Vulnerabilities

Cotonti 1.0.0's Comments plugin feeds the unauthenticated 'ci' GET parameter directly into PHP's unserialize() without the allowed_classes restriction, allowing arbitrary PHP objects with attacker-controlled properties to be instantiated. By sending a crafted serialized payload in the URL, an unauthenticated attacker can trigger gadget chains available in the application, resulting in database manipulation or remote code execution. The flaw is rated critical (CVSS 4.0: 9.3) and is classified as CWE-502 (deserialization of untrusted data). Sites running Cotonti 1.0.0 with the Comments plugin enabled are affected. No public proof of concept is known, the issue is not in CISA's KEV catalog, and there is no evidence of exploitation in the wild, but exploitation requires only a simple HTTP request once a viable gadget chain is identified.

Do: Upgrade Cotonti to the latest release as soon as a fixed version is available, or disable the Comments plugin if it is not needed. In the meantime, use a WAF or reverse proxy rule to block requests to the Comments plugin containing suspicious serialized data in the 'ci' parameter (e.g., strings starting with 'O:' or 'a:'). Audit web server logs for historical requests with a 'ci' parameter carrying serialized payload markers, and verify database integrity and web roots for signs of code injection.

CVE-2026-68491 is a critical (CVSS 4.0: 9.4) improper link resolution flaw (CWE-59) in which the software performs a file write without adequately validating that the target path is not a symbolic link, permitting an attacker to overwrite arbitrary files. Exploitation is network-reachable and requires only low privileges (PR:L, likely an authenticated account) with no user interaction: the attacker plants or controls a symlink on a path the application writes to, redirecting the write to a file of their choosing. Successful abuse yields high impact to confidentiality, integrity, and availability on both the vulnerable system and downstream systems, with typical outcomes including tampering with configuration, credential, or executable files to escalate privileges or achieve code execution. The flaw was coordinated through HackerOne as CNA, but the advisory data provided does not identify the vendor, product, or affected versions, so the at-risk population cannot be determined from this record. Exploitation status: not in the CISA KEV catalog, no public PoC known, and exploit maturity is unspecified (E:X).

Do: Track the vendor advisory coordinated via HackerOne and upgrade to the fixed version as soon as the affected product is publicly identified. In the interim, verify that file-write operations use symlink-safe practices (e.g., open with O_NOFOLLOW, lstat validation, secure temporary files) and remove unexpected symlinks from application-writable directories. Audit affected hosts for unexplained file overwrites of configs, credentials, or binaries that could indicate attempted exploitation.

Digital Watchdog VMAX DVR and NVR recorders ship with hard-coded credentials baked into the firmware, in violation of secure development practice (CWE-798). When the device's FTP service is reachable, a remote attacker can authenticate using these embedded credentials and access files with root privileges, potentially reading or modifying arbitrary files on the recorder, including stored video footage and configuration data. The CVSS 4.0 base score is 9.4 (critical), though the adjacent-network attack vector means the attacker generally needs access to the same network segment as the recorder. The affected population is the Digital Watchdog VMAX lineup of DVRs and NVRs, which are commonly deployed in commercial video surveillance environments such as retail, banking, and education. There is no known public proof-of-concept and no evidence of in-the-wild exploitation to date.

Do: Apply vendor firmware updates to affected VMAX DVRs/NVRs as soon as Digital Watchdog releases them, and check the ICS-CERT advisory for the exact model and firmware list. Immediately disable the FTP service if it is not required, and restrict management protocols on recorders to a dedicated VLAN or firewall allowlist so only trusted clients can reach them. Audit FTP access logs for unauthorized logins and rotate any local credentials as a precaution.

Digital Watchdog VMAX DVRs and NVRs are missing authorization checks on state-changing CGI endpoints and perform no session validation, so requests that modify device state can be accepted without a valid authenticated session (CWE-862). An attacker who can reach the recorder on the same network segment (CVSS attack vector is adjacent-network, with no privileges or user interaction required) can invoke these CGIs directly and change device configuration or behavior, with critical-rated impacts on the confidentiality, integrity, and availability of the recorder and dependent systems such as recorded video and surveillance operations. Organizations running VMAX DVR/NVR appliances — typically commercial and physical-security video deployments — are affected. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and there is no evidence of exploitation in the wild, though exposed recorder web interfaces are routine targets once network access is obtained.

Do: Apply the vendor firmware update for the VMAX DVR/NVR lineups as described in the ICS-CERT advisory and confirm the patched build is running. Because exploitation requires adjacent-network access, place recorders on a dedicated VLAN or behind firewall rules so only trusted clients can reach their CGI/web endpoints. Rotate any default credentials and review device logs for unexpected configuration changes or CGI requests.

The @zereight/mcp-gitlab MCP server (version 2.1.18, npm) registers its Streamable HTTP transport at /mcp without any Host or Origin allowlist and without the MCP SDK's DNS-rebinding protections (enableDnsRebindingProtection, allowedHosts, allowedOrigins are never set; express.() is installed globally before any origin check). Because the server binds to 127.0.0.1 by default, a malicious web page can use DNS rebinding to make a victim's browser send cross-origin requests to the local MCP listener with attacker-controlled Host and Origin headers, which the server accepts and processes through the MCP initialize path instead of rejecting at the HTTP boundary. In default local mode this lets the attacker's page drive the MCP session and invoke GitLab tools from the victim's machine; in REMOTE_AUTHORIZATION=true mode, unauthenticated tools/list and GitLab API calls are blocked by token checks, but the browser-boundary flaw remains and a captured/planted Private-Token flow still allows tool listing and calls such as list_project_variables against the victim's GitLab. Affected users are anyone running this package with the Streamable HTTP transport (documented for remote deployments), while stdio users are not directly exposed. The issue is rated CVSS 3.1 9.6 (critical); no public PoC or in-the-wild exploitation is known.

Do: Upgrade @zereight/mcp-gitlab to a release later than 2.1.18 once a fix ships (verify that StreamableHTTPServerTransport sets enableDnsRebindingProtection with allowedHosts/allowedOrigins, or that a Host/Origin-checking middleware runs before express.() and /mcp). Until then, prefer stdio over Streamable HTTP, do not expose the HTTP listener beyond loopback without a reverse proxy that strictly validates Host and Origin, and set REMOTE_AUTHORIZATION=true so tool calls require a GitLab token. Review server logs and metrics (totalSessions/activeSessions) for unexpected initialize requests or sessions originating from browsers.

The @zereight/mcp-gitlab MCP server (repository zereight/gitlab-mcp) is vulnerable to server-side request forgery (CWE-918) when the environment variable ENABLE_DYNAMIC_API_URL=true is set: the server honors an attacker-supplied X-GitLab-API-URL request header as the base URL for all outbound GitLab API calls, validating only URL syntax with no allowlist or hostname restriction. Because the server attaches the victim's GitLab Private-Token to every outbound fetch using that redirected URL, any caller who can reach the HTTP/SSE transport can point the server at an attacker-controlled host and capture the victim's token, giving full access to whatever GitLab projects and permissions that token grants. All versions through commit 74a8c83 are affected, and no patched version was available at the time of the report. The flaw is rated critical (CVSS 3.1 9.6; the advisory text also cites 8.5) and the report includes a working proof-of-concept, though no exploitation in the wild is known and it is not on the CISA KEV list.

Do: Do not set ENABLE_DYNAMIC_API_URL=true; leave the dynamic API URL feature disabled (its default state) until a patched release is published. If the flag was ever enabled on a network-reachable instance, rotate the configured GitLab private tokens immediately and review logs for outbound requests to unexpected hosts carrying private-token headers. Restrict access to the MCP HTTP/SSE endpoints (bind to localhost, firewall the port, require strong authentication) and monitor the upstream repository for a fix.

Fireshare, a self-hosted media and link sharing application, contains an argument injection flaw (CWE-88) in its video upload function in all versions prior to 1.6.14. An unauthenticated remote attacker can inject additional arguments into the upload processing path by sending a crafted request to the affected endpoint, allowing them to write or overwrite arbitrary files on the host system. Because the endpoint requires no authentication and the flaw carries a CVSS 3.1 score of 9.8 (network vector, low complexity, no privileges, no user interaction), any internet-reachable instance can be fully compromised through file overwrite leading to code execution or data destruction. Operators running Fireshare below 1.6.14 are affected; the issue is fixed in version 1.6.14. There is no known public proof of concept and the CVE is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation status is currently none known.

Do: Upgrade Fireshare to version 1.6.14 or later immediately. Until patched, remove the instance from public internet exposure (e.g., restrict access via VPN, firewall rules, or a reverse proxy with authentication) and disable the video upload endpoint. Review the server for unexpectedly created or modified files outside the media directories and rotate any credentials or secrets stored on the host in case of prior compromise.

Tencent's Mass Service Engine in Cluster (MSEC) contains an unauthenticated path traversal flaw (CWE-22) that lets a remote attacker send a crafted POST request containing '../' sequences to write files outside the intended directory, such as a webshell. Once a webshell is uploaded, the attacker can execute arbitrary code with root privileges on the target device, giving full compromise of confidentiality, integrity, and availability. The attack requires no credentials and no user interaction, and is rated critical at CVSS 4.0 9.3. Any organization running an internet-reachable MSEC deployment is affected; no affected or fixed version numbers have been published. There is no known public proof of concept, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported to date.

Do: Immediately inventory for any Tencent MSEC deployments and remove or isolate management/API endpoints from the public internet (allow-list via VPN or firewall). Review web server and MSEC logs for POST requests containing '../' sequences and hunt for unexpected recently-added script/webshell files and unexplained root processes. Contact Tencent or monitor their advisories for a patched release, since no fixed version has been specified in the available data.

CVE-2026-87230 is a flaw in the Security component of Oracle Hyperion Financial Management, affecting supported version 11.2.26.0.000. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges and no user interaction. Successful attacks allow unauthorized creation, deletion, or modification of critical data — or all data accessible to Oracle Hyperion Financial Management — as well as unauthorized read access to that data, and because of a scope change, the impact can extend beyond Hyperion Financial Management to additional products. The vulnerability carries a maximum CVSS 3.1 base score of 10.0, driven by high confidentiality and integrity impacts. No public proof of concept is known, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no in-the-wild exploitation has been reported to date.

Do: Apply the Oracle patch for this issue as soon as it is available via Oracle's Critical Patch Update for Hyperion 11.2.x, since 11.2.26.0.000 is the only listed affected version. Until patched, restrict network access to Hyperion Financial Management HTTP endpoints — remove internet exposure and place the service behind a VPN or allow-listed reverse proxy — and monitor authentication and Security component logs for unauthenticated access attempts. Verify that you are not running the affected 11.2.26.0.000 build on any production or DR instance.

Oracle Hyperion Data Relationship Management (DRM) version 11.2.26.0.000 contains a critical vulnerability in its Access and security component that allows an unauthenticated attacker with network access over HTTP to compromise the application. The flaw is rated CVSS 3.1 9.1 (critical) and is described by Oracle as easily exploitable, with no privileges or user interaction required. A successful exploit gives the attacker unauthorized ability to create, delete, or modify critical data (or all DRM-accessible data) as well as unauthorized read access to that data, impacting confidentiality and integrity, though availability is not affected. Organizations running the affected on-premises version of this enterprise master-data governance tool are exposed, particularly if its HTTP endpoints are reachable beyond an internal network. No public proof of concept is known and the flaw is not on the CISA Known Exploited Vulnerabilities catalog, so there is no evidence of active exploitation to date.

Do: Apply the Oracle Critical Patch Update that addresses this flaw on Hyperion Data Relationship Management 11.2.26.0.000 as soon as it is available for your environment. In the interim, restrict HTTP access to DRM endpoints to trusted internal networks or VPN allow-lists and block unauthenticated access at the reverse proxy or web tier. Review DRM audit logs for unexpected unauthenticated requests or unexplained data creation, modification, or deletion activity.

CVE-2026-83462 is a critical (CVSS 9.8) vulnerability in the MWA Terminal Server component of the Oracle Mobile Application Server, part of Oracle E-Business Suite releases 12.2.3 through 12.2.15. An unauthenticated remote attacker who can reach the MWA Terminal Server's TCP port over the network can exploit the flaw without any user interaction or credentials, and a successful attack results in a complete takeover of the Oracle Mobile Application Server with high impact to confidentiality, integrity, and availability. Because exploitation is described as easy and requires no privileges, any EBS environment running an affected version with the MWA service reachable (especially from the internet) is at serious risk of full server compromise. Organizations running EBS 12.2.3-12.2.15 in warehouse, manufacturing, or mobile data-collection deployments are the primary affected population. There is no known public proof-of-concept and the flaw is not on the CISA KEV list, so exploitation status is currently none known.

Do: Apply Oracle's Critical Patch Update that fixes CVE-2026-83462 to all EBS 12.2.3-12.2.15 environments running the Mobile Application Server. Until patched, block external access to the MWA Terminal Server TCP port at the firewall and restrict it to trusted internal networks or VPN clients, or shut down the MWA service if mobile/warehouse functionality is not in use. Review logs for unexpected TCP connections and anomalous terminal sessions on the MWA port to rule out prior exploitation.

CVE-2026-83452 is a critical (CVSS 9.8) flaw in the Internal Operations component of the Oracle Document Management and Collaboration product within Oracle E-Business Suite, affecting releases 12.2.3 through 12.2.15. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges or user interaction, and successful attacks allow complete takeover of the Document Management and Collaboration component with high impact to confidentiality, integrity, and availability. Organizations running affected EBS releases that expose these services to a network — especially internet-facing HTTP endpoints — are at risk of full compromise of sensitive documents and collaboration data. The flaw is addressed in Oracle's Critical Patch Update cycle, but the specific flaw type (e.g., injection or deserialization) was not disclosed by Oracle. No public proof-of-concept or confirmed in-the-wild exploitation has been reported, and the CVE is not on the CISA Known Exploited Vulnerabilities catalog.

Do: Apply the Oracle Critical Patch Update that remediated CVE-2026-83452 to all EBS 12.2.3-12.2.15 environments running Document Management and Collaboration, prioritizing internet-facing instances. Restrict HTTP access to EBS DMC/Internal Operations endpoints via firewall rules or VPN so they are not reachable unauthenticated from untrusted networks. Review access logs for anomalous unauthenticated requests to the affected component and rotate credentials for accounts associated with it if compromise is suspected.

CVE-2026-83355 is a critical (CVSS 9.8) vulnerability in the Metrics component of Oracle Enterprise Manager for Fusion Middleware, affecting supported releases 13.5 and 24.1. It is easily exploitable by an unauthenticated attacker who has network access to the affected system via HTTP, requiring no privileges and no user interaction. A successful attack can result in a complete takeover of Oracle Enterprise Manager for Fusion Middleware, with high impact on confidentiality, integrity, and availability. Because the product is a centralized management console, compromise could also expose credentials and configuration data for the middleware estates it manages. As of now, there is no known public proof of concept, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no in-the-wild exploitation has been reported.

Do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83355 to all Oracle Enterprise Manager for Fusion Middleware 13.5 and 24.1 installations as a priority, given the unauthenticated, network-reachable nature of the flaw. In the interim, restrict HTTP access to the OEM console and Metrics endpoints to trusted management networks via firewall rules or a VPN, and verify the console is not exposed to the public internet. Review audit logs for unexplained administrative changes or new accounts that could indicate attempted compromise.

Oracle WebCenter Enterprise Capture, a component of Oracle Fusion Middleware, contains an easily exploitable flaw in its Client Bundle that allows an unauthenticated attacker with network access via HTTP to compromise the application. Successful attacks can result in a complete takeover of the Enterprise Capture instance, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 9.8). Affected installations run versions 12.2.1.4.0 or 14.1.2.0.0. No public proof-of-concept or confirmed in-the-wild exploitation is known and the CVE is not on the CISA KEV list, but the unauthenticated, low-complexity network vector makes any internet-reachable deployment a high-value target.

Do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83339 to all deployments of WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0. Until patched, restrict HTTP access to the Enterprise Capture client endpoints via VPN or IP allowlisting and monitor for unauthenticated or anomalous requests. Verify whether your Fusion Middleware estate includes WebCenter Enterprise Capture, as this niche component is often missed in WebLogic-focused patch reviews.

CVE-2026-83327 is a critical vulnerability (CVSS 9.8) in the Personalization component of Oracle Applications Framework within Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It is easily exploitable by an unauthenticated attacker who has network access to the target via SOAP, requiring no privileges or user interaction. A successful attack allows the attacker to compromise Oracle Applications Framework and take it over, with high impact on the confidentiality, integrity, and availability of the affected system. Any organization running E-Business Suite Release 12.2 in the affected version range is potentially exposed, particularly instances with SOAP endpoints reachable from untrusted networks. There is no known public proof-of-concept, the flaw is not on the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported as of this writing.

Do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83327 to all E-Business Suite 12.2.3-12.2.15 environments as a top priority given the unauthenticated, network-exploitable nature of the flaw. Until patched, restrict or block unauthenticated network access to SOAP endpoints on the EBS web tier using firewall/WAF rules, and allow-list only trusted integration sources. Review HTTP/SOAP access logs for anomalous unauthenticated requests targeting Applications Framework Personalization services, and treat any confirmed compromise as a full-takeover incident.

CVE-2026-83282 is a critical vulnerability (CVSS 3.1 base score 9.9) in the Platform Security component of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0, part of Oracle Analytics. A low-privileged, authenticated attacker with network access via HTTP can send crafted requests that compromise the OBIEE installation and, because the scope changes, may also significantly impact additional products beyond OBIEE itself. Successful exploitation results in a complete takeover of OBIEE with high impact on confidentiality, integrity, and availability, meaning an attacker could read, alter, or destroy business analytics data and pivot to connected systems. Organizations running the affected 12.2.1.4.0 release, especially instances reachable over a network, are at risk. As of now, the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, no public proof-of-concept is known, and no active exploitation has been reported.

Do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83282 to your OBIEE 12.2.1.4.0 environment as soon as it is available. Restrict network access to OBIEE HTTP endpoints (VPNs, allowlists, WAF rules) so only trusted users can reach the platform, and audit low-privileged accounts for suspicious privilege changes or anomalous activity. Given the scope change, also review access and logs on integrated products that trust OBIEE credentials or share its infrastructure.

Oracle BI Publisher, part of Oracle Analytics, contains an easily exploitable flaw in its BI Platform Security component that lets an unauthenticated attacker with HTTP network access compromise the application. Successful attacks result in a complete takeover of Oracle BI Publisher, with high impacts to confidentiality, integrity, and availability, reflected in a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). Affected deployments include versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, spanning legacy on-premises OBIEE-era releases through the current analytics release. No public proof-of-concept exists and the flaw is not on the CISA Known Exploited Vulnerabilities catalog, but the unauthenticated, network-reachable nature makes internet-facing consoles a high-priority patch target.

Do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83269 to every BI Publisher instance running 8.2.0.0.0, 12.2.1.4.0, or 26.01.0.0.0. Until patched, remove BI Publisher HTTP endpoints from internet exposure and restrict access via VPN or an authenticating reverse proxy. Review web server and BI Publisher logs for unauthenticated HTTP requests as indicators of probing or exploitation attempts.

A critical (CVSS 9.8) vulnerability in the Core component of Oracle Product Lifecycle Analytics, part of the Oracle Supply Chain suite, affects version 3.6.1. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges and no user interaction, and successful attacks can result in complete takeover of the Product Lifecycle Analytics installation with high impact on confidentiality, integrity, and availability. In practice, this means an attacker who can reach the application's web endpoint could seize control of the product and its data. Organizations running the affected version exposed to internal or external networks are at risk. No public proof-of-concept is known, the flaw is not on CISA's KEV list, and no in-the-wild exploitation has been reported to date.

Do: Apply the Oracle Critical Patch Update that addresses this flaw in Product Lifecycle Analytics and confirm the patched version in the relevant Oracle advisory, since only 3.6.1 is listed as affected. Until patched, restrict HTTP access to the application to trusted networks (VPN, firewall allowlisting) rather than leaving it broadly reachable, and front it with authentication at a proxy or SSO layer if possible. Review application and server logs for unexplained account changes, unknown sessions, or data exfiltration indicating prior compromise.

Oracle Agile PLM 9.3.6 contains a critical flaw (CVSS 9.1) in the Event Java PX (Process Extension) component that a high-privileged attacker with network access can exploit over the T3 or IIOP protocols to fully take over the Agile PLM server. Because the vulnerability has a scope change, a successful attack can also significantly impact products beyond Agile PLM itself, with high impact on confidentiality, integrity, and availability. Exploitation is described as easy once the attacker holds the required high privileges, which effectively turns any compromised admin account or trusted network foothold into complete server compromise. The affected population is enterprises running the on-premises Oracle Agile PLM 9.3.6 release, common in manufacturing and product-development environments. No public proof-of-concept exists and the flaw is not in the CISA Known Exploited Vulnerabilities catalog, so there is no evidence of in-the-wild exploitation at this time.

Do: Apply the corresponding Oracle Critical Patch Update to Agile PLM 9.3.6 as soon as it is available for this CVE. In the meantime, restrict T3 and IIOP listener access at the firewall to trusted admin clients only, since the flaw requires high privileges — audit privileged Agile/WebLogic accounts and rotate credentials that may be exposed. Review deployed Event Java PX extensions and server logs for unauthorized changes or suspicious T3/IIOP activity, and accelerate planning to migrate off the aging 9.3.6 line toward Oracle Fusion Cloud PLM.

Oracle Data Integrator, a component of Oracle Fusion Middleware, contains an easily exploitable flaw in the Console / Repository Explorer component that allows an unauthenticated attacker with network access over HTTP to fully compromise the product. Successful exploitation results in complete takeover of Oracle Data Integrator, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 9.8). The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0, meaning organizations running current releases on those branches are exposed. Any instance whose Console or Repository Explorer is reachable by an attacker — particularly if internet-exposed — is at risk. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the CVE is not on the CISA KEV list, though the unauthenticated, network-exploitable nature makes it a high-priority patch target.

Do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83232 if you run Oracle Data Integrator 12.2.1.4.0 or 14.1.2.0.0. Until patched, restrict network access to the ODI Console and Repository Explorer (allow-list trusted hosts, require VPN/authentication at a reverse proxy) and verify these endpoints are not exposed to the internet. Review Console and Repository Explorer access logs for unexplained or unauthenticated activity as an indicator of attempted exploitation.

A critical vulnerability (CVSS 9.1) exists in the Siebel Management Console component of Oracle Siebel CRM Deployment, affecting supported versions 17.0 through 26.7. It is easily exploitable by a high-privileged attacker with network access via HTTP, allowing them to fully compromise the Siebel CRM Deployment. The vulnerability has a scope change (S:C), meaning successful attacks can significantly impact additional products beyond the Siebel CRM Deployment component itself. Successful exploitation results in a complete takeover of the deployment with high impacts to confidentiality, integrity, and availability. There is no evidence of in-the-wild exploitation, and no public proof-of-concept is known.

Do: Apply the Oracle Critical Patch Update that remediates this flaw to all Siebel CRM deployments running versions 17.0-26.7. Restrict network access to the Siebel Management Console so it is reachable only from trusted administrative networks, and enforce least-privilege on the high-privileged accounts that could be leveraged in an attack. Audit Management Console logs for anomalous activity by high-privilege accounts and monitor for unexpected configuration or deployment changes.

CVE-2026-83202 is a critical (CVSS 9.1) flaw in the Server Infrastructure component of Oracle Siebel CRM Deployment, affecting supported versions 17.0 through 26.7. It is easily exploitable by an unauthenticated attacker with network access via HTTP, meaning no valid credentials or user interaction are required. A successful attack allows the attacker to create, delete, or modify critical data (or all data accessible to the Siebel CRM Deployment component), as well as read critical or all accessible data; availability is not impacted. Organizations running affected Siebel CRM versions with the deployment/server infrastructure reachable over a network — especially internet-exposed Siebel web endpoints — are at risk of silent data theft and tampering. The flaw is not in the CISA KEV catalog and no public proof-of-concept is known, so exploitation status is currently none known.

Do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83202 and move to a Siebel CRM release beyond the affected 17.0-26.7 range. Until patched, restrict HTTP access to Siebel Deployment/Server Infrastructure endpoints using firewalls, reverse proxies, or VPN-only access, and disable any unnecessary internet exposure. Review application and database audit logs for unauthenticated access patterns and unexplained creation, modification, or deletion of Siebel data.

CVE-2026-83197 is a critical (CVSS 9.1) flaw in the Financial Accounts component of Oracle Siebel Apps - Financial Services, affecting all supported versions from 17.0 through 26.7. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges or user interaction. A successful attack allows the attacker to read critical data — up to complete access to all data accessible through Siebel Apps - Financial Services — and to cause a hang or frequently repeatable crash, resulting in complete denial of service. Integrity impact is rated as none, so the flaw is primarily a confidentiality and availability risk rather than code execution. No public proof-of-concept exists and the vulnerability is not on the CISA KEV list, so exploitation in the wild is not currently known.

Do: Check Oracle's latest Critical Patch Update for the Siebel Financial Services fix and apply it to all instances running versions 17.0-26.7. In the interim, restrict HTTP access to Siebel Apps - Financial Services endpoints (network segmentation, VPN, or WAF rules) so they are not reachable by unauthenticated users or the internet. Review logs for anomalous unauthenticated requests against the Financial Accounts component and monitor for unexplained data access or repeated crashes/hangs.

CVE-2026-83154 is a critical (CVSS 9.1) vulnerability in the Open UI component of Oracle Siebel CRM's End User product, affecting all supported versions from 17.0 through 26.7. It is easily exploitable by an unauthenticated attacker with network access who can reach the product's SOAP interface, requiring no privileges or user interaction. A successful attack lets the attacker create, delete, or modify critical data — or all data accessible to the Siebel CRM End User application — as well as read that data in full, with high impacts on both confidentiality and integrity (availability is not affected). Any organization running Siebel CRM within the affected version range with a network-reachable SOAP endpoint is exposed, particularly if the service is internet-facing. The flaw is not currently listed in CISA's KEV catalog, no public proof-of-concept is known, and no exploitation in the wild has been reported.

Do: Apply the Oracle Critical Patch Update that fixes CVE-2026-83154 for your Siebel Innovation Release, or upgrade to a release later than 26.7 (e.g., 26.8+). Restrict and segment network access to Siebel SOAP/EAI web service endpoints so they are not reachable from untrusted networks such as the internet. Review application and web server logs for unauthenticated SOAP requests, unexpected record creation/deletion, or anomalous data modifications that could indicate prior probing or compromise.

Oracle Service Delivery Platform (a Fusion Middleware product, specifically the Messaging Enabler component) contains an easily exploitable vulnerability that lets an unauthenticated remote attacker compromise the platform through its SOAP interface over the network. Successful exploitation can result in a complete takeover of the Service Delivery Platform, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Versions 12.2.1.4.0 and 14.1.2.0.0 are the supported releases confirmed as affected. The product is primarily deployed by communications service providers, so exposure is limited to telecom operator environments rather than the general internet. No public proof-of-concept exists and the flaw is not on CISA's Known Exploited Vulnerabilities catalog, so exploitation is currently none known.

Do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83151 to Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 as soon as possible. Restrict network access to the Messaging Enabler SOAP endpoints so only trusted internal systems (e.g., charging, provisioning, and mediation platforms) can reach them, and block unauthenticated SOAP traffic at perimeter firewalls. Review logs for unexpected SOAP requests or administrative activity against these endpoints to rule out prior exploitation.

CVE-2026-83149 is an easily exploitable vulnerability in Oracle Application Testing Suite (OATS) version 13.3.0.1 that allows a low-privileged attacker holding the 'Test Manager for Web Apps' privilege to compromise the suite over HTTP via the network. The flaw carries a scope change (CVSS 3.1 score 9.1, vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L), meaning successful attacks on OATS may significantly impact additional products beyond it. A successful exploit gives the attacker unauthorized read access to critical data or complete access to all OATS-accessible data, unauthorized update, insert, or delete access to some of that data, and the ability to cause a partial denial of service. Only organizations running OATS 13.3.0.1 with network-reachable (HTTP) consoles and accounts with the Test Manager for Web Apps privilege are affected. No public proof of concept is known and the vulnerability is not on the CISA KEV list, so there is no indication of in-the-wild exploitation at this time.

Do: Apply the Oracle Critical Patch Update that remediated CVE-2026-83149 to all Oracle Application Testing Suite 13.3.0.1 installations. Restrict HTTP access to OATS consoles so only trusted QA networks and VPN clients can reach them, and review 'Test Manager for Web Apps' accounts for compromise, unexpected data access, or unauthorized modifications. Audit logs for anomalous activity and avoid exposing OATS endpoints directly to the internet.

CVE-2026-83099 is a critical (CVSS 3.1 base score 10.0) unauthenticated vulnerability in the Forms Services client/server and character-mode components of Oracle Forms, part of Oracle Fusion Middleware. It is triggered remotely over HTTP by an attacker with no credentials and no user interaction, and successful exploitation results in a complete takeover of Oracle Forms with full impact to confidentiality, integrity, and availability. The CVSS vector includes a scope change (S:C), meaning attacks against the vulnerable Forms component can also significantly impact additional products on the compromised host. Affected deployments are Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. No public proof of concept exists, the flaw is not on the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported to date.

Do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83099 to all Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 installations as an emergency change, prioritizing any Forms Services endpoints reachable over the network. Remove internet exposure for Forms servlets and restrict access to trusted networks or VPN, and place the service behind an authenticating reverse proxy where possible. Review HTTP access logs for unauthenticated requests to Forms Services endpoints and watch for anomalous process or file activity on Forms hosts, since the scope change means adjacent products on the same server may be impacted after compromise.