI:N vector make network reachability the primary exposure factor, so internet-facing or broadly reachable SOAP endpoints are the highest priority. No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis.

Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 contain an easily exploitable Fabric Layer flaw that lets a low-privileged, network-positioned attacker take over the SOA Suite service over HTTP. Successful exploitation can also impact integrated products because the vulnerability changes scope, with high confidentiality, integrity, and availability impact; a low-privilege authenticated account is required. No public exploit code or CISA KEV entry was identified at the time of analysis.

Unauthenticated remote takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 is achievable through the Adapters component of Oracle Fusion Middleware, with Oracle assigning the maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No credentials, user interaction, or special preconditions are required beyond network reachability of the SOA Suite HTTP listener, and the scope-change rating means successful exploitation can cascade into connected or dependent products rather than being contained to the SOA Suite host. At the time of analysis there is no public exploit code or CISA KEV listing, but the combination of maximum severity, unauthenticated access, and low complexity makes this a top-priority patch item for any internet- or broadly internally reachable deployment.

Unauthenticated attackers who can reach the HTTP interface of Oracle SOA Suite's Fabric Layer can bypass authentication to read critical data and make limited unauthorized modifications in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the flaw 9.3 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N); the scope change indicates that a successful compromise can reach beyond SOA Suite into other Fusion Middleware components deployed in the same environment. No public exploit code or confirmed active exploitation was identified at time of analysis, but the absence of authentication, user-interaction, or complexity prerequisites makes this a high-priority patch target wherever the SOA HTTP interface is network-reachable.

Oracle SOA Suite's Fabric Layer can be taken over by a low-privileged attacker who already has authenticated network access via HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The high attack complexity (AC:H) means exploitation depends on conditions outside the attacker's direct control, and no public exploit was identified at time of analysis. The issue carries a 7.5 CVSS base score with high confidentiality, integrity, and availability impact.

Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 contain an improper access control weakness in the Fusion Middleware Fabric Layer that lets a low-privileged, network-positioned attacker read and partially modify data beyond their intended authorization. Exploitation is over HTTP, requires only a valid low-privilege account (PR:L) and no user interaction, yielding high confidentiality impact plus limited integrity impact for a CVSS 3.1 base score of 7.1 (High). No public exploit code or confirmed active exploitation was identified at time of analysis, though the low attack complexity and the prevalence of internet-facing SOA Suite consoles make exposed Fabric Layer endpoints an attractive target.

Authenticated attackers with only low privileges can achieve full takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer over HTTP, with high impact to confidentiality, integrity, and availability. Exploitation is rated difficult (CVSS AC:H) because specific conditions outside the attacker's control must align, and a valid low-privileged SOA Suite account is required (PR:L). No public exploit code or CISA KEV entry was identified in the available intelligence at time of analysis.

Low-privileged authenticated attackers with HTTP network access can achieve full takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through a flaw in the Fabric Layer component, with high impact to confidentiality, integrity and availability (CVSS 3.1 base score 7.5). The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U) means a valid low-privileged account is required and Oracle rates the flaw as difficult to exploit, so attack complexity and account provisioning are the main real-world barriers rather than the score alone. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle tracks the fix through its October 2026 Critical Patch Update.

Remote unauthenticated attackers who can reach the Adapters component of Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0 over HTTP can modify or delete critical data and cause a hang or frequently repeatable crash, producing a CVSS 9.1 integrity and availability impact. No public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data, but the low-complexity, no-privilege vector makes patching and reducing network exposure high priorities.

Low-privileged authenticated attackers can take full control of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer component reachable over HTTP, with a CVSS 3.1 base score of 9.9. The scope-change rating (S:C) means a successful compromise is not contained to the SOA Suite instance and can significantly impact additional connected products, so confidentiality, integrity and availability are all rated high. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the practical gate for attackers is possession of any valid low-privilege account plus network reachability of the SOA Suite HTTP interface.

Full takeover of Oracle SOA Suite is achievable by authenticated low-privilege attackers who can reach the Fabric Layer over HTTP in versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is network-reachable, low-complexity, and requires no user interaction, with high confidentiality, integrity, and availability impact once a valid low-privilege account is obtained. No public exploit code or CISA KEV entry is identified in the supplied intelligence; vendor fixes are referenced through Oracle's October 2026 Critical Patch Update advisory.

Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised by a low-privileged, authenticated remote attacker exploiting the Human Workflow (11g+) component over SOAP, with a scope change that may extend impact to additional products. Successful exploitation can result in takeover of the BPM Suite with high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, but the low attack complexity and high impact make this a priority patching target.

Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 are exposed to unauthenticated remote takeover through the Fabric Layer component reachable via T3 and IIOP. An attacker with network access can exploit the flaw without credentials or user interaction to achieve high confidentiality, integrity, and availability impact; the changed scope means interconnected products may also be affected. No public exploit identified at time of analysis, and the supplied intelligence does not indicate CISA KEV listing, but the unauthenticated network vector and CVSS 10.0 score make this a top-priority exposure for internet- or broadly reachable T3/IIOP listeners.

Unauthenticated remote takeover of Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Human Workflow component exposed over HTTP. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or non-default configuration are required beyond network reachability. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle's October 2026 Critical Patch Update advisory is the authoritative fix source.

Unauthenticated HTTP access to the Oracle SOA Suite Fabric Layer can expose critical data and, because of a scope change, may affect integrated products that trust SOA Suite. The flaw affects Oracle Fusion Middleware SOA Suite 12.2.1.4.0 and 14.1.2.0.0 and is rated CVSS 8.6 with confidentiality-only impact. No public exploit was identified at time of analysis.

Authenticated low-privileged network attackers can exploit Oracle SOA Suite's Fabric Layer to bypass access controls and gain read/write access to critical SOA data, with potential impact spreading to integrated products through scope change. The issue affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). No public exploit code or CISA KEV entry was identified at time of analysis.

Unauthenticated remote attackers can read sensitive data from Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer over HTTP, with scope change potentially exposing data in connected Oracle products. The flaw is easily exploitable (CVSS 3.1 8.6, AV:N/AC:L/PR:N/UI:N/S:C/C:H) and is limited to confidentiality impact; no public exploit was identified in the provided intelligence at time of analysis.

Unauthenticated remote takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Fabric Layer over T3 or IIOP, with a maximum CVSS 3.1 score of 10.0 and a scope change indicating impact beyond the SOA Suite host. Any attacker who can reach the T3/IIOP listener needs no credentials or user interaction, so exposure is primarily governed by network reachability. The provided intelligence shows no KEV listing and no public exploit identified at time of analysis, but the assessed risk remains top-priority because successful exploitation can fully compromise confidentiality, integrity, and availability.

Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised by an authenticated low-privileged attacker who reaches the Fabric Layer over HTTP; successful exploitation affects confidentiality, integrity, and availability and can lead to takeover of the SOA Suite deployment (CVSS 8.8). The flaw is easily exploitable once a valid low-privileged account exists, so exposure is bounded by credential possession rather than anonymity. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.

Unauthenticated remote takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Fabric Layer component exposed over HTTP. The CVSS 3.1 score is 9.8 with network access, no privileges, and no user interaction, yielding high confidentiality, integrity, and availability impact; Oracle's October 2026 Critical Patch Update advisory is the reference. No public exploit code or CISA KEV entry was identified at time of analysis, but this is a genuine high-priority exposure because default configurations are affected and the only practical barrier is network reachability to the SOA Suite HTTP interface.

Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 ship a flaw in the BPM Composer component that lets any low-privileged, network-reachable account over HTTP take full control of the BPM Suite instance, with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The gating factor is authentication: exploitation requires a valid low-privilege credential and no user interaction, so exposure is concentrated in deployments that broadly issue accounts or where credentials can be phished or reused. No public exploit code was identified at time of analysis, and the issue is fixed in Oracle's October 2026 Critical Patch Update; risk is elevated because the barrier to entry is a single ordinary user session rather than administrative access.

Unauthenticated network access to the Generic REST interface in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can expose critical data, with a CVSS 3.1 score of 8.6 and a scope change that may extend disclosed access to additional integrated products. The flaw is remotely exploitable over HTTP without credentials or user interaction, but impact is limited to confidentiality, with no integrity or availability effect. No public exploit code was identified at time of analysis; the main exposure driver is whether the connector's REST endpoint is reachable by an attacker.

High-privileged SOAP access to Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can be abused to read and modify critical connector data, with scope change extending impact to additional Oracle Fusion Middleware products. The flaw is easily exploitable once an attacker already holds high privileges in the product (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, 8.7) and requires network reachability to the Connectors and Connector Server component; no public exploit was identified at time of analysis.

Oracle Solaris 11.4's Image Packaging System (IPS) can be induced to act on attacker-influenced package content delivered over HTTP, giving a network-positioned, unauthenticated attacker high confidentiality impact and limited integrity impact (CVSS 3.1: 7.1 High, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N). The attacker must either control or compromise the repository the host queries, or intercept cleartext HTTP package traffic, and exploitation still requires a Solaris operator to perform a package operation against that content - the UI:R condition is the decisive exposure limiter. Only Solaris 11.4 is listed as affected per Oracle's October 2026 CPU and ENISA EUVD; no public exploit code was identified in the provided intelligence at time of analysis.

Authenticated low-privileged attackers can take over Oracle Service Bus 14.1.2.0.0 by reaching its HTTP interface, with high confidentiality, integrity, and availability impact (CVSS 8.8). Only the 14.1.2.0.0 Core component is listed as affected, and Oracle characterizes the flaw as easily exploitable; no public exploit identified at time of analysis and no CISA KEV entry was provided. The authentication requirement is the main barrier, so exposure is greatest where Service Bus HTTP endpoints are reachable by users who can obtain even minimal valid credentials.

Low-privileged authenticated attackers with network HTTP access can exploit the Oracle Service Bus Core component to achieve takeover of the service, with high confidentiality, integrity, and availability impact (CVSS 8.8). Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 are affected, and exploitation requires a valid account but no user interaction; no public exploit code was identified at time of analysis. The authentication prerequisite limits exposure compared with unauthenticated flaws, but default deployments reachable over HTTP remain at risk from any low-privilege user.

Information disclosure in Oracle Solaris 11.4's Image Packaging System (IPS) allows unauthenticated remote attackers with HTTP network access to read critical data or all data accessible to the system; CVSS 3.1 is 7.5 with confidentiality-only impact. Oracle's October 2026 CPU identifies the affected component and version, but no public exploit code or CISA KEV entry is present in the supplied intelligence, so there is no public exploit identified at time of analysis. Exposure is limited to deployments where the IPS/pkg HTTP interface is reachable by untrusted networks.

Stored content injection in Oracle Applications Framework's Personalization component (Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to place malicious content that executes when another user opens the personalized page, causing high confidentiality and integrity impact and possible scope change into other products. The attacker must hold valid credentials and convince a second user to interact with the page, so exploitation is neither self-contained nor unauthenticated. No public exploit code or CISA KEV entry was identified at time of analysis.

Takeover of the Pasta Printing Engine component within Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a low-privileged authenticated user who can reach the component over HTTP, with full impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.5). Oracle characterizes the flaw as difficult to exploit, and the AC:H metric indicates an additional precondition the attacker does not fully control - such as a specific timing window, race condition, or particular printing-component state - so reliable, single-shot exploitation is not implied; no public exploit code and no active exploitation (CISA KEV) were identified at time of analysis. This is a serious but not top-tier priority issue: exploitation is gated behind valid EBS credentials and applies only to 12.2.x deployments running the Pasta component, and no user interaction is required (UI:N).

Local low-privileged users with logon access to hosts running Oracle E-Business Suite Applications DBA 12.2.3 through 12.2.15 can abuse the AD Utilities component to read, create, delete, or modify critical application data. The assessed CVSS 3.1 score is 7.1 High with AV:L/PR:L/UI:N and high confidentiality and integrity impact, while availability is unaffected; exploitation requires an existing local account and no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.

Takeover of the Oracle E-Business Suite Applications DBA (AD Utilities) component is achievable by a low-privileged attacker who already holds a logon on the application-tier host running those utilities, in supported versions 12.2.3 through 12.2.15. The attacker cannot reach the flaw remotely or unauthenticated (AV:L/PR:L), and successful exploitation additionally depends on a different, higher-privileged person performing an action - typically a DBA or operator running an affected AD Utilities operation against attacker-influenced input (UI:R). Oracle rates the impact on confidentiality, integrity and availability as high (CVSS 3.1 base 7.3); no public exploit code or confirmed active exploitation was identified at time of analysis, and the practical risk is gated by shared access to the application tier and by privileged-operator behavior rather than being a drop-everything emergency.

Crafted-document processing in Oracle Outside In Technology 8.5.8 (Outside In Core) can be exploited by an unauthenticated network attacker to take over the affected application, with high confidentiality, integrity, and availability impact. The attacker delivers a malicious file over HTTP and succeeds only if a person or automated pipeline opens it (UI:R), so real-world exposure is bounded by whether the deploying product ingests untrusted documents through Outside In. No CISA KEV listing appears in the supplied intelligence and no public exploit was identified at time of analysis; the 8.8 score reflects potential impact rather than demonstrated exploitation.

Unauthenticated remote attackers can read critical data and cause a partial denial of service in Oracle Outside In Technology 8.5.8 by supplying crafted files to applications that embed the Outside In Core parser. The CVSS 3.1 score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L), reflecting high confidentiality impact, low availability impact, and no integrity impact. No public exploit was identified at time of analysis, and exploitation depends on a host application exposing file-processing paths to untrusted input.

Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 expose a high-severity flaw in the Core component that lets a low-privileged, network-positioned attacker take over the service bus, with full impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). Exploitation is straightforward once credentials exist - no user interaction, low attack complexity, HTTP-reachable - but it is not unauthenticated: the attacker must already hold a valid low-privilege account on the target (PR:L). At time of analysis there is no CISA KEV listing and no public exploit code identified, so this is a credible high-priority patch target rather than an emergency, and the practical risk is dominated by how freely low-privilege accounts can be obtained and how exposed the HTTP interface is.

Takeover of Oracle GoldenGate is possible through its Admin Server Executable, where a low-privileged authenticated attacker with HTTPS network access can achieve high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments are GoldenGate 19.1.0.0.0 through 19.32.0.0, 21.3 through 21.23, and 23.4 through 23.26.3.0.0, while instances patched to the October 2026 CPU fix level are not exposed. No public exploit code has been identified at time of analysis, but low attack complexity and network reachability make timely patching important.

Authenticated low-privileged attackers who can reach the OSSL module of Oracle HTTP Server over HTTP can read and modify critical data, with a scope change that lets the impact extend into other Fusion Middleware products reachable through or proxied by the server. The flaw carries a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N; no availability impact) and affects only Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0. No public exploit code or CISA KEV entry was identified at time of analysis, but the low attack complexity and the front-end position of OHS make this a high-priority patch target.

Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 can be compromised by unauthenticated, remote attackers through the WebLogic Server Proxy Plug-in component, yielding high confidentiality and integrity impact and - because the CVSS vector carries a scope change (S:C) - potential knock-on impact to systems the plug-in fronts. Oracle rates the attack complexity as high ('difficult to exploit'), so the bug is not reliably repeatable against arbitrary targets and depends on conditions outside the attacker's control, but no authentication (PR:N) or user interaction (UI:N) is required once those conditions are met. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the source data.

Unauthenticated remote attackers can compromise Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 through the Authentication Engine, obtaining high-impact confidentiality and integrity access and potentially affecting other products because the CVSS scope is changed. The CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), with no availability impact; no public exploit identified at time of analysis. Exposure depends on reachability of the OAM authentication endpoint, and default deployments appear exploitable because the description calls out no special configuration prerequisite.

Takeover of Oracle VM VirtualBox 7.2.20 is possible by a high-privileged attacker with access to the physical communication segment attached to the hardware running VirtualBox, per Oracle's October 2026 CPU. The Core component flaw has a CVSS 3.1 score of 8.4 (AV:A/AC:L/PR:H/UI:N/S:C) and can cross a scope boundary to affect additional products. No public exploit or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied.

Takeover of Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) is possible for an attacker who already holds a low-privileged authenticated logon on the host running the product, affecting versions 9.2.0.0 through 9.2.26.5. The flaw is local rather than network-reachable (AV:L), needs no user interaction, and has low attack complexity, so once the prerequisite account access exists the attacker can reliably gain high confidentiality, integrity, and availability impact, yielding a CVSS 3.1 base score of 7.8. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical gating factor is possession of local credentials on the EnterpriseOne server tier.

Unauthenticated remote attackers with HTTP access to the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools (releases 9.2.0.0 through 9.2.26.5) can tamper with application data, based on the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5). The flaw is scored for high integrity impact only - attackers cannot read confidential data or disrupt availability - but no privileges or user interaction are required, making the integrity of EnterpriseOne business records the sole but significant exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and the primary practical limit on exposure is whether the EnterpriseOne Tools HTTP interface is reachable from untrusted networks.

Unauthenticated network attackers who can reach the Interoperability SEC component of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 over TLS can read and modify critical business data, although Oracle rates the attack as difficult (AC:H) because an unspecified precondition must be satisfied. No public exploit code or confirmed active exploitation has been identified at time of analysis. Oracle's October 2026 Critical Patch Update advisory is the reference for remediation.

Takeover of JD Edwards EnterpriseOne Tools is possible for low-privileged attackers who can reach the JDENET service on affected versions 9.2.0.0 through 9.2.26.5. The flaw is in the Interoperability SEC component and has a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring a valid low-level account or an existing authenticated foothold rather than anonymous access. No public exploit identified at time of analysis; Oracle's October 2026 Critical Patch Update advisory is the reference source.

A high-complexity privilege-escalation flaw in Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component, versions 9.2.0.0 through 9.2.26.5) lets a low-privileged, already-authenticated attacker reach the JDENET service over the network and take over the EnterpriseOne Tools environment, with full confidentiality, integrity, and availability impact (CVSS 7.5). Exploitation is explicitly difficult (AC:H) because success depends on timing, configuration, or environmental conditions outside the attacker's control, and it requires pre-existing low-privilege credentials plus network reachability to JDENET. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV signal was supplied; Oracle addresses it in its October 2026 Critical Patch Update.

Low-privileged users who can reach the JDENET service on Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can escalate to full takeover of the EnterpriseOne Tools instance, affecting confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the Database and Comm SEC component, requires only network reachability plus a valid low-privilege account, and needs no user interaction or elevated rights, making attack complexity low. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible high-priority issue but not a drop-everything emergency; the practical constraint on attackers is possession of credentials and exposure of JDENET.

Authenticated low-privileged users of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can abuse the Package Build SEC component over HTTP to create, delete, or modify critical application data and to hang or repeatedly crash the Tools service, yielding a combined integrity and availability impact rated CVSS 8.1. Exploitation requires only a valid low-tier account (PR:L), with low attack complexity, no user interaction, and no elevated privileges, so the practical barrier is account provisioning plus reachability of the EnterpriseOne Tools web layer rather than any exploit precondition. At the time of analysis no public exploit code or confirmed active exploitation was identified, and no CISA KEV listing exists for this CVE.

Authenticated low-privileged users with HTTP access to the Interoperability SEC component of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can read critical application data beyond their intended authorization scope and trigger a partial denial of service, as addressed in Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) reflects high confidentiality impact and low availability impact, gated only by the need for a valid low-privilege account and reachable integration endpoints. No public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis, and the tag 'Authentication Bypass' indicates the weakness is an authorization/access-control gap rather than a pre-auth entry point.

Oracle JD Edwards EnterpriseOne Tools (Interoperability SEC) versions 9.2.0.0 through 9.2.26.5 allows a low-privileged authenticated attacker with network access to JDENET to create, delete, or modify critical data and read all data accessible to the application. The CVSS 3.1 score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N); no public exploit code or CISA KEV confirmation was identified at time of analysis. Despite an 'Authentication Bypass' tag, the assessed vector requires valid low-privileged credentials, making this a credible high-priority patch target but not a confirmed emergency.

Unauthenticated network attackers can achieve full takeover of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) by reaching the SMTP mail-handling path of the Enterprise Infrastructure SEC component, as disclosed in Oracle's October 2026 Critical Patch Update. Oracle rates the flaw 8.1 with high confidentiality, integrity, and availability impact, but attack complexity is high (AC:H), meaning success depends on message-processing state or timing the attacker does not fully control, so reliable exploitation is non-trivial. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a serious-but-not-emergency patching priority rather than an active incident.

High-severity confidentiality exposure in Oracle Outside In Technology 8.5.8, a document-parsing library embedded in third-party applications, lets unauthenticated remote attackers read critical data through HTTP requests. The CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting low attack complexity, no user interaction, scope change, and high confidentiality impact with no integrity or availability effect. Exploitation realistically requires that the library's Outside In Core parsing path be reachable and fed attacker-supplied documents by the embedding product; no public exploit code or CISA KEV entry is identified at time of analysis.

Unauthenticated network attackers can read, create, delete, or modify critical data in Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 through the Core component's HTTP interface. The 9.1 CVSS score reflects high confidentiality and integrity impact with no availability impact, low complexity, and no user interaction. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided; exposure is primarily determined by whether WebLogic HTTP/T3 listeners are reachable from untrusted networks.

Oracle VM VirtualBox 7.2.16 carries a flaw in its Core component that lets a low-privileged user with local logon to the host read critical data accessible to VirtualBox and reliably hang or repeatedly crash the hypervisor, with a scope change (S:C) that points to a guest-to-host boundary escape rather than a mere guest-local bug. The vector (AV:L/AC:L/PR:L/UI:N) means exploitation is local and requires only a low-privileged account, no user interaction, and low attack complexity, so risk concentrates in multi-tenant hosts, VDI estates and developer machines where semi-trusted users can log on or drive a guest VM. No public exploit code has been identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV entry), no EPSS score was supplied, and the exact fixed build is not specified in the provided data - the Oracle Critical Patch Update (October 2026) advisory is the authoritative patch source.

Unauthenticated attackers with HTTP network access to a third-party web server (Apache HTTP Server, Microsoft IIS, or Oracle iPlanet) running the Oracle WebLogic Server Proxy Plug-in can bypass authentication and obtain read/write access to critical data reachable through the proxied WebLogic backend. The flaw affects plug-in versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 and carries a CVSS 3.1 score of 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). Oracle rates exploitation as difficult (AC:H), and no public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis; EPSS was not supplied.

Unauthenticated remote attackers can disclose critical data from Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 by reaching the Authentication Engine over HTTP; the issue is rated CVSS 7.5 with high confidentiality impact and no integrity or availability effect. Exploitation requires only network reachability to the OAM authentication endpoint, making internet-exposed or broadly reachable deployments the priority. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied.

Authenticated low-privileged attackers with HTTP access to the Oracle BI EE Analytics Server can take over affected 8.2.0.0.0 and 26.01.0.0.0 installations, with high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires a valid low-privilege account (PR:L) but no user interaction and low complexity; no public exploit was identified at time of analysis.

Unauthenticated remote takeover of Oracle Access Manager is possible through its SAML-facing Authentication Engine, affecting builds 12.2.1.4.0 and 14.1.2.1.0 of the Oracle Fusion Middleware component. With a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), Oracle characterizes the flaw as easily exploitable by an attacker who can reach the SAML authentication interface over the network, with full confidentiality, integrity, and availability impact and potential full compromise of the OAM service. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation has not been confirmed in the wild, but the combination of unauthenticated network access, low attack complexity, and complete impact makes this a top-tier patching priority for any internet- or partner-facing OAM deployment.

Unauthenticated attackers with HTTP network access can abuse Oracle Access Manager's Authentication Engine (versions 12.2.1.4.0 and 14.1.2.1.0) to achieve full confidentiality and integrity compromise of OAM-accessible data, with scope change extending impact to federated downstream products. Oracle rates the issue 'difficult to exploit' (AC:H), meaning success hinges on non-trivial environmental or flow-specific conditions rather than a simple request, so this is a serious but conditional risk rather than a point-and-click exploit. No public exploit code or confirmed active exploitation was identified at time of analysis, and no CVE-level patch version is stated beyond Oracle's October 2026 Critical Patch Update advisory. EPSS: not provided.

Unauthenticated network attackers can potentially take over Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 through crafted SAML authentication exchanges, yielding high confidentiality, integrity, and availability impact. The flaw is rated CVSS 3.1 8.1 with AC:H, indicating exploitation is difficult and depends on specialized conditions in the SAML flow; no public exploit or CISA KEV status is identified in the provided data, and SAML must be configured and reachable for exposure.

Unauthenticated network attackers can compromise the Authentication Engine component of Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 over HTTP, gaining high-confidentiality read access to data managed by the identity server plus limited ability to modify it and to degrade availability (CVSS 3.1 base 8.6, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, no credentials, session, or victim interaction are needed - only network reachability to a vulnerable OAM deployment. No public exploit code or confirmed active exploitation was identified at time of analysis, so risk is driven by exposure: internet-facing or broadly reachable OAM instances should be treated as high priority and patched via Oracle's October 2026 Critical Patch Update, while internal-only deployments behind filtering proxies have materially lower reachability.

Unauthenticated network attackers can obtain unauthorized read access to critical data accessible through Oracle MySQL Connector/Python 26.7.0, the only affected release. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), the flaw is remotely reachable at low complexity without privileges or user interaction, but impact is bounded to data disclosure and to deployments where the connector is network-exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; Oracle's October 2026 Critical Patch Update is the reference advisory.

Low-privileged authenticated users can achieve full takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 through the OIM Legacy UI component, which is reachable over HTTP and requires no victim interaction. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects complete loss of confidentiality, integrity and availability, but exploitation is gated on an attacker already holding a valid low-privilege OIM account plus network reachability to the deployed Legacy UI - unauthenticated external exploitation is not indicated by the assessed vector. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so the practical risk is highest for environments where the Legacy UI is exposed to broad network segments or where low-privilege accounts are weakly governed.

Authenticated takeover of Oracle Identity Manager is achievable through the OIM Legacy UI component: a holder of any low-privileged account who can reach the instance over HTTPS can escalate to full control of confidentiality, integrity, and availability (CVSS 8.8). Only versions 12.2.1.4.0 and 14.1.2.1.0 of the Fusion Middleware product are listed as affected, and no user interaction or special attack conditions are required beyond that minimal foothold. Oracle resolves the issue with the October 2026 Critical Patch Update; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, but the low complexity and high payoff make unpatched, lower-trust-accessible deployments a priority.

Complete compromise of Oracle WebLogic Server is possible for unauthenticated, network-positioned attackers targeting the T3 or IIOP listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), meaning no credentials or user interaction are required and confidentiality, integrity, and availability are all fully impacted. No CISA KEV entry or public exploit code is identified in the provided intelligence at time of analysis, but the lack of exploit reporting does not reduce the priority for internet-exposed T3/IIOP endpoints.

Unauthenticated HTTP access to the Data Transforms component in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 can be abused to read critical ODI data and perform limited unauthorized data changes. The flaw is rated CVSS 8.2 with high confidentiality and low integrity impact and requires no credentials or user interaction, making reachable ODI endpoints a high-priority exposure. No public exploit code was identified at time of analysis.

Unauthenticated remote takeover of Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 is possible through the ODI Console / Repository Explorer over HTTP, as addressed in Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score is 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no authentication, no user interaction, and high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV confirmation was identified in the supplied intelligence at time of analysis, but internet-exposed ODI Console instances are high priority because the assessed limiting factor is network reachability rather than any special configuration.

Unauthenticated remote takeover of Oracle Data Integrator is possible through the Console / Repository Explorer RMI interface on versions 12.2.1.4.0 and 14.1.2.0.0, with CVSS 3.1 score 9.8 reflecting high confidentiality, integrity, and availability impact. Attackers with network reachability to the RMI listener need no credentials or user interaction; the primary exposure constraint is whether that listener is reachable across network boundaries. Exploitation status: no public exploit identified at time of analysis.

Authenticated low-privileged attackers with HTTP access to Oracle Product Hub 12.2.3 through 12.2.15 can achieve takeover of the component, with scope change (S:C) extending impact to additional connected Oracle E-Business Suite products. The CVSS 3.1 base score is 8.5, but exploitation is rated difficult (AC:H) and requires a valid low-privileged account (PR:L) with no user interaction (UI:N). No public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.

Unauthenticated network attackers can potentially bypass authentication and read or modify critical data through the Oracle WebLogic Server Proxy Plug-in in supported 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 deployments, although Oracle rates exploitation as difficult (AC:H) and the impact may extend to systems behind the proxy because of scope change. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided, so internet-facing proxy plug-in installations should still be prioritized for review and patching.

Unauthenticated attackers with network access to Oracle E-Business Suite's Shipping Execution module can bypass authentication in the Workflow Events component to read and modify critical shipping data. The flaw affects E-Business Suite 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact; the high attack complexity (AC:H) reflects difficult-to-satisfy exploitation preconditions rather than a lack of severity. No public exploit code or confirmed active exploitation was identified at time of analysis.

Unauthenticated data tampering and disclosure in the Workflow Events component of Oracle Shipping Execution (Oracle E-Business Suite 12.2.3 through 12.2.15) can be triggered by a network attacker over HTTP, yielding full confidentiality and integrity impact on the module's accessible data with a CVSS 3.1 base score of 7.4. Oracle explicitly characterizes the flaw as difficult to exploit (AC:H), so a successful attack depends on conditions outside the attacker's control rather than a single crafted request, and there is no availability impact - the realistic risk is data disclosure and modification, not service disruption. No public exploit code or confirmed active exploitation was identified at time of analysis, and given the high attack complexity this is best treated as a genuine but second-tier priority addressed through the October 2026 Critical Patch Update.

An authenticated low-privileged user who can reach the Oracle Contract Lifecycle Management for Public Sector HTTP endpoints in Oracle E-Business Suite can achieve full takeover of the CLM module's data and functionality - a complete loss of confidentiality, integrity and availability scored at CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only instances running the Award/PO component of CLM for Public Sector on releases 12.2.3 through 12.2.15 are exposed, and the attack requires a valid account (PR:L) with no user interaction and low complexity once that prerequisite is met. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle typically withholds technical detail until customers have patched, so the absence of exploit reporting should not be read as low risk for internet-facing or broadly accessible EBS deployments.

Oracle E-Business Suite 12.2.3 through 12.2.15 ships a Contract Lifecycle Management for Public Sector module whose Award/PO component fails to properly constrain what a logged-in low-privileged user can do, so any account holder with HTTP reach to the application can read and alter contract and purchase-order data they should not touch. The result is a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact and no availability impact; the vector (AV:N/AC:L/PR:L/UI:N/S:U) means exploitation requires prior authentication but no admin rights, no user interaction and no special configuration. Risk is concentrated in EBS deployments with large or loosely governed user populations, or where credentials can be phished or reused; no public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle has published a fix in its October 2026 Critical Patch Update.

Unauthenticated remote write access in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an attacker manipulate the shared Redis backing store under any tenant's key, collapsing the platform's credential-encryption boundary and allowing cached flow parameters to be poisoned across tenants. The issue is rated CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) and requires the multi-tenant deployment pattern where tenants share the same Redis instance. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.

Full system takeover of Oracle Solaris 11.3 and 11.4 is possible for unauthenticated network attackers who can reach the Image Packaging System (IPS) HTTP service, with high confidentiality, integrity, and availability impact. The 9.8 CVSS score reflects network reachability with low attack complexity, no privileges, and no user interaction, but practical exposure depends on whether the IPS endpoint is accessible from an attacker-reachable network path. No public exploit code or CISA KEV entry was identified at time of analysis.

Authorization bypass in OpenChoreo (1.0.0 through 1.0.5, 1.1.0 through 1.1.6, and 1.2.0 through 1.2.4) lets an authenticated user holding workflowrun:update on one project or component rewrite the ownership labels of a different WorkflowRun in the same namespace. Because the PUT .../workflowruns/{runName} handler derives its authorization hierarchy from the openchoreo.dev/project and openchoreo.dev/component labels in the request body while loading the target run from the URL path, an attacker who names a victim run in the path and submits labels for a scope they control is subsequently treated as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or drive the run into a permanent ComponentValidationFailed state. CVSS 3.1 scores this 7.4 with scope change (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L), but exposure is limited to deployments where multiple projects or components share a single namespace; it is not anonymously reachable and not cross-tenant, and no public exploit code was identified at time of analysis. Vendor-released patches exist in 1.0.6, 1.1.7, and 1.2.5.

Origin-policy bypass in Google Chrome before 156.0.8078.47 can let a remote attacker use a crafted HTML page to make unauthorized cross-origin accesses after the victim visits the page. The flaw is a missing authorization check in Chrome's Animation component (CWE-862); it affects default installations and requires user interaction, with no authentication needed. There is no evidence of active exploitation and no public exploit identified at time of analysis; EPSS is 0.24% (14th percentile), and Google has released 156.0.8078.47 as the fixed build.

Improper access control in Google Chrome's ComputePressure component allows a remote, unauthenticated attacker to bypass web origin policy in any build prior to 156.0.8078.47 by getting a victim to open a crafted HTML page. Impact scoring conflicts across sources: the published vector claims 8.8 with high confidentiality and integrity impact, while our own assessment rates it confidentiality-only and low (C:L/I:N/A:N), so the realistic worst case is a limited cross-origin information leak rather than full compromise. No public exploit code has been identified at time of analysis and EPSS sits at 0.24% (14th percentile); the mandatory user interaction keeps mass automation unlikely, which is why it is prioritized for remediation this week rather than treated as an emergency.

Improper access control in the V8 JavaScript engine of Google Chrome builds prior to 156.0.8078.47 lets a remote attacker who convinces a user to load a crafted HTML page potentially bypass web origin policy, compromising the confidentiality and integrity of data across origins. Exploitation needs no credentials (PR:N) but does require user interaction, so unattended mass exploitation is bounded. No public exploit code or CISA KEV entry is present in the supplied data; EPSS is low at 0.23% (14th percentile), and the priority decision is this_week rather than emergency.

Improper access control in Chrome's ANGLE graphics layer enables remote code execution inside the browser sandbox on Google Chrome versions earlier than 156.0.8078.47 when a victim renders a crafted HTML page. The CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but Google rates it Low because the impact is confined to the renderer sandbox and no sandbox escape is shown; exploitation requires user interaction, authentication is not required per PR:N, and no public exploit identified at time of analysis. The conflicting signals - high CVSS and RCE/authentication-bypass tags versus vendor Low and sandbox-only impact - should be weighed when prioritizing.

Takeover of Oracle Product Hub is possible for a low-privileged authenticated attacker with HTTP access to the Internal Operations component in Oracle E-Business Suite 12.2.3 through 12.2.15. The flaw carries CVSS 3.1 score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning any valid low-tier session can reach the vulnerable component without user interaction and potentially gain full control of confidentiality, integrity, and availability. No public exploit code or CISA KEV entry was identified at time of analysis, but the low attack complexity and authenticated network vector make it a credible priority for exposed EBS deployments.

Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by an authenticated low-privileged attacker with HTTP network access, enabling high impact to confidentiality, integrity, and availability of the component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) shows low attack complexity and no user interaction once a valid low-privileged account is obtained, making this a genuine high-priority issue. No public exploit identified at time of analysis and no CISA KEV entry or EPSS score was provided in the supplied intelligence, but Oracle has published an October 2026 CPU advisory for remediation.

Any authenticated low-privilege user who can reach the HTTP interface of Oracle Product Hub (the Internal Operations component of Oracle E-Business Suite) can take full control of the module, with high impact on confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U). Deployments of E-Business Suite 12.2.3 through 12.2.15 running Product Hub are in scope, and because attack complexity is low and no user interaction is required, a single valid low-privilege session is sufficient to attempt exploitation - the real barrier is first obtaining EBS credentials and network reachability to the endpoint. No public exploit code and no CISA KEV entry were identified at time of analysis, so this is a credible mid-to-high priority patching item rather than an emergency, but the low bar for a credentialed insider or compromised account keeps it worth scheduling promptly.

Strategic Network Optimization in Oracle E-Business Suite versions 12.2.3 through 12.2.15 can be taken over through a network-based attack that requires no credentials but does require a victim to interact with attacker-controlled content. The CVSS 3.1 score is 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting high confidentiality, integrity, and availability impact; no public exploit was identified at time of analysis. The limiting prerequisite is user interaction, not authentication, so exposure of the SNO HTTP interface together with successful social engineering is the practical attack path.

Authenticated attackers can achieve broad data tampering and disclosure against Oracle E-Business Suite's Global Order Promising Web Service in versions 12.2.3 through 12.2.15, with CVSS 3.1 scoring 8.2 (C:H/I:H, no availability impact). Exploitation requires a valid low-privilege EBS account (PR:L) plus network HTTP reachability to the affected component and satisfaction of high-complexity, server-side conditions the attacker cannot directly control (AC:H); no user interaction is needed (UI:N), and successful attacks cross a scope boundary (S:C), meaning other products can be significantly impacted. No public exploit code or confirmed in-the-wild activity was identified at time of analysis - no public exploit identified at time of analysis - so risk is real but bounded by the authentication prerequisite and the High attack complexity.

Takeover of Oracle Contract Lifecycle Management for Public Sector (the Award/PO component of Oracle E-Business Suite) is achievable by an attacker who already holds a high-privileged application account, with full loss of confidentiality, integrity and availability (CVSS 3.1 base 7.2). Only versions 12.2.3 through 12.2.15 are affected, and the attack is carried out over the network via HTTP with low complexity and no user interaction, so the practical barrier is the prerequisite of an existing highly privileged session rather than any technical obstacle. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so risk is concentrated on privileged insiders, compromised administrator credentials, and environments where the CLM application is exposed to attackers who have already escalated.

Authenticated denial-of-service with limited data disclosure and modification in Oracle Shipping Execution affects Oracle E-Business Suite deployments running 12.2.3 through 12.2.15. A low-privileged attacker holding a valid EBS account can reach the Workflow Events component over HTTP and, only when specific non-default conditions line up (AC:H), hang or repeatedly crash the Shipping Execution module while reading and modifying a subset of its data; the scope-change flag means integrated EBS products can also be impacted. CVSS 3.1 scores this 7.7 with availability as the dominant impact, and while the flaw is difficult to exploit, no public exploit code or confirmed active exploitation (no CISA KEV listing) has been identified at time of analysis.

Unauthenticated, network-reachable attackers can access critical or all Oracle Shipping Execution data in Oracle E-Business Suite versions 12.2.3 through 12.2.15 by targeting the Workflow Events component over HTTP. The flaw is rated 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with high confidentiality impact and no integrity or availability impact; no public exploit code or CISA KEV entry was identified at time of analysis. Exposure is limited mainly by whether the EBS web tier is reachable from untrusted networks.

Unauthenticated network attackers can potentially take over Oracle Shipping Execution in Oracle E-Business Suite 12.2.3 through 12.2.15 by abusing a high-complexity flaw in the Workflow Events component, rated CVSS 8.1 with full confidentiality, integrity, and availability impact. Oracle characterizes the issue as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control such as precise timing, server state, or a specific configuration rather than reliable reproduction against any default install, and no public exploit code or active exploitation has been identified at time of analysis. Practical risk is further bounded by exposure: the EBS HTTP interface and the Shipping Execution module must be network-reachable to the attacker, which in many deployments means internal-only rather than internet-facing access.

Oracle Shipping Execution, a module of Oracle E-Business Suite, exposes an Internal Operations component that permits a low-privileged authenticated user with HTTP access to read, modify, and partially disrupt shipping data across supported releases 12.2.3 through 12.2.15. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:L/A:L, 7.6) reflects a high confidentiality impact with limited integrity and availability effects, and no public exploit code or confirmed active exploitation was identified at time of analysis. The main barrier to abuse is the requirement for a valid low-privilege EBS session (PR:L), so exposure is greatest where the EBS web tier is broadly reachable or where low-privilege accounts are easy to obtain.