Authentication Bypass

Oracle VM VirtualBox 7.2.14 Core component allows a high-privileged local attacker to trigger a complete denial-of-service condition - causing a hang or frequently repeatable crash of the hypervisor - with a confirmed scope change that can significantly impact additional products beyond VirtualBox itself, likely the host operating system or co-resident guest VMs. The vulnerability is exploitable by an attacker with administrator-level access already present on the host infrastructure, making it most relevant in multi-tenant or shared virtualization environments where privileged-but-not-hypervisor-owner threat actors are a realistic model. No public exploit code or CISA KEV listing has been identified at time of analysis.

Oracle VM VirtualBox 7.2.14 contains a locally exploitable flaw in its Core component that grants high-privileged local attackers partial read, write, and denial-of-service capabilities, with a confirmed scope change meaning the impact can extend to products or components beyond VirtualBox itself. The vulnerability is described as 'easily exploitable' by Oracle, though the high privilege and local access requirements substantially constrain the realistic attacker pool. No public exploit code or CISA KEV listing has been identified at time of analysis.

Oracle VM VirtualBox 7.2.14 Core component exposes a local confidentiality vulnerability enabling a high-privileged attacker with local infrastructure access to read critical data across VM isolation boundaries, with confirmed scope change indicating potential host or cross-VM data exposure. The CVSS vector (AV:L/AC:H/PR:H/S:C/C:H/I:N/A:N) reflects a narrow but impactful attack path constrained by high complexity and privilege prerequisites. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, placing it in a low-urgency tier for most environments despite the high confidentiality impact when scope change is considered.

Oracle VM VirtualBox 7.2.14 Core component exposes a locally exploitable denial-of-service condition that can be triggered by a high-privileged attacker with logon access to the host infrastructure. Exploitation results in a complete, repeatably triggerable crash or hang of the VirtualBox process, with scope change indicated - meaning the disruption can cascade to guest virtual machines and other co-hosted workloads. No public exploit code exists and no active exploitation has been identified at time of analysis.

Partial denial-of-service exposure in Oracle Access Manager's Authorization Engine affects supported versions 12.2.1.4.0 and 14.1.2.1.0, reachable by any low-privileged network user over TCP. An authenticated attacker with minimal account privileges can disrupt availability of the Authorization Engine, potentially interrupting access-control decisions for applications federated through OAM. No public exploit code has been identified at time of analysis, and impact is bounded to partial availability degradation with no confidentiality or integrity exposure.

Unauthenticated network exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 enables remote attackers to perform unauthorized data manipulation and cause partial denial of service via HTTP against the Security component. The vulnerability requires no credentials and no user interaction, making it trivially accessible to any attacker with network reach to the application. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis; however, the unauthenticated, network-accessible attack surface warrants prompt patching.

Denial-of-service in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-adjacent attacker to cause the application to hang or crash repeatedly via crafted HTTP requests targeting the Security component. The flaw is rated Medium (CVSS 5.3) due to high attack complexity, meaning exploitation requires specific conditions to be met beyond simply having network access. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.

Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged attacker with local logon access to the host infrastructure, exploiting a flaw in the Security component under conditions of high attack complexity. Despite a moderate CVSS base score of 6.4 - dampened by strict access prerequisites - successful exploitation yields complete confidentiality, integrity, and availability compromise of the application. No public exploit code or active exploitation has been identified at time of analysis.

Oracle Hyperion Financial Management version 11.2.25.0.000 exposes an authentication bypass in its Security component that permits unauthenticated network attackers to perform limited unauthorized read and write operations on accessible financial data via HTTP. The attack is classified as difficult to exploit (AC:H), constraining realistic risk despite the absence of any authentication requirement. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed through Oracle's Critical Security Patch Update for August 2026.

Oracle VM VirtualBox 7.2.14 Core component contains a vulnerability that allows a high-privileged local attacker to breach VM isolation boundaries and access all confidential data accessible to VirtualBox, including data from guest virtual machines. The CVSS scope-change metric (S:C) confirms that successful exploitation extends impact beyond the VirtualBox process itself, enabling unauthorized read access to critical data across VM boundaries. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the EUVD 'Authentication Bypass' tag suggests the vulnerability may undermine guest-level authentication or isolation enforcement mechanisms.

Confidentiality compromise in Oracle VM VirtualBox 7.2.14 Core component allows a locally authenticated, high-privileged attacker to access all data reachable by the VirtualBox process and breach isolation boundaries to impact additional products via scope change. The 'Authentication Bypass' tag supplied by the reporter suggests an internal access-control bypass within VirtualBox's security model that extends an attacker's data reach beyond their normally authorized scope. No public exploit code or active exploitation has been confirmed at time of analysis.

Full takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged local attacker targeting the Security component, resulting in complete compromise of confidentiality, integrity, and availability. The attack requires logon access to the infrastructure host where the application runs, limiting exposure to insider threats or attackers who have already established a foothold with elevated privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the local-only attack vector substantially constrains real-world risk despite the full CIA impact.

Confidentiality breach in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible within the application via HTTP, including sensitive financial consolidation records. The vulnerability resides in the Security component and carries an 'Authentication Bypass' classification, suggesting improper enforcement of authorization controls that permits privilege escalation beyond the attacker's intended access level. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high attack complexity requirement indicates exploitation demands specific environmental or application-state conditions.

Local denial-of-service in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged attacker with logon access to the hosting infrastructure to hang or repeatedly crash the application via its Security component. The CVSS vector confirms this is a local, high-complexity attack with no confidentiality or integrity impact - purely an availability concern. No public exploit code and no CISA KEV listing exist at time of analysis, and the combination of local access requirement and high attack complexity substantially limits opportunistic exploitation.

Partial unauthorized data access and service disruption in Oracle Hyperion Financial Management 11.2.25.0.000 can be achieved by low-privileged, network-accessible attackers via HTTP targeting the Security component. Exploitation allows unauthorized read of a subset of application data, unauthorized update or insert of accessible data, and partial denial of service - all without user interaction. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.

Unauthenticated network exposure in Oracle Database Server's RDBMS component allows remote attackers to read a subset of database-accessible data via Oracle Net without any credentials. Affected across three major release trains - 19c (19.3-19.32), 21c (21.3-21.23), and 23ai (23.4.0-23.26.3) - the flaw is tagged as an authentication bypass, suggesting the Oracle Net listener or a pre-auth code path fails to enforce access controls before returning data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to attempt at scale.

SQL-based exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 enables a high-privileged authenticated attacker to achieve complete read and write access to all financial data within the application. The Security component - the logical gatekeeper for data authorization - is the attack surface, and successful exploitation grants unauthorized creation, deletion, modification, and disclosure of critical financial records. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the 'Authentication Bypass' tag warrants scrutiny given the contradiction with the PR:H CVSS metric (see risk assessment).

Hyperion Financial Management version 11.2.25.0.000 exposes authenticated low-privileged network attackers to a tri-impact vulnerability in its Security component: complete, repeatable denial of service via application hang or crash, limited unauthorized data modification, and partial unauthorized data disclosure. Exploitation requires a valid low-privileged account, HTTP network access, and conditions of high attack complexity - factors that collectively reduce the likelihood of opportunistic or automated attack. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.

Local information disclosure in Oracle Agile PLM MCAD Connector 3.6 exposes a subset of PLM-accessible data to unauthenticated local attackers exploiting an authentication bypass in the CAX Client component. Exploitation is gated by two significant constraints: the attacker must have local logon access to the infrastructure hosting the connector, and a separate legitimate user must interact with the application during the attack window. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, consistent with the low CVSS 3.1 base score of 3.3.

Unauthorized data disclosure in Oracle Agile PLM MCAD Connector 3.6 allows a low-privileged network attacker to gain complete read access to all data accessible by the CAX Client component via a complex HTTP-based attack requiring victim user interaction. The vulnerability is tagged as an authentication bypass, suggesting the CAX Client component fails to enforce authorization boundaries for a subset of data operations when specific, difficult-to-reproduce conditions are met. No public exploit code or CISA KEV listing exists at time of analysis, and the high attack complexity meaningfully limits opportunistic exploitation.

Unauthorized access to all data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged remote attacker exploiting a flaw in the Security component over HTTP. The vulnerability results in complete confidentiality compromise - an attacker can read all data accessible to the application, including sensitive financial consolidation records. No public exploit has been identified at time of analysis, and exploitation is bounded by the requirement for high-privilege credentials, though the 'Authentication Bypass' tag suggests established access may allow security control circumvention beyond the attacker's normal authorization scope.

Local exploitation of MySQL Connector/ODBC 26.7.0 on Oracle MySQL allows any user with OS-level logon to the affected infrastructure to crash or hang the connector process and read a subset of accessible data. The attack requires no authentication to MySQL Connectors itself and no user interaction, making it trivially executable by any local user or process on the host. No public exploit code has been identified at time of analysis, and exploitation is bounded by the requirement for local system access.

Limited confidentiality exposure in Oracle Agile PLM MCAD Connector 3.6 allows a high-privileged local attacker to read a subset of accessible data under constrained conditions. The CVSS 3.1 base score of 1.8 reflects a worst-case scenario requiring local infrastructure access, high privileges, high attack complexity, and mandatory third-party human interaction - a combination rarely satisfied in practice. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world risk is negligible for organizations maintaining least-privilege controls on the host infrastructure.

Local information disclosure in Oracle Agile PLM MCAD Connector version 3.6 allows a low-privileged, locally authenticated attacker to read a subset of data accessible to the CAX Client component under high-complexity exploitation conditions. Reported by Oracle Security (secalert_us@oracle.com) as part of the August 2026 Critical Patch Update and tracked under ENISA EUVD-2026-62027, this vulnerability carries a CVSS 3.1 base score of 2.5, reflecting strictly limited confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed.

Local integrity compromise in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) requires an attacker with high privileges and physical or logical logon access to the host infrastructure, under high-complexity conditions, to perform unauthorized data modification against accessible records. The attack yields only limited integrity impact - no confidentiality or availability loss - and no public exploit code or active exploitation has been identified at time of analysis. Notably, the 'Authentication Bypass' tag applied by the reporter conflicts with the PR:H CVSS vector, and this discrepancy is unresolved by available data.

Limited data exposure in Oracle Agile PLM MCAD Connector version 3.6 allows an unauthenticated attacker with access to the same physical network segment as the target host to partially read and modify application data. Exploitation is constrained by adjacent-only network access, high attack complexity, and a mandatory human-interaction requirement, resulting in a low CVSS 3.1 base score of 3.7. No public exploit code or active exploitation has been identified at time of analysis.

Network-exploitable denial-of-service in Oracle MySQL Connector/ODBC 26.7.0 allows low-privileged authenticated attackers to cause a complete hang or repeatable crash of the connector via multiple protocols. Oracle characterizes this as easily exploitable, consistent with the low-complexity, low-privilege CVSS vector (AV:N/AC:L/PR:L). No public exploit code or active exploitation has been identified at time of analysis, though the availability impact is rated High with no confidentiality or integrity exposure.

Oracle Agile PLM MCAD Connector version 3.6 exposes a local, privilege-dependent attack path through its CAX Client component, enabling a low-privileged authenticated local attacker to partially compromise data confidentiality, integrity, and availability within the PLM environment. Exploitation is constrained by a mandatory human-interaction requirement and high attack complexity, making opportunistic or remote exploitation infeasible. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog; the vendor-assigned CVSS 3.1 score of 4.2 reflects the limited blast radius.

Confidentiality compromise in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) allows an unauthenticated attacker with physical access to the local network segment to gain unauthorized access to all data accessible by the connector. The attack is adjacent-network and high-complexity, limiting realistic exposure to insider threats or attackers with pre-existing physical network presence. No public exploit code exists and no active exploitation has been confirmed; CVSS 5.3 reflects the constrained attack vector. The 'Authentication Bypass' tag suggests the vulnerability circumvents a credential or session-validation mechanism within the CAX Client, enabling direct data exposure without credential theft.

Unauthenticated network access to Oracle Agile PLM MCAD Connector 3.6 exposes a subset of data managed by the CAX Client component over plain HTTP, with no privileges or user interaction required. Classified as an authentication bypass (EUVD-2026-62021) and described as 'easily exploitable' in Oracle's CSPU August 2026 advisory, this vulnerability carries a CVSS 3.1 score of 5.3 with purely confidentiality impact and no integrity or availability risk. No public exploit code or active exploitation has been identified at time of analysis.

Authentication bypass in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) exposes critical PLM data to unauthenticated attackers who have physical adjacency to the network segment where the connector hardware operates. The vulnerability enables unauthorized read access to all connector-accessible data and limited write access, scored CVSS 5.9 Medium due to the adjacent-network attack vector and high complexity constraints. No public exploit code or CISA KEV listing has been identified at time of analysis.

Local low-privileged access to Oracle Agile PLM MCAD Connector 3.6 enables an authenticated attacker to partially degrade availability of the CAX Client component. Oracle's August 2026 Critical Patch Update (CPU) documents this as easily exploitable by any user with a logon to the host infrastructure, resulting in partial denial of service with no confidentiality or integrity impact. No public exploit identified at time of analysis, and CISA KEV listing is absent, placing this firmly in the low-urgency category.

Partial authentication bypass in Oracle Agile PLM MCAD Connector 3.6 exposes confidentiality and integrity of accessible PLM data to low-privileged adjacent-network attackers. The CAX Client component fails to properly restrict data operations, allowing an attacker on the same physical network segment with low-level credentials to read a subset of accessible records and perform unauthorized insert, update, or delete operations. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.

Unauthorized data disclosure in Oracle Agile PLM MCAD Connector 3.6 allows any low-privileged authenticated attacker with HTTP network access to bypass authorization controls in the CAX Client component and read the entire dataset accessible to the connector. The vulnerability is tagged Authentication Bypass, indicating that after obtaining a minimal credential foothold, no additional privilege escalation is needed to access critical PLM data such as engineering designs and product specifications. Oracle's own advisory characterizes the flaw as 'easily exploitable,' and no public exploit code or CISA KEV listing has been identified at time of analysis.

Local exploitation of Oracle Agile PLM MCAD Connector version 3.6 enables an unauthenticated attacker with infrastructure-level logon to partially compromise the CAX Client component, resulting in limited unauthorized read, write, and denial-of-service impact. Exploitation is constrained by both high attack complexity and a mandatory human interaction requirement from a third party, making opportunistic attacks unlikely. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Unauthorized confidential data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 exposes complete application-accessible data to a network-based attacker already holding high-level privileges, exploiting a flaw within the Security component via HTTP. EUVD metadata tags this as an Authentication Bypass, suggesting an access-control enforcement failure that allows an authenticated high-privileged user to exceed authorized data boundaries rather than a perimeter bypass open to unauthenticated parties. No public exploit code has been identified, and the vulnerability has not appeared in CISA KEV at time of analysis; the high attack complexity further constrains realistic exploitation.

Local confidentiality compromise in Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 allows a low-privileged authenticated local attacker to gain unauthorized read access to all data accessible by the application via the Endeca Application Controller component. Oracle classifies this as easily exploitable with low attack complexity, indicating reliable exploitation without special tooling for any user holding a local logon on the affected host. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.

Cross-site scripting or injection via the Endeca Application Controller in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows an unauthenticated remote attacker to cause unauthorized read and write access to data by luring a victim user to interact with a malicious HTTP request. The CVSS scope change (S:C) signals that a successful exploit extends impact beyond the vulnerable component itself - consistent with browser-context compromise such as session theft or UI redress, which aligns with the 'Authentication Bypass' tag. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server allows unauthenticated network attackers to bypass authentication over HTTP and gain complete read access to critical data, including data accessible across additional connected products due to a confirmed scope change. The vulnerability is rated CVSS 6.8 with high attack complexity, meaning exploitation requires specific conditions to be met, which limits opportunistic mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Authentication Bypass tag and scope-change impact make this a material risk for Oracle Fusion Middleware deployments running the affected version.

Cross-site scripting (or equivalent client-side injection) in the Endeca Application Controller component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows unauthenticated remote attackers to perform unauthorized read and write operations against Commerce data by luring an authenticated user into interacting with a malicious HTTP request. The scope change (S:C) in the CVSS vector confirms that a successful attack can extend impact beyond the targeted component to additional Oracle products or browser contexts. No public exploit identified at time of analysis, and no CISA KEV listing; Oracle disclosed and patched this issue in the August 2026 Critical Patch Update.

Cross-site scripting in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 enables unauthenticated remote attackers to compromise victim sessions via HTTP. The attack requires human interaction - a victim must trigger the malicious request - and exploits the Internal operations component in a way that causes a scope change, meaning successful exploitation can affect resources beyond the vulnerable component itself (consistent with browser-context hijacking). Impact is limited to partial confidentiality and integrity loss: unauthorized read access to a subset of accessible data and unauthorized write/insert/delete on some accessible data; no availability impact is present. No public exploit or CISA KEV listing has been identified at time of analysis.

Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes critical data and partial denial-of-service risk via the Endeca Application Controller component over HTTP. An unauthenticated network attacker exploiting this vulnerability - tagged as an authentication bypass - can gain complete read access to all data accessible within the Oracle Commerce platform and degrade service availability. No public exploit code has been identified at time of analysis, and the high attack complexity (AC:H) reduces the realistic threat surface, though a successful attacker requires no credentials or user interaction once the exploit conditions are met.

Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local security-component flaw that grants a high-privileged infrastructure user unauthorized read and write access to all application data, including critical financial records. Despite requiring existing high privileges, the 'Authentication Bypass' tag signals that the Security component likely fails to enforce intra-application authorization boundaries, enabling privilege escalation within the product beyond the attacker's sanctioned scope. No public exploit code has been identified, and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Cross-site scripting (XSS) class vulnerability in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows unauthenticated remote attackers to compromise confidentiality and integrity of data by delivering a crafted HTTP payload that requires victim interaction. The scope change indicator in the CVSS vector (S:C) confirms that successful exploitation impacts resources beyond the directly vulnerable component - consistent with browser-context script execution affecting adjacent systems or sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this accessible to unsophisticated attackers once a suitable delivery mechanism is established.

Confidential data exposure in Oracle Commerce Guided Search / Experience Manager 11.4.0 enables high-privileged network attackers to read critical platform data over HTTP, with a confirmed scope change extending potential impact to adjacent Oracle Commerce components beyond the primary application. The attack requires no user interaction and is characterized as easily exploitable at low complexity, though the high privilege prerequisite narrows the attacker pool. Oracle has addressed this vulnerability in the Critical Security Patch Update for August 2026; no public exploit code has been identified at time of analysis.

Unauthorized critical data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a high-privileged, network-based attacker to read all data accessible to the Experience Manager component, with scope change extending impact to additional Oracle Commerce products. The vulnerability is exploitable over HTTP with no user interaction required. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the 'Authentication Bypass' tag warrants attention - it may indicate a privilege escalation pathway that reduces the effective authentication bar. EPSS data was not provided.

Cross-site scripting (XSS) in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows a remote unauthenticated attacker to inject malicious content into a victim's browser session via a crafted HTTP request, requiring the victim to interact with a manipulated link or page. The scope change in the CVSS vector (S:C) indicates the attack can affect browser context outside the vulnerable component, enabling session token theft or unauthorized data modification within the application. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Cross-site scripting or client-side injection in Oracle Commerce Experience Manager 11.4.0 enables unauthenticated remote attackers to compromise confidentiality and integrity of affected deployments through HTTP-delivered attacks requiring victim interaction. The scope change indicator in the CVSS vector confirms that successful exploitation can impact resources beyond the directly vulnerable component, consistent with session theft or content injection affecting downstream users. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle's August 2026 Critical Patch Update addresses this in a quarterly advisory cycle.

Cross-site scripting conditions in Oracle Commerce Guided Search / Experience Manager 11.4.0 allow an unauthenticated remote attacker to compromise victim sessions through a crafted HTTP request that requires human interaction to trigger. The vulnerability carries a scope change, extending impact beyond the directly vulnerable component to data accessible within the victim's authenticated browser context, enabling unauthorized read and limited data modification. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified at the time of analysis.

Unauthorized data disclosure in Oracle Commerce Experience Manager 11.4.0 allows low-privileged authenticated attackers to access critical or complete application data via HTTP. The vulnerability is tagged as an authentication bypass, suggesting that despite requiring a low-privileged account, the flaw circumvents authorization controls that should restrict data access within the Experience Manager component. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit once an attacker has any valid credential.

Oracle Commerce Guided Search and Experience Manager version 11.4.0 exposes a local confidentiality vulnerability in its Content Acquisition System (CAS) component that allows an unauthenticated infrastructure-level attacker to bypass application-layer authentication and obtain complete read access to all Oracle Commerce accessible data, including critical confidential records. The scope change designation in the CVSS vector (S:C) indicates successful exploitation can cascade beyond the Commerce platform itself, impacting additional co-located or integrated products. No public exploit code has been identified at time of analysis, and EPSS data was not provided in the source intelligence.

Unauthorized access to critical commerce data is achievable against Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via a network-accessible authentication bypass in the Content Acquisition System component. The vulnerability carries a CVSS scope change, meaning successful exploitation can spill over to compromise data accessible by additional integrated Oracle Commerce components beyond the directly attacked service. No public exploit has been identified at time of analysis, but the Authentication Bypass tag and unauthenticated network vector make this a meaningful data-exposure risk for any organization running the affected version.

Local data exposure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a low-privileged attacker with OS-level logon access to the hosting infrastructure to compromise the Content Acquisition System (CAS) component and read critical or complete data. The scope change (S:C) in the CVSS vector confirms the attack can propagate beyond the directly vulnerable component to impact other Oracle Commerce products sharing the same environment. No public exploit code and no CISA KEV listing are identified at time of analysis; this issue was disclosed by Oracle via the August 2026 Critical Patch Update.

Unauthenticated network exploitation of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via the Content Acquisition System component enables complete unauthorized read access to all data accessible by the platform, with scope change indicating downstream impact on adjacent Oracle systems. The attack vector is HTTP with high complexity, meaning specific preconditions must be met, but no credentials are required. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog. The tag 'Authentication Bypass' suggests the root cause is a failure in the Content Acquisition System to enforce identity controls on inbound HTTP requests.

Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes all data accessible to the Content Acquisition System component via a network-based authentication bypass over HTTP. Successful exploitation requires no credentials and no user interaction, though high attack complexity limits opportunistic mass exploitation. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog at time of analysis.

Unauthorized access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by any low-privileged, network-authenticated attacker over HTTP. The flaw resides in the Security component and, per the Oracle tag classification, represents an authorization bypass that permits a low-privilege account to read critical or complete HFM data assets well beyond their assigned permissions. No public exploit has been identified at time of analysis, though Oracle's Critical Security Update for August 2026 formally acknowledges and patches the issue.

Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged attacker with network access via HTTP to bypass security controls and gain complete read access to all data accessible within the application. The vulnerability resides in the Security component and is tagged as an authentication bypass, indicating weaknesses in how the application enforces authorization for authenticated sessions. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the confidentiality impact is rated High, covering critical financial consolidation data.

Unauthorized read and write access to critical financial data in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible via an authentication bypass in the Installation and Configuration component, reachable over HTTP by low-privileged network attackers. Successful exploitation grants complete confidentiality and integrity compromise of all Hyperion-accessible data, though no availability impact is described. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.

Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows any low-privileged authenticated attacker with HTTP network access to bypass security controls within the Security component, gaining read access to all financial data accessible by the application. Tagged as an Authentication Bypass, this suggests low-privileged users can circumvent authorization logic to access data sets beyond their permitted scope. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor's 'easily exploitable' designation and low attack complexity make this a practical risk for organizations running HFM in financial consolidation environments.

Unauthorized data exposure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows a low-privileged network attacker to access critical or complete Hyperion data via HTTP. The vulnerability resides in the Installation and Configuration component and is rated CVSS 6.5, with high confidentiality impact and no integrity or availability consequence. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity makes it accessible to any authenticated attacker with network reach.

Unauthorized data access in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged attacker with HTTP network access to read a subset of accessible data and perform unauthorized insert, update, or delete operations against the Installation and Configuration component. Despite the moderate CVSS score of 4.2, the 'Authentication Bypass' tag suggests the vulnerability enables a low-privileged user to circumvent authorization controls beyond their entitlement, though high attack complexity (AC:H) significantly constrains practical exploitation. No public exploit code and no active exploitation have been identified at time of analysis.

Local information disclosure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows a low-privileged local attacker to read a subset of data accessible to the application. The vulnerability resides in the Installation and Configuration component and requires only local logon access with standard user privileges. No active exploitation or public exploit code has been identified at time of analysis.

Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes a network-exploitable flaw in its Installation and Configuration component that allows unauthenticated remote attackers to partially compromise confidentiality and integrity. The scope change (S:C) in the CVSS vector, combined with the UI:R requirement and 'Authentication Bypass' tag, strongly suggests a client-side injection class vulnerability - likely cross-site scripting or request forgery - capable of affecting components beyond the directly targeted product. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 enables low-privileged authenticated users to access critical financial data or all application-accessible data over HTTP. The vulnerability resides in the Security component, and the 'Authentication Bypass' tag in the intelligence data suggests a breakdown in authorization enforcement that allows an authenticated low-privileged user to exceed their intended access scope - effectively escalating read access to sensitive financial records. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and network accessibility make this a practical risk for any organization relying on HFM for financial consolidation.

Unauthorized read and write access to Helidon-accessible data is possible through the Imperative Web Server component in Oracle Helidon 3.2.19 via a network-deliverable HTTP attack that requires victim interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) with scope change is characteristic of a client-side injection vulnerability such as Cross-Site Scripting or CSRF, where the attack crosses a scope boundary to impact resources or systems beyond the Helidon process itself. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV at time of analysis; Oracle disclosed it via the August 2026 Critical Patch Update.

Oracle Hyperion Financial Management 11.2.25.0.000 exposes a low-severity integrity flaw in its Security component that permits a local, unauthenticated attacker - one with OS-level logon to the host infrastructure - to perform unauthorized insert, update, or delete operations against a subset of accessible application data. Exploitation is rated difficult (AC:H) and additionally requires human interaction from a party other than the attacker, substantially constraining real-world opportunity. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, consistent with its 2.5 CVSS base score.

Integrity compromise in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged local attacker - contingent on human interaction from a separate user - to perform unauthorized creation, deletion, or modification of critical financial consolidation data, with potential scope change impact on additional Oracle components. ENISA EUVD-2026-61861 tags this as involving Authentication Bypass within the Security component, though the specific mechanism is not disclosed in Oracle's advisory. No public exploit code exists and no CISA KEV listing is present at time of analysis.

Partial denial-of-service in Oracle Java SE's JSSE component allows unauthenticated remote attackers to degrade availability of applications using TLS APIs across a broad range of supported Java versions. Affected releases span Java SE 8 through 26, GraalVM for JDK 17 and 21, and GraalVM Enterprise Edition 21.3.19, making this a wide-blast-radius availability issue for the Java ecosystem. Exploitation is limited to availability impact only - no confidentiality or integrity compromise is possible - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

Local authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a low-privileged attacker with logon access to the hosting infrastructure to read critical or all DRM-accessible data, with scope change indicating spillover exposure to additional integrated Oracle Hyperion components. The CVSS 3.1 score of 6.5 reflects the local attack vector with high confidentiality impact (C:H) and a notable scope change (S:C), meaning data exposure is not confined to the DRM application alone. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Full system takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a high-privileged attacker with network access via HTTP, exploiting a flaw in the Access and Security component. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, consistent with a CVSS 3.1 score of 6.6 that is tempered by high attack complexity and high privilege prerequisites. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a low-severity, network-accessible vulnerability in its Security component that allows a high-privileged, authenticated attacker to read a limited subset of application data and cause a partial denial of service via HTTP. The CVSS 3.1 base score of 3.3 (Low) accurately reflects the constrained real-world risk: exploitation demands both elevated privileges and high attack complexity, substantially limiting the attacker population. No public exploit code or active exploitation has been identified at time of analysis.

Partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, authenticated attacker over HTTP, targeting the Security component under high-complexity conditions. Impact is limited exclusively to availability - no confidentiality or integrity compromise is possible - resulting in a partial service disruption rather than full outage. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing it at low real-world priority for most environments.

Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a low-severity local vulnerability in its Security component, enabling a high-privileged attacker with local infrastructure logon to perform unauthorized data modification and cause partial denial of service. The CVSS vector (AV:L/AC:H/PR:H) confirms that exploitation requires both physical or logical local access and a high-privilege account, with complex attack conditions that must be met. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, consistent with its low base score and restricted attack surface.

Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a network-exploitable vulnerability in its Security component that allows a high-privileged authenticated attacker to exfiltrate critical financial data or cause a complete denial of service via crafted HTTP requests. Disclosed as part of Oracle's Critical Patch Update for August 2026 (CSPUAUG2026), this flaw carries a CVSS 3.1 base score of 6.5, driven by High confidentiality and High availability impacts with no integrity effect. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the intelligence data introduces a notable ambiguity regarding actual privilege requirements that warrants verification.

Partial confidentiality exposure in Oracle Hyperion Financial Management version 11.2.25.0.000 allows unauthenticated network attackers to read a subset of application data via HTTP under high-complexity conditions. The Security component is tagged as an authentication bypass, though impact is limited to low-severity data disclosure with no integrity or availability consequences. No public exploit code or CISA KEV listing exists at time of analysis.

Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local privilege escalation via its Security component, enabling a low-privileged infrastructure user to bypass access controls and obtain complete unauthorized access to all financial data the application can reach. The CVSS scope change (S:C) confirms that successful exploitation extends impact beyond HFM itself to additional Oracle ecosystem products sharing the same infrastructure. No public exploit has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.

Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 enables an unauthenticated attacker positioned on the same physical network segment to fully compromise confidentiality and integrity of financial data. The vulnerability is tagged as an authentication bypass in the Security component, meaning an adversary can bypass credential checks and gain unauthorized read and write access to all financial data accessible by the application. No public exploit code has been identified at time of analysis, and the adjacent-network vector combined with high attack complexity limits the realistic attacker population to internal network adversaries or those with network proximity to the deployment.

Local confidentiality breach in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged infrastructure user to bypass Security component controls and gain unauthorized access to critical financial data, with potential spillover into additional connected Oracle products due to a confirmed scope change. The CVSS vector (AV:L/AC:H/PR:L/S:C/C:H) indicates the attack requires local system logon and high complexity, but successful exploitation yields complete read access to all data accessible by the application. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world immediate risk moderate despite the authentication bypass tag.

Local access exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 enables authenticated low-privileged users with host logon rights to bypass Security component access controls and gain unauthorized read access to all HFM-accessible financial data, plus limited write capability. The vulnerability is tagged as an Authentication Bypass within the Security component itself - not a peripheral feature - meaning the core authorization enforcement mechanism is circumvented. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and realistic insider-threat scenario make this actionable for organizations running HFM on-premises.

Local confidentiality exposure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged attacker with local system logon to read critical or all accessible financial data within the application. The vulnerability resides in the Security component and is classified as easily exploitable given low attack complexity and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis.

Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged authenticated network attackers to gain complete read access to all data accessible by the application via HTTP. The vulnerability resides in the Security component and is tagged as an Authentication Bypass, indicating that an attacker with a valid but low-privileged account can circumvent authorization controls to read critical financial data beyond their intended scope. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network attack vector make this straightforward to exploit once credentials are obtained.

Unauthorized data disclosure in Oracle Hyperion Financial Management version 11.2.25.0.000 allows low-privileged, network-based attackers to access critical or complete application data via HTTP. The vulnerability resides in the Security component and is tagged as an authentication bypass, indicating that existing authorization controls can be circumvented by an attacker holding any low-privilege account, exposing all financial data accessible within the application. No public exploit code has been identified at time of analysis, and Oracle has addressed the issue in its Critical Patch Update for August 2026.

Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged authenticated network attackers to access all data accessible to the application via HTTP, targeting the Security component. The 'Authentication Bypass' tag suggests an authorization control failure permitting privilege escalation within an authenticated session, enabling full confidentiality compromise of sensitive financial consolidation data. No public exploit or active exploitation has been identified; this was disclosed as part of Oracle's Critical Security Patch Update for August 2026.

Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a network-accessible low-privileged attacker to read all data the application can access via a flaw in its Security component over HTTP. The vulnerability is tagged as an authentication bypass, suggesting that while a low-privilege session is sufficient to initiate the attack, the Security component fails to enforce authorization boundaries that should restrict access to higher-privilege data. No public exploit code has been identified and no active exploitation is confirmed by CISA KEV at the time of analysis.

Integrity compromise in Oracle Hyperion Financial Reporting 11.2.25.0.000 enables a low-privileged attacker with local infrastructure access to create, delete, or modify critical financial data managed by the application. Oracle's August 2026 Critical Security Patch Update addresses the flaw, which is rated Medium severity (CVSS 4.7) and is constrained by a local attack vector and high attack complexity. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.

Oracle Hyperion Financial Reporting version 11.2.25.0.000 exposes its Server component to unauthorized data manipulation and read access via a network-exploitable flaw tagged as an Authentication Bypass by Oracle's security team. A low-privileged attacker with HTTP network access can, under difficult-to-achieve conditions, read a subset of accessible financial data and perform unauthorized insert, update, or delete operations. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the financial data sensitivity of the affected platform elevates organizational risk beyond the moderate CVSS base score.

Oracle Hyperion Financial Reporting version 11.2.25.0.000's Server component contains an authentication bypass flaw exploitable by unauthenticated remote attackers over HTTP, as tagged directly by Oracle in their August 2026 Critical Patch Update. Successful exploitation - which demands both high attack complexity and human interaction from a legitimate user - yields complete read access to all data accessible within the Financial Reporting server, plus limited write capability (insert, update, delete) over some records. No public exploit code has been identified at time of analysis; exploitation complexity and the mandatory victim interaction requirement meaningfully constrain opportunistic or automated campaigns.

Unauthenticated remote compromise of Oracle Hyperion Financial Reporting version 11.2.25.0.000 allows network-accessible attackers to read and tamper with financial reporting data via HTTP without any credentials. The Server component is the affected entry point, and the attack is characterized by Oracle as 'easily exploitable,' meaning no special tooling or chaining is required. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, though the authentication bypass tag and zero-privilege requirement lower the bar for opportunistic targeting.

Unauthorized data exposure in Oracle Hyperion Financial Reporting 11.2.25.0.000 enables unauthenticated remote attackers to read a subset of accessible financial data via HTTP under high-complexity conditions. Tagged as an authentication bypass, the vulnerability is reachable without credentials and without user interaction, yet the AC:H rating signals that reliable exploitation is non-trivial. No public exploit code has been identified and no active exploitation is confirmed; however, the financial sensitivity of data processed by Hyperion EPM elevates the practical significance beyond the raw CVSS 3.7 Low score for affected organizations.

Local privilege escalation in Oracle Hyperion Financial Reporting 11.2.25.0.000 allows a low-privileged attacker with logon access to the host infrastructure to perform unauthorized creation, deletion, or modification of critical data and read a subset of application data - consistent with an application-layer authentication bypass within the Server component. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. The combination of local access requirement and high attack complexity substantially limits opportunistic exploitation, though the integrity impact is rated High by Oracle.