Privilege Escalation

Full compromise of Oracle Yard Management (part of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting supported versions 12.2.6 through 12.2.15, the flaw carries a CVSS 3.1 base score of 8.8 and, on successful exploitation, results in complete takeover of the Yard Management application with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Takeover of Oracle Purchasing (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged, network-authenticated attacker in supported releases 12.2.11 through 12.2.15. Successful attacks yield full confidentiality, integrity, and availability compromise of the Purchasing application per Oracle's July 2026 Critical Patch Update. Exploitation is rated high-complexity (AC:H), and no public exploit identified at time of analysis; the issue was reported internally by Oracle's security alert team rather than a public researcher.

Account takeover in Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-adjacent attacker to fully compromise the product over HTTP. Any authenticated user with minimal EBS privileges can escalate to complete control of the Public Sector Financials application (CVSS 8.8, high confidentiality/integrity/availability impact). There is no public exploit identified at time of analysis, but Oracle E-Business Suite is a recurring, high-value target for post-authentication attacks, and the July 2026 Critical Patch Update remediates it.

Account takeover in Oracle Public Sector Payroll (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-adjacent attacker fully compromise the module over HTTP. The CVSS 3.1 base score of 8.8 reflects complete confidentiality, integrity, and availability impact, and the flaw resides in the Internal Operations component. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's Critical Patch Update for July 2026.

Full compromise of Oracle Payroll (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Oracle rates the flaw 8.8 and characterizes it as 'easily exploitable' with a result of complete product takeover across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low complexity and low-privilege prerequisite make it a strong patching priority for EBS operators.

Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical HR data, with a scope change that lets attacks significantly impact other products beyond HRMS. Rated CVSS 3.1 8.2 (High) with high confidentiality and integrity impact but no availability impact, and flagged by Oracle as difficult to exploit (AC:H). At the time of analysis there is no public exploit identified and no CISA KEV listing, so exploitation appears theoretical rather than active.

Takeover of Oracle Trade Management (component: Claim LOV) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the module. The flaw is easily exploitable (AC:L) and requires only a low level of authenticated access (PR:L), carrying a CVSS 3.1 base score of 8.8. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.

Full compromise of Oracle Lease and Finance Management (versions 12.2.14 through 12.2.15), a module of Oracle E-Business Suite's Internal Operations component, is possible for a network-based attacker who already holds high application privileges. Oracle rates this CVSS 3.1 7.2 with high confidentiality, integrity, and availability impact, describing successful attacks as resulting in complete takeover of the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the modest EPSS-relevant profile is consistent with the high-privilege precondition limiting mass exploitation.

Full compromise of the Oracle E-Business Suite TeleSales module (Internal Operations component) is possible over the network via HTTP by a low-privileged authenticated user. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation results in complete takeover of TeleSales with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). This flaw was disclosed in the Oracle July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full compromise of Oracle Payables (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to take over the module via HTTP, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8). Any user holding a valid low-privilege EBS session can escalate to full control of the Payables application. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor language make it a strong patching priority.

Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, network-based attacker fully compromise the module over HTTP. Oracle rates the flaw CVSS 8.8 with high confidentiality, integrity, and availability impact and classifies it as "easily exploitable," meaning an authenticated user with minimal privileges can escalate to full control of the affected product. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but Oracle's own "easily exploitable" language signals a low barrier once credentials are held.

Unauthenticated remote compromise of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Integration component) allows a network attacker to reach critical data and, because of a scope change, to impact additional PeopleSoft products beyond the vulnerable module. The flaw is rated CVSS 3.1 9.9 and is trivially exploitable over HTTP with no authentication or user interaction, yielding full read of accessible data plus partial write and partial denial-of-service. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the near-maximal score and unauthenticated network vector make it a high-priority patching candidate.

Full server takeover in Oracle Communications Converged Application Server 8.2 and 8.3 (Core component) is possible for an unauthenticated remote attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Successful attacks yield high confidentiality, integrity, and availability impact (CVSS 3.1 8.1), but the attack is rated high-complexity (AC:H), meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, indicating no confirmed active exploitation.

Full takeover of Oracle PeopleSoft In-Memory Project Discovery 9.2 is possible when a low-privileged attacker with network access over HTTP exploits the Project Discovery component, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change (S:C), meaning successful attacks can significantly impact additional products beyond the vulnerable component itself, with complete loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low exploitation barrier make it a high remediation priority.

Account takeover in Oracle PeopleSoft Enterprise FIN Program Management 9.2 (Primavera Integration component) lets a low-privileged, authenticated remote attacker fully compromise the module by luring a separate legitimate user into interacting with malicious HTTP content, with a scope change that spills the impact into other integrated Oracle products. Oracle rates it CVSS 3.1 9.0 with full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis; it is disclosed only via the Oracle July 2026 Critical Patch Update.

Remote unauthenticated compromise of Oracle PeopleSoft Enterprise FIN Expenses 9.2 (Expenses component) allows attackers with only HTTP network access to read, create, delete or modify all Expenses-accessible data and to cause a partial denial of service. Rated CVSS 3.1 9.4 and flagged by Oracle as easily exploitable, meaning no authentication or user interaction is required. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low-complexity unauthenticated profile makes it a high-priority patch in the July 2026 Oracle Critical Patch Update.

Full compromise of Oracle PeopleSoft Enterprise CRM Common Objects 9.2.23 is possible by a remote, unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Although the flaw resides in the CRM Common Objects component, a scope change means a successful attack can cascade into other PeopleSoft products and result in complete takeover of the affected component. Oracle rates it CVSS 9.0 but flags it as difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows a low-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity, and availability impact. The Oracle July 2026 Critical Patch Update rates this CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H). No public exploit is identified at time of analysis and it is not listed in CISA KEV.

Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) allows a low-privileged, network-authenticated attacker to compromise confidentiality, integrity, and availability over HTTP. Oracle rates this 8.8 and describes it as 'easily exploitable,' meaning any user holding a valid low-level account can escalate to full application control. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and high impact make it a strong patch priority.

Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) allows a low-privileged, network-authenticated attacker to compromise the entire application over HTTP. Oracle rates the flaw as easily exploitable with high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and it is not on CISA KEV; the only source is Oracle's July 2026 Critical Patch Update.

Account takeover in Oracle Agile PLM 9.3.6 (Security component) lets a low-privileged, remotely authenticated attacker fully compromise the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated easily exploitable with high confidentiality, integrity, and availability impact (CVSS 8.8) and results in complete takeover of the Agile PLM instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Complete takeover of Oracle Commerce Guided Search Platform Services 11.4.0 (formerly Endeca) is possible by an unauthenticated remote attacker sending crafted HTTP requests to the Forge component. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and lack of authentication make it a high-priority patch target.

Takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible for an authenticated low-privileged attacker reaching the Experience Manager component over HTTP. Rated CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact, this flaw was disclosed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is possible when a low-privileged attacker reaches the Content Acquisition System component over HTTP. Oracle rates this 9.9 with a scope change (S:C), meaning a successful compromise of the Guided Search product can significantly impact additional downstream products beyond the vulnerable component itself. There is no public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority patch item.

Full compromise of the Oracle Advanced Benefits module (Affordable Care Act component) within Oracle E-Business Suite 12.2.7 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests over the network. Successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact. This is a July 2026 Oracle Critical Patch Update issue with no public exploit identified at time of analysis and no CISA KEV listing.

Account/system takeover in Oracle Communications Service Catalog and Design (versions 8.0.0.7.0 through 8.3.0.2.0), Solution Designer component, lets a low-privileged attacker with network HTTP access fully compromise the product. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, Oracle describes it as 'easily exploitable,' meaning any authenticated user can escalate to complete control. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Local privilege-escalation to full takeover in Oracle Communications Billing and Revenue Management (BRM) 15.0.0.0.0-15.0.1.0.0 and 15.1.0.0.0-15.2.0.0.0 allows a low-privileged attacker with logon access to the underlying infrastructure to fully compromise the BRM Platform component, with high confidentiality, integrity, and availability impact. The flaw is rated CVSS 3.1 7.8 and was disclosed by Oracle in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because BRM is a back-office telecom billing platform, exploitation requires an existing foothold on the host rather than remote unauthenticated access.

Account/module takeover in Oracle HRMS (UK) UK Payroll — part of Oracle E-Business Suite 12.2.8 through 12.2.15 — lets a low-privileged, network-based attacker fully compromise the module over HTTP with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Oracle classifies it as easily exploitable and rates the outcome as complete takeover of Oracle HRMS (UK). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as a networked, low-complexity flaw requiring only minimal privileges it warrants prompt patching in the July 2026 Critical Patch Update.

Full compromise of Oracle HRMS (US) within Oracle E-Business Suite is possible via the Internal Operations component, letting a low-privileged user with local logon access escalate to complete takeover of the HRMS application, with confidentiality, integrity and availability all fully impacted. Rated CVSS 3.1 7.0 but explicitly high-complexity (AC:H), so exploitation is non-trivial and requires an existing account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full compromise of Oracle Application Object Library (the core security and application framework within Oracle E-Business Suite, DB Privileges component) is possible by a low-privileged, authenticated attacker sending crafted HTTP requests. Successful attacks yield complete takeover of the Application Object Library across supported EBS releases 12.2.3 through 12.2.15, impacting confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the flaw is rated difficult to exploit (AC:H), but the CVSS 3.1 base score of 7.5 and the takeover impact make it a notable item in the Oracle July 2026 Critical Patch Update.

Privilege escalation to full component takeover in Oracle E-Business Suite (Oracle Applications DBA, ADPatch component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the Oracle Applications DBA subsystem, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Disclosed in Oracle's July 2026 Critical Patch Update, this is easily exploitable per Oracle's own rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a strong patching priority.

Full compromise of the Oracle Applications DBA component (Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible for an authenticated, high-privileged attacker with HTTP network access, resulting in complete takeover with high confidentiality, integrity, and availability impact. Rated CVSS 3.1 7.2 (High) by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Full compromise of Oracle WebCenter Enterprise Capture is possible when a low-privileged, network-authenticated attacker abuses a flaw in the Client Bundle component reachable over HTTP, resulting in complete takeover with high confidentiality, integrity, and availability impact. It affects Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 and was disclosed in Oracle's July 2026 Critical Patch Update. Oracle rates it easily exploitable (CVSS 8.8), with no public exploit identified at time of analysis and no CISA KEV listing.

Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privileged attacker with network access over HTTP targets the Client Bundle component. Per Oracle's July 2026 Critical Patch Update, successful attacks result in complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.8). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Takeover of MySQL Server and MySQL Cluster is possible through the Server: Replication component, where a high-privileged attacker with network access can fully compromise affected instances. This authenticated flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1, and is fixed in Oracle's July 2026 Critical Patch Update. Oracle rates it CVSS 7.2 with full confidentiality, integrity and availability impact; no public exploit identified at time of analysis.

Local privilege escalation leading to full product takeover affects the BRM Server component of Oracle Communications Billing and Revenue Management versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. A low-privileged attacker who already has a logon on the host where BRM executes can leverage this easily-exploitable flaw to fully compromise the product, gaining high impact to confidentiality, integrity and availability. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild; Oracle addressed it in the July 2026 Critical Patch Update.

Local privilege-based takeover of Oracle Project Foundation (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with logon access to the host infrastructure to fully compromise the component. Successful exploitation yields high confidentiality, integrity, and availability impact - effectively a complete takeover of Project Foundation. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full takeover of Oracle PeopleSoft Enterprise HCM Talent Acquisition Manager 9.2 is achievable by a low-privileged, network-based attacker abusing the Job Opening component over HTTP. Because the flaw carries a scope change (S:C), successful attacks reach beyond the Talent Acquisition module and can significantly impact additional connected PeopleSoft products. No public exploit identified at time of analysis, but the 9.9 CVSS and trivial exploitability make this a top-priority patch from Oracle's July 2026 Critical Patch Update.

Privilege escalation to full application takeover in Oracle PeopleSoft Enterprise SCM Supplier Contract Management 9.2 (Security component) lets a low-privileged attacker with logon access to the hosting infrastructure compromise the module, with a scope change that can significantly impact additional connected products. The flaw carries an Oracle-assigned CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not in CISA KEV, though it is remediated in Oracle's July 2026 Critical Patch Update.

Full compromise of Oracle PeopleSoft Enterprise FIN Cash Management 9.2 is possible by a low-privileged user who already has logon access to the infrastructure hosting the application. Because the flaw carries a scope change, a successful attack can pivot beyond the Cash Management module to significantly impact additional Oracle products, resulting in complete takeover of the affected component. Fixed in the Oracle July 2026 Critical Patch Update; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Local privilege-based compromise in Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 (Security Framework component of Oracle Fusion Middleware) allows a low-privileged attacker with an interactive logon to the host to fully take over the JDeveloper installation, impacting confidentiality, integrity, and availability. Fixed in the Oracle July 2026 Critical Patch Update, the flaw is rated CVSS 7.0 but is explicitly high-complexity (AC:H) and requires local access, so no public exploit identified at time of analysis and no active exploitation is confirmed. It is tagged as an Information Disclosure issue by Oracle, though the vector shows full C/I/A impact consistent with a complete component takeover.

Full takeover of Oracle PeopleSoft Enterprise SCM Order Management 9.2 is possible for any low-privileged user who can log on to the infrastructure where the application runs, via a flaw in its Security component. A successful attack yields complete compromise of confidentiality, integrity, and availability of the Order Management module. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update.

Local privilege escalation to full product takeover in Oracle Communications BRM - Elastic Charging Engine (versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0) lets a low-privileged attacker with logon access to the host running the ECE infrastructure compromise the Diameter Gateway and SDK component. Per Oracle's CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N), exploitation is authenticated and local but easily performed, yielding high confidentiality, integrity, and availability impact (base 7.8). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Account/instance takeover in Oracle Process Manufacturing Systems (Internal Operations component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access fully compromise the module, achieving high confidentiality, integrity, and availability impact. Oracle rates it CVSS 8.8 and calls it 'easily exploitable'; no public exploit is identified at time of analysis, and it is not listed in CISA KEV. The fix ships in Oracle's July 2026 Critical Patch Update.

Full compromise of Oracle Process Manufacturing Logistics (Internal Operations component of Oracle E-Business Suite) is possible for a high-privileged, authenticated attacker sending crafted HTTP requests, per Oracle's July 2026 Critical Patch Update. Successful attacks yield complete takeover of the module with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Full compromise of Oracle Advanced Collections (Internal Operations component of Oracle E-Business Suite) is achievable by a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.8, successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single-privilege prerequisite make it a strong patching priority.

Full compromise of the Oracle Project Portfolio Analysis module (Internal Operations component) in Oracle E-Business Suite releases 12.2.3 through 12.2.15 is achievable by a low-privileged, network-based attacker over HTTP, resulting in complete takeover of the affected product with high confidentiality, integrity, and availability impact. The CVSS 3.1 base score is 7.5, and the vector's AC:H rating means exploitation is difficult and likely requires specific timing or preconditions. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Local privilege-driven takeover in Oracle E-Business Tax (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker who can log on to the host infrastructure fully compromise the E-Business Tax module. Oracle rates it CVSS 3.1 7.8 with complete confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit was identified at time of analysis, and it is not listed in CISA KEV.

Full takeover of Oracle Transportation Execution (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged attacker with only network HTTP access to the application. Any authenticated user account can be leveraged to fully compromise confidentiality, integrity, and availability of the module, per the CVSS 3.1 8.8 vector. No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.

Full compromise of Oracle Service Fulfillment Manager (a Fulfillment Engine component of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible where an authenticated, low-privileged attacker with network HTTP access can escalate to complete takeover of the module. Although rated CVSS 3.1 7.5 with confidentiality, integrity and availability impact, the attack complexity is high, meaning exploitation is non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.

Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite) allows a high-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application, with a scope change that may significantly impact additional Oracle products. Affected releases span 12.2.3 through 12.2.15, and Oracle rates it CVSS 8.7 (confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is addressed in the Oracle July 2026 Critical Patch Update.

Full account takeover of Oracle Labor Distribution (part of Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to affected servers running versions 12.2.3 through 12.2.15. The flaw compromises confidentiality, integrity, and availability of the module and, per Oracle, results in complete takeover of Labor Distribution. No public exploit identified at time of analysis, though the CVSS 8.8 rating and network-reachable, low-complexity nature make it a high-priority patch in the Oracle July 2026 Critical Patch Update.

Full compromise of Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) is possible over HTTP by a low-privileged authenticated attacker, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, a successful attack results in complete takeover of the product with full confidentiality, integrity, and availability impact. The CVSS 3.1 score is 7.5 and Oracle rates the flaw difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full compromise (takeover) of the Oracle Public Sector Financials module in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. The flaw carries a CVSS 3.1 base score of 7.5 and impacts confidentiality, integrity, and availability, but is rated hard to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.

Full compromise of the Oracle Public Sector Payroll module within Oracle E-Business Suite (Internal Operations component) is possible for an already-privileged attacker who can reach the application over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw affects supported EBS releases 12.2.4 through 12.2.15 and, though rated CVSS 7.2, requires high existing privileges (PR:H), which narrows the realistic attacker set to trusted or authenticated users. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Account takeover in the Public Sector Payroll module (Internal Operations component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with network HTTP access fully compromise the payroll application. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and calls it 'easily exploitable,' meaning a single low-tier authenticated account is enough to seize the module. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and network reach make it a prompt-patch item from the July 2026 Critical Patch Update.

Account/component takeover in the Oracle Customer Care module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the Customer Care component. The flaw carries a CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, and low attack complexity. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.

Full compromise of the Oracle Shipping Execution module of Oracle E-Business Suite (Internal Operations component) is possible for a high-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Affecting supported EBS releases 12.2.12 through 12.2.15, successful exploitation results in complete takeover of the Shipping Execution product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, so real-world urgency is tempered by the requirement for pre-existing high privileges.

Privilege-based takeover of Oracle Project Intelligence (a module of Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the component, resulting in high confidentiality, integrity, and availability impact. Oracle rates it CVSS 3.1 8.8 and delivered the fix in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though EBS components are historically attractive post-authentication targets.

Full compromise of Oracle HCM Configuration Workbench (Rapid Implementation component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a high-privileged, network-authenticated attacker to take over the module over HTTP with high confidentiality, integrity, and availability impact. Oracle addressed the flaw in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Despite the vendor 'Information Disclosure' tag, the CVSS vector reflects a full C/I/A takeover rather than mere data exposure.

Privilege-escalation-to-takeover in Oracle Warehouse Management (Internal Operations component of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with network access over HTTP to fully compromise the module. Because CVSS scope is unchanged but all three impacts (C/I/A) are High, a successful attack results in complete takeover of Oracle Warehouse Management. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is addressed in the Oracle Critical Patch Update of July 2026.

Full compromise of Oracle Payroll (Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to the affected application, per Oracle's July 2026 Critical Patch Update. The flaw affects EBS releases 12.2.3 through 12.2.15 and, given the CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, allows takeover of Oracle Payroll. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor characterization warrant prompt patching.

Full compromise of Oracle Payroll (a module of Oracle E-Business Suite, Internal Operations component) is possible in supported releases 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access can achieve complete takeover of the Payroll application. Oracle rates the flaw CVSS 3.1 7.5 with high confidentiality, integrity and availability impact, but flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is elevated but not confirmed as active.

Full takeover of Oracle Payroll (component: Internal Operations) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged, authenticated attacker over HTTP, yielding complete compromise of confidentiality, integrity, and availability (CVSS 8.8). The flaw is described by Oracle as easily exploitable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It was disclosed and fixed in the Oracle Critical Patch Update of July 2026.

Full compromise of Oracle Order Management, a module of Oracle E-Business Suite (EBS), is possible via the Product Diagnostic Tools component, where a low-privileged attacker with HTTP network access can achieve complete takeover of the module. Oracle rates the flaw 8.8 (High) and describes it as 'easily exploitable,' with full confidentiality, integrity, and availability impact across EBS releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and low privilege bar make it a strong patch priority.

Full compromise of Oracle Advanced Pricing (Pricing Installation component of Oracle E-Business Suite) is achievable by a low-privileged, network-adjacent attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation yields complete takeover of the Advanced Pricing module with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Full compromise of Oracle Quoting (a module of Oracle E-Business Suite) is possible for an authenticated, low-privileged attacker reaching the application over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the Quoting component with high impact to confidentiality, integrity, and availability, though Oracle rates the attack complexity as high (difficult to exploit). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Full compromise of the Oracle Quality module within Oracle E-Business Suite (Internal Operations component, versions 12.2.3 through 12.2.15) is possible for a low-privileged, authenticated attacker reaching the application over HTTP. Successful attacks lead to complete takeover of Oracle Quality with high confidentiality, integrity, and availability impact, though Oracle rates the attack complexity as high. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privileged compromise of Oracle Quality, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), allows a high-privileged attacker with HTTP network access to read all Oracle Quality-accessible data, partially modify data, and cause partial denial of service. Because the flaw carries a scope change (S:C), successful attacks can significantly impact additional products beyond Oracle Quality itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 3.1 base score of 8.2 reflects meaningful confidentiality and cross-component risk.

Privilege-scoped compromise of Oracle Price Protection (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with local logon to the hosting infrastructure to read, create, delete, or modify all data accessible to the product. Oracle rates it CVSS 3.1 8.4 with a scope change, meaning a successful attack can significantly impact products beyond Price Protection itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle-reported EBS flaws are historically high-value targets.

Full compromise of the Oracle HCM Common Architecture module (Internal Operations component) within Oracle E-Business Suite is possible, allowing an attacker who already holds high-level application privileges to take over the module over the network via HTTP. The flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 score of 7.2 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' for an authenticated actor.

Local privilege escalation and full compromise in Oracle Solaris 11.4 (Utility component) allows a low-privileged local user with logon access to the host to take over the operating system, impacting confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.0 and flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.

Account takeover in Oracle General Ledger (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with network access via SOAP fully compromise the General Ledger module, gaining high impact to confidentiality, integrity, and availability. The Oracle July 2026 Critical Patch Update rates it CVSS 3.1 8.8 and describes it as easily exploitable, resulting in complete takeover of the affected component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Privilege escalation to full takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) lets a low-privileged, network-based attacker fully compromise the server over HTTP. Because the CVSS vector marks a scope change (S:C), a successful attack can significantly impact additional products beyond WebCenter Content itself, driving the near-maximal 9.9 base score. No public exploit identified at time of analysis, but the ease of exploitation (AC:L, PR:L) and complete confidentiality, integrity, and availability impact make this a top-priority patch in Oracle's July 2026 Critical Patch Update.

Local privilege escalation to full system takeover in Oracle Solaris 11.4 lets a low-privileged local user compromise the Filesystems component and, due to a scope change, significantly impact additional products beyond Solaris itself. Exploitation is rated difficult (high attack complexity) and requires an existing local logon, but a successful attack yields complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis; this was disclosed in the Oracle Critical Patch Update of July 2026 and is not listed in CISA KEV.

Account takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged attacker with HTTP network access fully compromise the server. The CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local privilege escalation to full product takeover in Oracle Data Integrator (Studio component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a low-privileged attacker who can log on to the host where ODI runs fully compromise the product with high confidentiality, integrity, and availability impact. Oracle rates it CVSS 3.1 7.8; there is no public exploit identified at time of analysis and it is not on the CISA KEV list. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update.

Full application takeover in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (Time Accounting and HRM Base component) allows an authenticated, low-privileged attacker to compromise the product over HTTP. Per the CVSS vector (PR:L), a valid low-privilege account is required and exploitation is difficult (AC:H), but success yields high confidentiality, integrity, and availability impact — effectively total compromise of the HCM Foundation instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.

Full compromise of Oracle Transportation Management 6.5.3 (Supply Chain suite, Install component) is possible for a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability loss - Oracle describes the outcome as a 'takeover' of the product. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.

Unauthenticated data compromise in Oracle Identity Manager (Fusion Middleware, OIM Legacy UI component) versions 12.2.1.4.0 and 14.1.2.1.0 lets remote attackers read and modify all OIM-accessible data over HTTP. Tagged as an authentication bypass, the flaw carries a CVSS 9.1 and was addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis.

Full product takeover of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a remote, unauthenticated attacker over HTTP against the Runtime Tools component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, base 9.8) reflects that no credentials, user interaction, or special conditions are needed, and a successful attack fully compromises confidentiality, integrity, and availability. This is a July 2026 Oracle Critical Patch Update item with no public exploit identified at time of analysis and no CISA KEV listing.

Full compromise of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Integration Business Insight component in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the product with high confidentiality, integrity, and availability impact. Addressed in the Oracle Critical Patch Update of July 2026, this issue carries a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the 'easily exploitable' language from Oracle (reflected as AC:L) makes prompt patching prudent for exposed instances.

Complete takeover of the Oracle Identity Manager Connector (PeopleSoft Applications component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, with CVSS 9.8 reflecting full confidentiality, integrity, and availability loss. Affected releases are 12.2.1.4.0 and 14.1.2.1.0, and the fix ships in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and 'takeover' outcome make it a top-tier patch priority for any environment running this connector.

Local privilege-driven takeover in Oracle HTTP Server 14.1.2.0.0 (Oracle Fusion Middleware) lets a low-privileged attacker with logon access to the host running OHS fully compromise the server via the bundled HTTP/2 module (mod_http2.so). With a CVSS 3.1 base score of 7.8 and full confidentiality, integrity, and availability impact, successful exploitation yields complete takeover of the OHS instance. Fixed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis.

Denial-of-service and information disclosure in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (OW HR PR Foundation component) allows a low-privileged, authenticated attacker with network/HTTP access to hang or repeatedly crash the application (complete DoS) and read a subset of accessible data. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.

Local privilege-based takeover of Oracle HTTP Server (12.2.1.4.0 and 14.1.2.0.0) allows a low-privileged attacker with a logon session on the host to fully compromise the web server, yielding high confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.8 with a local attack vector (AV:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but complete server takeover makes it a meaningful lateral-movement and privilege-consolidation target once a foothold exists.

Takeover of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a low-privileged attacker with network access over LDAP can fully compromise the directory service. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, Oracle describes the flaw as 'easily exploitable', meaning an authenticated LDAP user can escalate to full control of the directory. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-user prerequisite make it a high priority for LDAP-exposed deployments.

Privilege-based takeover of Oracle Unified Directory (OUD Core) affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a high-privileged attacker with LDAP network access can fully compromise the directory service. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit identified at time of analysis; addressed in Oracle's July 2026 Critical Patch Update.

Full takeover of Oracle Project Costing (part of Oracle E-Business Suite) is possible via the Enterprise Command Center component, where a high-privileged, network-authenticated attacker sending HTTP requests can compromise confidentiality, integrity, and availability of the module. Affected releases span EBS 12.2.3 through 12.2.15, and Oracle rates the flaw CVSS 3.1 7.2 while noting it is 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fix is delivered in the Oracle July 2026 Critical Patch Update.

Local privilege-based takeover in Oracle Coherence (component: Core) allows a low-privileged attacker with logon access to the host where Coherence executes to fully compromise the product, yielding high confidentiality, integrity, and availability impact. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.