Authentication Bypass

Oracle Quality in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated low-privileged remote attacker to read and modify critical data through the Internal Operations component over HTTP. The flaw is low complexity and requires no user interaction, but valid EBS credentials are required, which limits anonymous exploitation; confidentiality and integrity are fully impacted while availability is not. No public exploit code or CISA KEV entry was identified at time of analysis.

Oracle Project Contracts versions 12.2.3 through 12.2.15 expose critical data to any user holding a valid low-privileged E-Business Suite account, because the Internal Operations component fails to adequately restrict what that account can read over HTTP. Successful exploitation gives high-confidentiality read access to Project Contracts data and, due to a scope change in the assessed vector, can extend to data in other Oracle products reachable from the same suite; integrity and availability are unaffected. Exploitation requires authentication (CVSS PR:L) and no user interaction, making it low-complexity for an insider or anyone who has obtained a mundane EBS credential - no public exploit code and no confirmed active exploitation were identified at time of analysis, and Oracle addresses the flaw through its October 2026 Critical Patch Update.

Unauthenticated network attackers can read and modify critical data in Oracle E-Business Suite's Mobile Application Server (MWA Terminal Server) versions 12.2.3 through 12.2.15, with a CVSS 3.1 score of 7.4. Oracle rates the issue difficult to exploit because of high attack complexity, and no public exploit code or CISA KEV active-exploitation signal was identified at time of analysis. Exposure is greatest where the MWA Terminal Server is reachable beyond trusted internal or warehouse-handheld networks.

Oracle HCM Common Architecture, the shared framework layer within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations component reachable over HTTP that a low-privileged authenticated user can abuse to read and modify critical HCM data and to partially degrade service availability. The defect is rated CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), with the High attack complexity reflecting a precondition or environmental state the attacker does not control, which keeps reliable exploitation difficult even though no victim interaction is needed. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Oracle published the fix in its October 2026 Critical Patch Update, so priority is real but second-tier relative to unauthenticated, low-complexity flaws.

Takeover of the Oracle HCM Common Architecture component is possible in Oracle E-Business Suite releases 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access to the Internal Operations functionality can achieve full compromise of the component with high confidentiality, integrity and availability impact. Exploitation is constrained: the attacker must already hold valid low-privilege EBS credentials (PR:L) and the attack carries high complexity (AC:H), meaning success depends on conditions outside the attacker's direct control such as timing, configuration or application state, and no end-user interaction is required (UI:N). No public exploit code was identified and the issue is not confirmed actively exploited (not in CISA KEV) at time of analysis; EPSS was not provided, so risk is concentrated on internet-exposed EBS deployments where low-privilege or self-service accounts are widely provisioned.

Oracle E-Business Suite's HCM Common Architecture component (Internal Operations) in versions 12.2.3 through 12.2.15 can be compromised by a low-privileged attacker with network HTTP access, allowing full takeover of the component with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.5). Exploitation is gated by high attack complexity - Oracle describes it as 'difficult to exploit' - meaning conditions outside the attacker's direct control (such as a specific application state, configuration, or timing condition) must align, and the attacker must already hold a valid low-privileged EBS account (PR:L, not unauthenticated). There is no public exploit code and no confirmed active exploitation (not in CISA KEV) at time of analysis, but internet-exposed EBS portals enlarge the pool of potential low-privileged attackers who could attempt it.

Unauthorized read and write access to critical data in Oracle E-Business Suite's Document Management and Collaboration (Attachments) component affects versions 12.2.3 through 12.2.15 and, because of a scope change, can extend to data and resources in other EBS products. A low-privileged authenticated attacker with HTTP access can trigger the flaw, but exploitation requires a different user-typically someone with higher privileges-to interact with attacker-supplied attachment content, so this behaves like a stored/second-order access-control or injection issue (CVSS 8.7; C:H/I:H/A:N) rather than a pre-auth remote compromise. No public exploit code or CISA KEV entry was identified in the available intelligence, and no EPSS score was supplied.

Takeover of Oracle Bills of Material in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a low-privileged authenticated attacker with network HTTP access to the Internal Operations component. The flaw is explicitly difficult to exploit (AC:H) and requires no user interaction, but successful exploitation would fully compromise confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

High-privileged authenticated attackers can achieve unauthorized data manipulation and partial denial of service in Oracle Bills of Material (Oracle E-Business Suite 12.2.3-12.2.15) by exploiting a difficult-to-exploit flaw over HTTP, with scope change potentially affecting additional Oracle products. The vulnerability requires network access, high attack complexity (AC:H), and a high-privilege account (PR:H); no public exploit code or active exploitation has been identified at time of analysis. EPSS risk was not provided, but the CVSS 7.2 score reflects an integrity-heavy impact profile.

Authenticated low-privileged users can compromise Oracle General Ledger 12.2.3 through 12.2.15 over HTTP, with successful exploitation potentially leading to takeover of the General Ledger component. The CVSS 3.1 score is 7.5, reflecting high confidentiality, integrity, and availability impact, but Oracle rates the attack as difficult to exploit because it requires high attack complexity in addition to valid credentials. No public exploit code or active exploitation is identified at time of analysis, and remediation is available through Oracle's October 2026 Critical Patch Update.

Authenticated low-privileged users of Oracle Product Hub 12.2.3 through 12.2.15 can abuse the Item Catalog component over HTTP to obtain broad unauthorized read access to critical Product Hub data, limited insert/update/delete capabilities, and a partial denial of service, with the scope change extending impact into other Oracle E-Business Suite products. The CVSS 3.1 base score is 7.7 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L), but the high attack complexity means exploitation depends on conditions outside the attacker's control and is difficult to carry out reliably. No public exploit code has been identified and there is no confirmation of active exploitation (no CISA KEV listing) at time of analysis. An EPSS score was not provided, so no probabilistic exploitation estimate can be cited.

Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 can be fully taken over by an authenticated attacker who already holds high application privileges and can reach the Internal Operations component over HTTP. The flaw is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the high-privilege prerequisite substantially limits realistic exposure to insiders, compromised privileged accounts, or post-authentication attack chains. No public exploit code or confirmed active exploitation was identified at time of analysis.

Oracle E-Business Suite Assets 12.2.3 through 12.2.15 exposes a low-privileged, authenticated attacker with HTTP access to the Internal Operations component to cause a hang or repeatable crash (complete denial of service) while also reading a subset of Assets data and modifying, inserting, or deleting some of it. With a CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H), the flaw is easily triggered once valid credentials exist but is constrained by the authentication requirement and the Assets module scope. No public exploit code or CISA KEV entry was identified in the provided intelligence, so this is a genuine but moderate-priority issue rather than a confirmed actively exploited emergency.

Authenticated low-privileged users can achieve full takeover of the Oracle Engineering Change Management component in Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP, with high impact to confidentiality, integrity, and availability (CVSS 8.8, PR:L/AC:L/UI:N). The flaw is easily exploitable once a valid EBS account is obtained; no public exploit code or confirmed active exploitation is identified in the available intelligence. Risk is greatest for internet-exposed EBS instances or environments where low-privilege accounts are readily available.

Unauthenticated network attackers can cause MySQL Router 26.7.0 to hang or repeatedly crash, resulting in complete denial of service for the routing tier. The CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with availability-only impact and no effect on confidentiality or integrity. No public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is reduced where Router listeners are firewalled from untrusted networks.

Unauthenticated remote takeover of Oracle E-Business Suite Workflow is possible in versions 12.2.3 through 12.2.15 via HTTP through the Workflow Notification Mailer component. Successful exploitation has a CVSS 3.1 base score of 10.0 with scope change, meaning confidentiality, integrity, and availability impact can extend beyond Workflow to additional products. No public exploit was identified at time of analysis and no KEV entry was provided.

Unauthenticated, network-reachable attackers can read and modify critical data in Oracle Product Workbench, the WebUI component of Oracle E-Business Suite, across versions 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no credentials or user interaction are required beyond HTTP reachability to the Product Workbench WebUI endpoint. At the time of analysis, no public exploit code has been identified and the issue is not listed in CISA KEV, but Oracle's 'easily exploitable' rating and the complete absence of an authentication prerequisite make internet-exposed EBS deployments a priority.

MySQL Server and MySQL Cluster in the 8.4, 9.7 and 26.7 branches (plus Cluster 8.0.x) ship a mysqldump client that can be subverted by an attacker-controlled, malicious, or man-in-the-middle MySQL endpoint, letting an attacker who can influence the server a victim dumps from take over the client host with full confidentiality, integrity and availability impact (CVSS 7.5, C:H/I:H/A:H). The trust boundary is inverted: the victim must actively launch mysqldump against the hostile endpoint, which is why Oracle scores it AC:H and UI:R despite no credentials being needed against the attacker's own endpoint (PR:N). No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unproven rather than observed.

Takeover of MySQL Server and MySQL Cluster is possible for unauthenticated network attackers able to reach the Server: Replication component, but Oracle rates the flaw difficult to exploit and success requires human interaction from a person other than the attacker. Affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. CVSS 3.1 scores it 7.5 with high confidentiality, integrity and availability impact; no public exploit identified at time of analysis and no CISA KEV entry appears in the provided intelligence.

Low-privileged users of Oracle Communications BRM - Elastic Charging Engine 15.2.0.0.0 can read and alter critical charging data through a flaw in the product's Security component reachable over TLS. The issue scores CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N): Oracle rates it easily exploitable once a low-privilege foothold exists, with high confidentiality and integrity impact and no availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update.

High-privilege users of Oracle MySQL Server and MySQL Cluster 26.7.0 through 26.7.1 can leverage a flaw in the Server: Optimizer component to take full control of the database instance, achieving complete compromise of confidentiality, integrity, and availability. The vulnerability is network-reachable and low-complexity (CVSS 3.1 base score 7.2, AV:N/AC:L/PR:H/UI:N), but is gated behind an existing administrative-level MySQL account, so realistic risk is concentrated in malicious-insider or post-credential-compromise scenarios rather than anonymous attack. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle has published a Critical Patch Update advisory covering the fix.

Oracle MySQL Server and MySQL Cluster are exposed to a high-severity integrity and availability flaw in the Server: JSON component, affecting MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. An authenticated low-privileged attacker with network access can use MySQL protocols to create, delete, or modify critical data, read a limited subset of data, and cause hangs or repeatable crashes, yielding CVSS 3.1 score 8.3. No public exploit was identified at time of analysis, and exploitation is constrained by the need for valid low-privileged database credentials.

Oracle MySQL Router 26.7.0 exposes an HTTPS-facing weakness (component Router: General) that can be attacked without credentials (PR:N, UI:N), letting a network-positioned adversary read and tamper with data the Router can reach - scored CVSS 7.4 with High confidentiality and integrity impact but no availability impact. Oracle characterizes exploitation as 'difficult' (AC:H), meaning success depends on timing, internal state, or non-default configuration rather than a single deterministic request, which tempers real-world risk despite the high impact rating. No public exploit code and no CISA KEV entry were identified at time of analysis, and no vendor fix version is documented in the available data beyond the October 2026 Oracle CPU reference.

Full takeover of MySQL Server and MySQL Cluster is possible for unauthenticated attackers who can reach the Group Replication communication segment, affecting MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The flaw is in the Server: Group Replication GCS component and yields high confidentiality, integrity and availability impact (CVSS 8.8, AV:A/AC:L/PR:N/UI:N). Exploitation is limited to deployments running Group Replication and to attackers on the adjacent physical communication segment; no public exploit was identified at time of analysis and CISA KEV status is not indicated.

Unauthenticated remote attackers can corrupt or destroy data and trigger repeatable crashes of MySQL Server and MySQL Cluster through the Server: Replication component, affecting Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 and Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle rates it 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H), explicitly calling it difficult to exploit, so success likely hinges on specific replication state, timing or race conditions rather than a single crafted request, and there is no confidentiality impact - the exposure is unauthorized creation, deletion or modification of critical data plus a hang or frequently repeatable full denial of service. No public exploit code or confirmed active exploitation was identified at time of analysis, and this is best treated as a genuine but second-tier priority concentrated on database nodes whose ports are network-reachable.

Unauthenticated attackers with access to the same layer-2 network segment as a MySQL Server or MySQL Cluster node running the Group Replication plugin can trigger a hang or frequently repeatable full crash (denial of service) and make limited unauthorized data changes, yielding a 7.1 CVSS score (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Exposure is narrow by design: the Group Replication plugin must be actively configured as part of a replication topology, which is not the default for standalone installations, and the attacker must sit on the adjacent broadcast domain or VLAN rather than reaching the host over the internet. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the practical risk is bounded far more by network adjacency and the non-default clustering configuration than by the raw score.

Unauthenticated, network-reachable attackers can potentially take over MySQL Server and MySQL Cluster through a high-complexity flaw in the 'Client programs' component, with full confidentiality, integrity, and availability impact. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; Oracle rates it difficult to exploit (AC:H) and no public exploit identified at time of analysis.

Takeover of Oracle MySQL Server and MySQL Cluster can result when a client program connects to an attacker-controlled, rogue, or intercepted MySQL endpoint, exploiting a difficult-to-trigger flaw in the client programs component. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. Oracle rates it CVSS 8.1 with high confidentiality, integrity, and availability impact; the vector requires network access with no privileges, and high attack complexity reflects the need for server impersonation or interception, with no public exploit identified at time of analysis.

Oracle MySQL Server and MySQL Cluster client programs (MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1) harbor a high-complexity flaw that an unauthenticated network attacker can use to achieve full confidentiality, integrity and availability impact on a MySQL client, amounting to takeover in the assessed scope. Exploitation is constrained because the victim client must connect to an attacker-controlled or attacker-influenced server endpoint over one of the supported protocols, and Oracle rates the issue 'difficult to exploit' (AC:H). No public exploit was identified at time of analysis and no CISA KEV entry is present; CVSS 3.1 base score is 8.1.

Denial of service and limited data access in MySQL Cluster 26.7.0 and 26.7.1 can be triggered by an unauthenticated attacker with TCP network access to the Cluster: General component. A successful attack can hang or repeatedly crash the cluster (complete availability loss) and expose or modify a subset of cluster-accessible data, with CVSS 3.1 score 7.0. The high attack complexity and the typical deployment of MySQL Cluster on segmented internal networks reduce practical exposure; no public exploit was identified at time of analysis.

MySQL Connector/J 26.7.0 can be fully compromised - confidentiality, integrity and availability - when a Java application using the driver processes a crafted or attacker-controlled response from the MySQL server endpoint it connects to, giving the attacker a path to take over the connector. Oracle scores this 8.1 but rates attack complexity High despite PR:N/UI:N, reflecting that the realistic precondition is attacker control of, or man-in-the-middle position on, the database endpoint rather than a direct hit on an internet-facing listener. No public exploit code and no CISA KEV entry were identified at time of analysis, and only version 26.7.0 is listed as affected, so upgrading removes exposure.

Unauthenticated remote attackers can take over Oracle Application Object Library, the core component of Oracle E-Business Suite 12.2.3 through 12.2.15, over HTTP with low complexity and no user interaction, yielding a CVSS 3.1 score of 9.8 with full confidentiality, integrity, and availability impact. The Oracle October 2026 Critical Patch Update advisory is the coordination point; no CISA KEV listing and no public exploit identified at time of analysis, and EPSS was not supplied. Exposure is highest for EBS web tiers reachable from untrusted networks; deployments restricted to trusted internal networks or VPN/WAF fronts have materially reduced attack surface.

Unauthenticated, network-reachable attacks against the BRM Server component of Oracle Communications Billing and Revenue Management 15.0.0.0.0 through 15.2.0.0.0 can read and modify critical billing data through the product's HTTP interface, a flaw Oracle rates as easily exploitable with CVSS 3.1 score 9.1 (C:H/I:H/A:N). The vector (AV:N/AC:L/PR:N/UI:N) means no credentials, user interaction, or special conditions are needed beyond network reachability of the HTTP interface; because BRM is typically a back-office telecom billing system, real-world risk hinges on whether that interface is exposed to an attacker-reachable segment. No CISA KEV listing or public exploit code was identified at time of analysis, and no EPSS score was provided, though the intrinsic severity and Oracle's 'easily exploitable' label warrant prompt patching.

Unauthenticated network attackers can take over Oracle Communications BRM Elastic Charging Engine 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 by reaching the Java RMI interface used in cloud-native deployments; CVSS 3.1 is 9.8 with high confidentiality, integrity, and availability impact and no privileges or user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was provided, so practical risk is driven mainly by whether the RMI listener is exposed beyond trusted telecom back-office/OSS-BSS networks.

Unauthenticated, remote attackers can read critical data from Oracle Communications Billing and Revenue Management (BRM) Server versions 15.0.0.0.0, 15.0.1.0.0.0, 15.1.0.0.0, and 15.2.0.0.0 over HTTP, with CVSS 3.1 score 7.5 driven solely by confidentiality impact. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates no credentials or user interaction are required, and there is no integrity or availability impact. No public exploit was identified at time of analysis, and no KEV or EPSS signal was supplied; real-world risk depends heavily on whether the BRM Server HTTP interface is reachable from untrusted networks.

Unauthenticated HTTP requests to Oracle BRM Server in Oracle Communications Billing and Revenue Management 15.0.0.0.0 through 15.2.0.0.0 can read critical billing data and make limited unauthorized changes, according to Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), so confidentiality is fully exposed while integrity impact is partial and availability is unaffected. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.

Local privilege escalation in Oracle E-Business Suite (Oracle Application Object Library, DB Privileges component) allows a low-privileged user who can log on to the infrastructure hosting the application to compromise the product and achieve takeover of it, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8). Affected releases are 12.2.3 through 12.2.15; the AV:L/PR:L/UI:N vector means a remote unauthenticated attacker cannot reach the flaw directly - the attacker must already hold valid low-privilege credentials plus interactive logon to the EBS host, which realistically limits exposure to insiders or intruders who have established an initial foothold. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible but not emergency-level patching priority.

Oracle Agile Engineering Data Management 6.2.1 contains a high-impact confidentiality and integrity flaw in its Install component that unauthenticated attackers can exploit only from an adjacent network segment, and only if a non-attacker user performs a triggering action. Successful exploitation could let an attacker create, delete, or modify critical data and read all EDM-accessible data, but the adjacent-network and user-interaction prerequisites keep real-world risk below the 7.3 CVSS score for most deployments. No public exploit code or confirmed active exploitation was identified at time of analysis.

Oracle Agile Engineering Data Management 6.2.1 contains an authenticated, high-complexity flaw in the Engineering Communication Interface that lets a low-privileged network attacker read or modify critical data, affect additional products through scope change, and cause partial denial of service. Exploitation requires a valid low-privileged account and HTTP access to the component; no public exploit identified at time of analysis. The CVSS 8.4 score reflects high confidentiality and integrity impact, but Oracle's 'difficult to exploit' rating and the authentication prerequisite reduce mass-exploitation risk.

Oracle Applications Manager, the diagnostics and management console bundled with Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by a low-privileged attacker who has network access to its HTTP interface. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is remote, low-complexity, requires no user interaction, and yields high confidentiality, integrity, and availability impact once a valid low-privilege EBS account is obtained. There is no public exploit code and no CISA KEV confirmation at time of analysis, but the low bar (PR:L, AC:L, UI:N) and the internal-facing nature of many Diagnostics deployments make this a high-priority patching item in the October 2026 Oracle Critical Patch Update.

Local, low-privileged attackers with logon access to the host running Oracle Agile Engineering Data Management 6.2.1 can exploit the Engineering Communication Interface to achieve full takeover of the product, with high impact to confidentiality, integrity, and availability. Exploitation requires authenticated local access and high attack complexity, which limits reliability, and no public exploit code has been identified at time of analysis. This is a high-severity but non-remote issue confined to version 6.2.1.

Unauthorized reads and modifications of critical Primavera Unifier data are possible for unauthenticated, network-positioned attackers in versions 21.12.0 through 21.12.17, though exploitation is rated high-complexity (AC:H) and depends on conditions outside the attacker's control. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impact with no availability impact. No public exploit identified at time of analysis; active exploitation is not confirmed.

Low-privileged authenticated users of Oracle Primavera Unifier 23.12.0 through 23.12.16 can create, delete, or modify critical Project Control data, and read a subset of application data, by sending HTTP requests to the Project Control component - no user interaction or special configuration is required. Scoring 7.1 on CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), the practical barrier is obtaining a valid low-privilege account rather than defeating authentication, which bounds exposure to instances reachable over the network with loosely controlled account provisioning. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; this is a genuine but mid-tier priority that warrants patching on the normal Oracle CPU cadence.

Takeover of Oracle Agile PLM 9.3.6 is possible through its Application Server component, where an unauthenticated network attacker who persuades a legitimate user to interact with crafted HTTP content can achieve high confidentiality, integrity, and availability impact. Oracle rates this 7.5 (High) with CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, and the high attack complexity plus required user interaction make automated mass exploitation unlikely. No public exploit has been identified at time of analysis.

Oracle Payroll, as shipped within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by an attacker who already holds a low-privilege account on the EBS instance and can reach the Payroll 'Internal Operations' component over HTTP, with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 7.5). The high attack complexity rating (AC:H) reflects Oracle's assessment that exploitation is difficult and depends on non-default timing, server state, or configuration preconditions, so it is not reliably repeatable against an arbitrary target. The authentication prerequisite (PR:L) rules out anonymous attackers, and no public exploit code has been identified at time of analysis - this is not a CISA KEV entry and does not appear to be under confirmed active exploitation, placing it in a second-tier remediation priority behind internet-exposed, unauthenticated flaws.

Takeover of the Oracle Payroll component within Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for low-privileged attackers who already hold a valid EBS account and can reach the Internal Operations component over HTTP. Successful exploitation yields high confidentiality, integrity, and availability impact (CVSS 3.1 base score 7.5), but Oracle rates the flaw difficult to exploit because attack complexity is high and specific preconditions must align. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update.

Unauthenticated, remote exploitation of the Oracle Concurrent Processing component in Oracle E-Business Suite 12.2.3 through 12.2.15 can expose and corrupt critical application data, with high confidentiality and integrity impact but no availability impact. Oracle characterizes the flaw as difficult to exploit (CVSS:3.1 AV:N/AC:H/PR:N/UI:N, base score 7.4) because success depends on conditions outside the attacker's control, such as a specific application state or timing, rather than a single deterministic HTTP request. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied, so triage priority should be driven mainly by whether the EBS web tier is reachable from untrusted networks.

Local compromise of Oracle Concurrent Processing in Oracle E-Business Suite 12.2.3 through 12.2.15 requires an attacker who already has high-privilege logon access to the infrastructure where the component runs, but successful exploitation can take over Concurrent Processing and, through scope change, significantly impact additional EBS products. The issue is context-dependent and moderate priority rather than a mass-exploitation threat; no public exploit was identified at time of analysis, and exploitation is not remotely or anonymously reachable.

Authenticated takeover of the Pasta component in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged user who already holds a valid account and can reach the Internal Operations HTTP interface, although Oracle rates the attack as difficult to carry out (CVSS 3.1 base score 7.5, AV:N/AC:H/PR:L/UI:N). Successful exploitation fully compromises confidentiality, integrity, and availability of the Pasta component, but the AC:H rating means success depends on non-trivial preconditions such as specific application state, timing, or a particular configuration rather than a single straightforward request. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and the mandatory authentication gate makes opportunistic internet-wide scanning and exploitation improbable.

Unauthenticated remote takeover of the Oracle Application Object Library Core component is possible in Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP, carrying a CVSS 3.1 base score of 8.1 for full confidentiality, integrity and availability impact. Oracle characterizes the flaw as difficult to exploit (AC:H), meaning the attacker must satisfy preconditions outside their direct control rather than sending a single reliable request, but no privileges or user interaction are needed once those conditions are met. No public exploit code has been identified at time of analysis and the issue has not been confirmed actively exploited (no CISA KEV entry); EPSS scoring was not provided, so prioritization should rest on the high impact of a full AOL compromise combined with the exposure of internet-facing EBS web tiers.

Oracle One-to-One Fulfillment 12.2.3 through 12.2.15 can be taken over by an authenticated low-privileged attacker with network access to the Documents component, resulting in full confidentiality, integrity, and availability impact. Exploitation is rated difficult (AC:H) and requires valid credentials (PR:L), so opportunistic attacks are unlikely; no public exploit code or CISA KEV entry was identified at time of analysis. Signals lean toward a moderate, not urgent, priority.

Oracle One-to-One Fulfillment in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes a Java Server Issues flaw that a low-privileged, network-positioned attacker could use to take over the component, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.5). Exploitation is rated difficult (AC:H) and requires an authenticated low-privileged account plus HTTP access; no public exploit identified at time of analysis. Oracle's October 2026 Critical Patch Update is the referenced remediation source.

High-privileged attackers with network access to the Oracle Mobile Field Service Admin UI can fully compromise the component - reading and altering data and disrupting availability - across Oracle E-Business Suite versions 12.2.3 through 12.2.15. Exploitation requires an already-authenticated administrative account (CVSS PR:H) and HTTPS access, but no user interaction and low attack complexity, so the practical threat is primarily from malicious insiders or attackers who have first stolen admin credentials. No public exploit code has been identified and the issue is not in CISA KEV; Oracle addressed it in the October 2026 Critical Patch Update.

Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes the Admin UI to a low-privileged authenticated network attacker over HTTP, allowing takeover of the module with high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires valid application credentials and reachability of the Admin UI endpoint; it is not remote-unauthenticated, and deployments without the module are not exposed. No public exploit code was identified at time of analysis.

Unauthenticated HTTP access to the Oracle E-Business Suite Integrated SOA Gateway can expose critical data and permit limited unauthorized data changes in EBS 12.2.3 through 12.2.15, because the SOA Provider component does not adequately enforce access controls. The issue is an authentication bypass rated CVSS 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), so where the optional gateway is deployed and reachable, default configurations are remotely exploitable without credentials or user interaction. No public exploit identified at time of analysis; practical risk is driven by whether the gateway is enabled and network-exposed.

Sensitive data exposure in Oracle E-Business Suite Integrated SOA Gateway 12.2.3 through 12.2.15 allows a low-privileged authenticated remote attacker to read critical data accessible through the SOA Provider component, with a scope change that can affect additional products. The issue is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and is easily exploitable once the gateway is deployed and reachable over HTTP. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.

Oracle E-Business Suite Integrated SOA Gateway releases 12.2.3 through 12.2.15 expose the SOA Provider component to unauthenticated HTTP requests, allowing an attacker with network reachability to read critical data and potentially reach all data accessible through the gateway. The CVSS 3.1 score of 8.6 reflects a scope-changing, confidentiality-only impact (C:H/I:N/A:N) reachable without credentials or user interaction (AV:N/AC:L/PR:N/UI:N/S:C); no public exploit code or confirmed active exploitation was identified at time of analysis. Risk is driven primarily by exposure - only deployments whose SOA Gateway endpoint is reachable from the attacker's network position are at risk.

Full compromise of the Integrated SOA Gateway - including confidentiality, integrity and availability of the SOA Provider component - is possible in Oracle E-Business Suite 12.2.3 through 12.2.15 by a low-privileged user who already holds a valid EBS account and can reach the gateway over HTTP. Oracle rates the flaw as 'difficult to exploit' (CVSS 3.1 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning conditions outside the attacker's control must align before a successful takeover, and no public exploit code or confirmed active exploitation was identified at time of analysis. The authentication prerequisite and high attack complexity are the main constraints defenders can rely on, so the practical priority is patching on the October 2026 CPU cycle rather than emergency response.

Authenticated low-privilege users can compromise and take over Oracle E-Business Suite Integrated SOA Gateway 12.2.3 through 12.2.15 over HTTP, with high confidentiality, integrity, and availability impact per CVSS 3.1 score 8.8. The assessed vector requires a valid low-privilege EBS account and reachable SOA Provider component, so fully anonymous attackers cannot exploit it. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's October 2026 CPU advisory provides the remediation path.

Oracle E-Business Suite Integrated SOA Gateway versions 12.2.3 through 12.2.15 contain a high-severity flaw in the SOA Provider component that allows a low-privileged, authenticated attacker with HTTP network access to take over the affected gateway. Successful exploitation can fully compromise confidentiality, integrity, and availability of the Integrated SOA Gateway (CVSS 8.8). No public exploit code or confirmed active exploitation was identified at time of analysis; exposure is limited to EBS deployments that enable and expose the Integrated SOA Gateway.

A high-severity flaw in Oracle E-Business Suite Integrated SOA Gateway (Internal Operations) 12.2.3 through 12.2.15 allows a low-privileged, network-positioned attacker using HTTP to read and modify critical data and cause partial denial of service. CVSS 3.1 is 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), so a valid low-privilege account and a reachable Gateway endpoint are required - the 'Authentication Bypass' tag should not be read as fully unauthenticated access. No CISA KEV listing was present, and no public exploit identified at time of analysis; Oracle's October 2026 Critical Patch Update advisory is the referenced fix source.

Local privilege escalation in Oracle Applications DBA (the AD Utilities component of Oracle E-Business Suite) affects versions 12.2.3 through 12.2.15 and lets a low-privileged user who already holds an interactive logon on the database/application tier host elevate to full control of the Applications DBA tooling, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.0). Exploitation is gated: the vector is AV:L/AC:H/PR:L/UI:N, so the attacker must first obtain a local account on the infrastructure where AD Utilities runs and must satisfy conditions Oracle describes as 'difficult to exploit', making this primarily an insider or post-compromise escalation risk rather than an external attack path. No public exploit code and no confirmed active exploitation were identified at time of analysis.

Local compromise of the Applications DBA (AD Utilities) component in Oracle E-Business Suite 12.2.3 through 12.2.15 can let an attacker who already has logon access to the EBS host seize control of the Applications DBA component, with high confidentiality, integrity and availability impact (CVSS 3.1 base score 7.8). No authentication to the E-Business Suite application itself is needed (PR:N), but the attack is local (AV:L) and requires a separate privileged user such as a DBA to perform an action (UI:R), so the practical exposure is limited to hosts with multi-user interactive access. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; no EPSS score was supplied in the available data.

Local privilege escalation in Oracle E-Business Suite Applications DBA (AD Utilities) versions 12.2.3 through 12.2.15 allows an attacker who already has a low-privileged logon on the host to take over the Applications DBA component, with high confidentiality, integrity, and availability impact. Exploitation is rated difficult (AC:H) and requires authenticated local access (PR:L) with no user interaction; no public exploit identified at time of analysis.

Unauthenticated network attackers can read and modify critical data in Oracle Communications Billing and Revenue Management 15.x through the Platform component's TLS interface, but Oracle rates the issue difficult to exploit because success depends on high-complexity preconditions (AC:H). The flaw affects 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 with CVSS 3.1 score 7.4 (C:H/I:H/A:N); no public exploit identified at time of analysis. Internet-facing BRM Platform TLS endpoints are the primary risk multiplier.

Unauthenticated remote attackers can crash or repeatedly hang Oracle MySQL Server and MySQL Cluster through network-accessible protocol interactions, causing a complete denial of service. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. CVSS 3.1 score is 7.5 with availability-only impact; no public exploit was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the vendor patch reference.

Takeover of Oracle Concurrent Processing is possible for any low-privileged user who can log on to the Oracle E-Business Suite application tier, affecting versions 12.2.3 through 12.2.15. The CVSS 3.1 vector (AV:L/PR:L/UI:N, C:H/I:H/A:H) confirms the flaw is local rather than network-reachable: an attacker must already hold a valid low-privileged account on the host running Concurrent Processing, after which no user interaction is needed and the component's confidentiality, integrity, and availability are fully compromised. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle has addressed the issue in its October 2026 Critical Patch Update, so exposure is limited to unpatched systems and realistic risk is concentrated on insiders or attackers performing post-compromise lateral movement within the EBS environment.

Unauthenticated network attackers can achieve full takeover of the Oracle Call Center Technology component in Oracle E-Business Suite 12.2.3 through 12.2.15 by reaching its RMI-based Internal Operations service. Oracle rates exploitation as difficult (AC:H) because success depends on server-side conditions outside the attacker's control, but a successful attack yields complete confidentiality, integrity, and availability loss. No public exploit code or CISA KEV entry was identified at time of analysis, and real-world risk is driven mainly by whether the RMI ports are reachable from untrusted networks.

Authenticated low-privilege users can read and modify critical data in Oracle Mobile Field Service, part of Oracle E-Business Suite 12.2.3-12.2.15, through the Admin UI over HTTP. The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) confirms network reachability, low attack complexity, and no user interaction, but it is not pre-authentication because a valid low-privilege account is required. No public exploit identified at time of analysis and the CVE is not in CISA KEV.

Authenticated low-privilege users can take over Oracle Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15 by sending crafted HTTP requests, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 8.8 because a single valid low-privilege account yields full confidentiality, integrity, and availability impact on the component. No user interaction and no non-default configuration are required, so the practical barrier is holding or obtaining any valid EBS account; risk rises sharply where the EBS login interface is internet-exposed or low-privilege accounts are numerous or easily obtained. No public exploit code or CISA KEV entry was identified at time of analysis, but this remains a genuine high priority for organizations running the affected E-Business Suite releases.

An authenticated low-privileged user with HTTP network access to the Oracle Mobile Field Service Admin UI in Oracle E-Business Suite 12.2.3 through 12.2.15 can escalate beyond their intended permissions, gaining the ability to create, delete or modify critical data and to read a subset of otherwise restricted data (CVSS 3.1 base score 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N). The flaw is easy to trigger once an attacker holds any valid low-privilege EBS account, but that authentication prerequisite is the main limiting factor, and exposure is largely determined by whether the Admin UI is reachable from untrusted networks. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; Oracle addresses the issue through its Critical Patch Update of October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), and EUVD (EUVD-2026-106067) corroborates the 12.2.3-12.2.15 affected range.

Unauthenticated network attackers can read and modify critical data in Oracle Mobile Field Service (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 through the Admin UI over HTTP, with no user interaction required. Oracle rates attack complexity as high ("difficult to exploit"), indicating specific preconditions constrain reliable exploitation. No public exploit identified at time of analysis.

Unauthenticated data disclosure in the Oracle Mobile Field Service Admin UI component of Oracle E-Business Suite 12.2.3 through 12.2.15 allows any attacker who can reach the HTTP interface to read critical data without credentials or user interaction. Oracle rates it 7.5 (High) with a confidentiality-only profile (C:H, I:N, A:N), so exploitation yields data exposure rather than modification or disruption, and the practical exposure depends almost entirely on whether the Admin UI is internet-facing or segmented. No public exploit code or confirmed active exploitation was identified at time of analysis; Oracle's October 2026 CPU advisory is the reference for fixes.

Unauthenticated network attackers can read and modify critical data in Oracle Mobile Field Service, the field-service module of Oracle E-Business Suite 12.2.3 through 12.2.15, by targeting the Admin UI over HTTP. Oracle rates the issue CVSS 3.1 7.4 with high confidentiality and integrity impact, but attack complexity is high, meaning successful exploitation depends on conditions outside the attacker's control. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is concentrated on internet-reachable EBS instances that actually deploy this module.

Oracle E-Business Suite Mobile Field Service 12.2.3 through 12.2.15 is exposed to takeover through its Internal Operations component by an authenticated, low-privileged attacker with HTTPS network access; the CVSS 3.1 score is 8.8 with high confidentiality, integrity and availability impact and no user interaction. Exploitation requires valid credentials but no special configuration, and no public exploit was identified at time of analysis. Organizations running the listed EBS releases should treat this as high priority because a low-privileged account can compromise the product's confidentiality, integrity and availability.

Application takeover in Oracle Mobile Field Service, the field-service module of Oracle E-Business Suite 12.2.3 through 12.2.15, is achievable over HTTP by any attacker who already holds a low-privilege application account. Because no user interaction is required, attack complexity is low, and the vector leaves scope unchanged while scoring high across confidentiality, integrity and availability (CVSS 3.1 base 8.8), a single compromised technician or contractor login is enough to pivot into full control of the module rather than a narrow data leak. Exploitation-signal data is thin: the issue is not in CISA KEV, no public exploit code has been identified at time of analysis, and no EPSS score was supplied, so priority should be driven by the technical profile and by whether the module is actually deployed - the authentication prerequisite is the main limiting factor, while the prevalence of low-privilege EBS accounts is the main aggravating one.

Oracle Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated low-privileged attacker with network access via HTTPS to compromise the application, leading to full takeover with high confidentiality, integrity, and availability impact. The vulnerability is easily exploitable (CVSS 8.8) but requires a valid low-privileged account; no public exploit code has been identified at time of analysis.

Authenticated low-privileged users can fully compromise Oracle Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15, achieving high confidentiality, integrity, and availability impact (CVSS 8.8, AV:N/PR:L, no user interaction). The flaw resides in the Internal Operations component and is reachable over HTTPS, so only EBS deployments that actually run Mobile Field Service are exposed. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, but low attack complexity combined with the existing-credential requirement makes this a realistic privilege-escalation path for an insider or a compromised low-privileged account.

Authenticated low-privileged users can corrupt or delete critical data in Oracle Partner Management, a module of Oracle E-Business Suite, across versions 12.2.3 through 12.2.15 by sending crafted HTTP requests to the Internal Operations component. Successful exploitation yields high integrity impact plus a partial denial of service, while confidentiality is unaffected (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the flaw through its October 2026 Critical Patch Update, so this is a routine-but-important patch item rather than an emergency.

Oracle Partner Management, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes an integrity and partial availability flaw in its Internal Operations component that a low-privileged authenticated user can reach over HTTPS. Successful exploitation lets that account create, delete, or modify critical Partner Management data and trigger a partial denial of service, with no user interaction and low attack complexity once a valid session is held. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a credible mid-tier priority for EBS deployments rather than an emergency - the main gate is possession of valid low-privileged credentials.

Authenticated low-privileged users with HTTP access to Oracle Partner Management can read, create, delete or modify critical data and cause a partial denial of service across Oracle E-Business Suite 12.2.3 through 12.2.15, with the scope-change rating (S:C) meaning the impact can extend beyond Partner Management into other EBS products (CVSS 3.1 base score 8.4: C:H/I:H/A:L). Oracle rates the flaw as difficult to exploit because success depends on conditions or timing the attacker does not fully control (AC:H), and no public exploit code or active exploitation has been identified at time of analysis. The practical limiting factors are the requirement for valid low-privilege credentials (PR:L) and network reachability to a deployed Partner Management / Internal Operations component; no user interaction is needed (UI:N).

Takeover of Oracle iSetup is possible for a low-privileged authenticated attacker who can reach the General Ledger Update Transform and Reports component over HTTP in Oracle E-Business Suite 12.2.3 through 12.2.15. The 7.5 CVSS score reflects high confidentiality, integrity, and availability impact, but the high attack-complexity metric means attacker-uncontrollable preconditions must be satisfied; no public exploit code was identified at time of analysis and CISA KEV does not list it. Only EBS deployments running the iSetup module on the stated versions are affected.

Takeover of Oracle iSetup within Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for an attacker who already holds high application privileges and can reach the iSetup web interface over HTTP. The issue is rated CVSS 7.2 with high confidentiality, integrity, and availability impact, but the PR:H precondition substantially narrows the realistic attacker population. No public exploit code or confirmed active exploitation is identified in the available data.

Full compromise of Oracle iSetup - high confidentiality, integrity and availability impact - is achievable by a low-privileged, authenticated attacker who can reach the General Ledger Update Transform and Reports functionality over HTTP, with Oracle E-Business Suite 12.2.3 through 12.2.15 affected. Oracle rates exploitation as difficult (AC:H), meaning success depends on conditions outside the attacker's control such as a specific component state, timing window, or configuration, which materially narrows practical risk despite the 7.5 base score. No public exploit code or active exploitation was identified at time of analysis, and no EPSS score or CISA KEV listing was supplied, so this should be treated as a high-impact but opportunistic-targeting concern rather than an emergency patch-now event.

Authenticated, low-privileged users of Oracle Report Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 can read all data reachable by the component and partially degrade its availability by sending HTTPS requests against the Internal Operations component. Oracle rates this 7.1 (C:H/I:N/A:L) with low attack complexity and no user interaction, so the practical barrier is the requirement for a valid EBS/Report Manager login rather than any technical complexity. No public exploit code or CISA KEV entry was identified at time of analysis, and the supplied data contains no EPSS score.

Unauthenticated HTTP access to the Audience component of Oracle Marketing in Oracle E-Business Suite 12.2.3 through 12.2.15 can let a remote attacker read all Oracle Marketing-accessible data and modify some of it, with no privileges or user interaction required. Oracle rates the issue 8.2 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N); exposure depends on the Marketing module being installed and its HTTP endpoints being reachable. Exploitation status at time of analysis: no public exploit identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory provides the vendor remediation.

Oracle E-Business Suite Applications DBA (AD Utilities) versions 12.2.3 through 12.2.15 can be taken over by a low-privileged attacker who already has local logon access to the infrastructure where the component runs and can induce a different person-typically an administrator or operator-to perform an action involving attacker-influenced input. Successful exploitation gives high confidentiality, integrity, and availability impact, and the CVSS 3.1 base score is 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and the local vector plus required human interaction limit realistic exposure to insider or post-compromise scenarios.

Unauthenticated network attackers can read and modify critical data in Oracle Mobile Field Service within Oracle E-Business Suite 12.2.3 through 12.2.15 through the Admin UI, but exploitation is rated difficult because high attack complexity means success depends on server-state or environmental conditions outside the attacker's direct control. Oracle's October 2026 Critical Patch Update references remediation, and no public exploit code or CISA KEV entry was identified at time of analysis.

Authenticated low-privileged attackers can achieve takeover of Oracle Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15 by reaching the Internal Operations component over HTTP. The flaw is remotely exploitable with low complexity and no user interaction, yielding high confidentiality, integrity, and availability impact; it requires a valid low-privileged account (PR:L) rather than anonymous access. No public exploit identified at time of analysis, and no CISA KEV entry is present in the provided intelligence; Oracle addresses the issue in its October 2026 Critical Patch Update.

Critical data disclosure and denial of service in Oracle Mobile Field Service (Oracle E-Business Suite 12.2.3 through 12.2.15) allow unauthenticated network attackers to read sensitive application data and cause a hang or frequently repeatable crash via crafted HTTP requests. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), reflecting complete confidentiality and availability impact with no integrity impact. No public exploit code or confirmed active exploitation was identified at time of analysis.