---METADATA---
VENDOR: Oracle
PRODUCT: Oracle Unified Directory
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in Oracle Unified Directory allows a low privileged, network-based attacker to perform a full system takeover, with potential impacts extending to other integrated products.

Executive Summary:
An easily exploitable vulnerability in Oracle Unified Directory (versions 12.2.1.4.0 and 14.1.2.1.0) allows low privileged attackers to achieve a complete takeover of the directory service.

Vulnerability Details

CVE-ID: CVE-2026-60429

Affected Software: Oracle Unified Directory

Affected Versions: 12.2.1.4.0, 14.1.2.1.0

Vulnerability: This vulnerability enables a low privileged attacker with LDAP network access to compromise the Oracle Unified Directory, resulting in a full system takeover and significant scope impact on secondary integrated applications.

Business Impact

With a CVSS 3.1 base score of 9.9, this vulnerability poses a severe threat to the organization. A full system takeover allows an attacker to exfiltrate all stored identity information, modify access permissions, or disrupt critical business authentication workflows, leading to catastrophic reputational and operational damage.

Remediation Plan

Immediate Action: Update all instances of Oracle Unified Directory to the latest patched version specified in the July 2026 Oracle Critical Patch Update.

Proactive Monitoring: Monitor directory service logs for evidence of unauthorized administrative actions or unexpected changes to system configurations.

Compensating Controls: Utilize a Web Application Firewall or specialized LDAP inspection tools to identify and block malicious traffic patterns attempting to exploit the directory infrastructure.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the vulnerability is low, meaning it is highly likely to be targeted by malicious actors once the technical details are better understood.

Analyst Recommendation

This vulnerability represents a critical risk that must be addressed immediately through official vendor patching. Organizations should treat this as a top priority to prevent unauthorized system takeover and potential data breaches.

---METADATA---
VENDOR: Oracle
PRODUCT: Unified Directory
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Oracle Unified Directory (OUD) Core component allows a low privileged attacker to compromise the directory server via LDAP.

Executive Summary:
An easily exploitable vulnerability in Oracle Unified Directory allows authenticated attackers to gain unauthorized control over the directory services.

Vulnerability Details

CVE-ID: CVE-2026-60423

Affected Software: Oracle Unified Directory

Affected Versions: 12.2.1.4.0, 14.1.2.1.0

Vulnerability: This vulnerability affects the OUD Core component and allows a low privileged attacker with LDAP network access to perform actions that result in the takeover of the Oracle Unified Directory service.

Business Impact

The impact of this vulnerability is significant, as OUD acts as a critical piece of infrastructure for identity and access management. The CVSS score of 8.8 indicates that a successful compromise could allow an attacker to gain unauthorized access to directory information, potentially leading to widespread lateral movement or persistent access within the environment.

Remediation Plan

Immediate Action: Apply the security updates provided in the July 2026 Oracle Critical Patch Update to resolve the underlying flaw in the OUD Core.

Proactive Monitoring: Review LDAP access logs for anomalous activity, such as unauthorized configuration changes or unexpected queries that may indicate exploitation attempts.

Compensating Controls: Utilize network segmentation and firewalls to restrict access to the LDAP service to known-good internal clients and administrative workstations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is not confirmed, the ease of access via LDAP necessitates immediate attention.

Analyst Recommendation

Organizations should prioritize the deployment of the July 2026 security patches for all Oracle Unified Directory installations. Given the risk to identity infrastructure, failure to patch could lead to significant security breaches and loss of control over user authentication mechanisms.

---METADATA---
VENDOR: Oracle
PRODUCT: Oracle Unified Directory
AFFECTED_VERSIONS: 14.1.2.1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in Oracle Unified Directory allows a low privileged attacker with network access via LDAP to compromise the directory, potentially impacting other products through scope change.

Executive Summary:
An easily exploitable vulnerability in Oracle Unified Directory (version 14.1.2.1.0) allows low privileged attackers to gain unauthorized access and compromise critical directory data.

Vulnerability Details

CVE-ID: CVE-2026-60422

Affected Software: Oracle Unified Directory

Affected Versions: 14.1.2.1.0

Vulnerability: This is a remotely exploitable vulnerability that allows an authenticated attacker with low privileges to leverage LDAP network access to perform unauthorized data modifications, deletions, or full data exfiltration, while also potentially causing a partial denial of service.

Business Impact

The criticality of this vulnerability is reflected in its CVSS 3.1 base score of 9.9, which indicates an extreme risk to confidentiality, integrity, and availability. Successful exploitation could lead to a complete compromise of identity and directory services, resulting in unauthorized access to sensitive corporate data and significant operational disruption.

Remediation Plan

Immediate Action: Apply the relevant security patch provided in the July 2026 Oracle Critical Patch Update advisory.

Proactive Monitoring: Review LDAP access logs for anomalous query patterns, unauthorized modification attempts, or unusual traffic spikes originating from low privileged user accounts.

Compensating Controls: Implement strict network segmentation to restrict LDAP access to trusted internal systems only and ensure that Principle of Least Privilege is enforced for all directory user accounts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly dangerous due to its ease of exploitation and the scope of its potential impact on integrated systems.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for full directory compromise, it is imperative that organizations prioritize the application of the official vendor patch. Immediate action is required to secure the environment against potential exploitation.

---METADATA---
VENDOR: Oracle
PRODUCT: Unified Directory
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Oracle Unified Directory (OUD) Core component allows a low privileged attacker to compromise the directory server via LDAP.

Executive Summary:
An easily exploitable vulnerability in Oracle Unified Directory allows authenticated attackers to gain unauthorized control over the directory services.

Vulnerability Details

CVE-ID: CVE-2026-60419

Affected Software: Oracle Unified Directory

Affected Versions: 12.2.1.4.0, 14.1.2.1.0

Vulnerability: This vulnerability affects the OUD Core component and allows a low privileged attacker with LDAP network access to execute commands or manipulate directory data, ultimately leading to a full system takeover.

Business Impact

A compromise of Oracle Unified Directory is critical as it often serves as a centralized identity and access management repository. A CVSS score of 8.8 reflects the high severity, as an attacker gaining control of the directory could potentially escalate privileges, access sensitive identity data, or disrupt authentication services across the entire enterprise.

Remediation Plan

Immediate Action: Apply the security patches provided in the July 2026 Oracle Critical Patch Update to all affected OUD instances.

Proactive Monitoring: Monitor LDAP traffic and server logs for unusual bind requests or administrative actions performed by low privileged accounts.

Compensating Controls: Implement strict network access control lists (ACLs) to ensure only authorized clients can communicate with the LDAP interface of the Unified Directory server.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because LDAP interfaces often have broad visibility within corporate networks.

Analyst Recommendation

Security teams should treat this vulnerability with high urgency. Because OUD is a foundational component for identity management, patching should be performed during the next maintenance window or immediately if the directory is exposed to broader network segments.

---METADATA---
VENDOR: Oracle
PRODUCT: TimesTen In-Memory Database
AFFECTED_VERSIONS: 26.1.1.1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical vulnerability in the Oracle TimesTen In-Memory Database Kubernetes Operator allows low privileged attackers to achieve full system takeover.

Executive Summary:
A critical, easily exploitable vulnerability in the Oracle TimesTen In-Memory Database Kubernetes Operator allows authenticated attackers to gain full control over the database environment.

Vulnerability Details

CVE-ID: CVE-2026-60402

Affected Software: Oracle TimesTen In-Memory Database

Affected Versions: 26.1.1.1.0

Vulnerability: This vulnerability affects the Kubernetes Operator component and can be triggered by an attacker with low privileges via HTTPS. It involves a scope change that enables the attacker to escalate privileges and take over the entire database instance.

Business Impact

With a CVSS score of 9.9, this vulnerability represents a severe threat to infrastructure integrity. A successful exploit grants an attacker full administrative control over the database, potentially leading to total loss of confidentiality, integrity, and availability for all data managed by the system.

Remediation Plan

Immediate Action: Update the Oracle TimesTen In-Memory Database to the latest available version provided in the July 2026 Oracle Critical Patch Update. Consult the official Oracle security advisory for specific installation instructions.

Proactive Monitoring: Audit access logs for the Kubernetes Operator and database management interfaces for unauthorized or unusual activity. Monitor for unexpected configuration changes or unauthorized service deployments.

Compensating Controls: Restrict network access to the Kubernetes Operator interface to only authorized management workstations. Utilize Kubernetes Network Policies to isolate the database and its management components from untrusted segments of the network.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. However, the high CVSS score and the ability to achieve a full system takeover make it an attractive target.

Analyst Recommendation

Organizations running the affected version of Oracle TimesTen must prioritize this update as part of their next maintenance window. The potential for full system takeover necessitates strict access controls and immediate patching to minimize exposure to internal threats.

---METADATA---
VENDOR: Oracle
PRODUCT: GoldenGate
AFFECTED_VERSIONS: 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, 23.4 through 23.26.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the Oracle GoldenGate Admin Server allows a low privileged attacker with network access to compromise the application.

Executive Summary:
An easily exploitable security vulnerability in Oracle GoldenGate allows authenticated attackers to achieve full system takeover.

Vulnerability Details

CVE-ID: CVE-2026-60400

Affected Software: Oracle GoldenGate

Affected Versions: 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, 23.4 through 23.26.1

Vulnerability: This is an easily exploitable flaw within the Admin Server component that permits a low privileged user with HTTPS network access to execute unauthorized actions, leading to a complete compromise of the GoldenGate instance.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to data integrity and system availability. With a CVSS score of 8.8, the potential for unauthorized administrative takeover means an attacker could exfiltrate sensitive data, manipulate database replication streams, or disrupt critical business operations.

Remediation Plan

Immediate Action: Apply the security updates provided in the July 2026 Oracle Critical Patch Update immediately.

Proactive Monitoring: Review access logs for the Admin Server for suspicious HTTP requests originating from low privileged user accounts.

Compensating Controls: Restrict network access to the Admin Server interface to trusted management subnets using firewalls or VPNs to limit the exposure of the management port.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly dangerous due to the low barrier to entry for authenticated attackers.

Analyst Recommendation

Given the high CVSS score and the potential for full system takeover, organizations must prioritize patching this vulnerability. Administrators should verify their current GoldenGate version against the affected ranges and apply the vendor-supplied security updates as soon as they are available.

---METADATA---
VENDOR: Oracle
PRODUCT: GoldenGate
AFFECTED_VERSIONS: 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, 23.4 through 23.26.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in Oracle GoldenGate Microservices allows an authenticated attacker with network access to achieve a full system takeover.

Executive Summary:
A high-severity vulnerability in Oracle GoldenGate Microservices allows low-privileged attackers to gain unauthorized control over the application.

Vulnerability Details

CVE-ID: CVE-2026-60398

Affected Software: Oracle GoldenGate

Affected Versions: 19.1.0.0.0 through 19.30.0.0, 21.3 through 21.21, 23.4 through 23.26.1

Vulnerability: This vulnerability affects the Microservices component of Oracle GoldenGate, permitting a low-privileged, authenticated attacker to compromise the system through HTTP-based network access.

Business Impact

Exploitation of this vulnerability could lead to the compromise of data synchronization processes, potentially allowing an attacker to manipulate or exfiltrate sensitive data in transit. With a CVSS score of 8.8, this flaw represents a significant risk to the integrity of business data pipelines and overall system availability.

Remediation Plan

Immediate Action: Update Oracle GoldenGate instances to the versions identified as secure in the July 2026 Oracle Critical Patch Update.

Proactive Monitoring: Monitor GoldenGate Microservices logs for signs of unauthorized access or unusual administrative activity.

Compensating Controls: Restrict network access to the GoldenGate management interfaces to trusted IP ranges only to reduce the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to its potential for full application takeover.

Analyst Recommendation

The broad range of affected versions requires immediate attention from system administrators. It is critical to apply the necessary patches to maintain the security and integrity of your data integration infrastructure.

---METADATA---
VENDOR: Oracle
PRODUCT: Service Delivery Platform
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical vulnerability in the Oracle Service Delivery Platform Messaging Enabler component allows unauthenticated attackers to achieve full system takeover via HTTP network requests.

Executive Summary:
An unauthenticated, remotely exploitable vulnerability in Oracle Service Delivery Platform poses a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-60389

Affected Software: Oracle Service Delivery Platform

Affected Versions: 12.2.1.4.0, 14.1.2.0.0

Vulnerability: This critical flaw resides in the Messaging Enabler component, permitting an unauthenticated attacker to remotely compromise the platform using HTTP requests. The vulnerability is easily exploitable and does not require user interaction.

Business Impact

With a CVSS score of 10.0, this vulnerability represents an extreme threat to confidentiality, integrity, and availability. Successful exploitation grants the attacker total control over the platform, which could facilitate unauthorized data exfiltration, service disruption, or further lateral movement within the corporate network.

Remediation Plan

Immediate Action: Organizations must consult the July 2026 Oracle Critical Patch Update and apply the mandated security patches to all instances of the Service Delivery Platform.

Proactive Monitoring: Inspect web server logs for suspicious HTTP requests and monitor for any unexplained modifications to system configurations or user accounts.

Compensating Controls: Deploy WAF rules to block malicious HTTP traffic patterns and ensure the platform is not exposed to the public internet unless absolutely necessary.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw makes it highly attractive to threat actors, necessitating immediate attention.

Analyst Recommendation

The severity of this issue necessitates an emergency patching cycle. Administrators should identify all affected Oracle Service Delivery Platform deployments and apply the vendor-provided patches immediately to mitigate the risk of remote system compromise.

---METADATA---
VENDOR: Oracle
PRODUCT: Service Delivery Platform
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical vulnerability in Oracle Service Delivery Platform allows an authenticated attacker to achieve a complete system takeover via the Messaging Enabler component.

Executive Summary:
A critical vulnerability in Oracle Service Delivery Platform allows authenticated attackers to gain full control over the system.

Vulnerability Details

CVE-ID: CVE-2026-60381

Affected Software: Oracle Service Delivery Platform

Affected Versions: 12.2.1.4.0, 14.1.2.0.0

Vulnerability: This vulnerability resides in the Messaging Enabler component and is easily exploitable by a low-privileged attacker. Using network access via T3 or IIOP protocols, the attacker can execute a full system takeover, potentially impacting other associated products due to a scope change.

Business Impact

With a CVSS score of 9.9, this vulnerability poses an existential risk to the affected infrastructure. A full system takeover allows an attacker to bypass all security controls, potentially leading to total data loss, complete service outages, and the compromise of all information managed by or accessible to the Service Delivery Platform.

Remediation Plan

Immediate Action: Install the official security updates released by Oracle in the July 2026 CPU cycle to remediate this vulnerability.

Proactive Monitoring: Monitor for any signs of unauthorized administrative activity or unexpected changes to system configurations within the Messaging Enabler.

Compensating Controls: If patching is delayed, isolate the Service Delivery Platform from external networks and strictly control internal access to T3 and IIOP ports.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Given the ease of exploitability, systems should be treated as high-risk until the vendor-supplied patch is applied.

Analyst Recommendation

This vulnerability is highly severe and must be prioritized for immediate remediation. Administrators should ensure that all affected Service Delivery Platform instances are patched promptly to prevent the risk of a full system compromise.

---METADATA---
VENDOR: Oracle
PRODUCT: Service Delivery Platform
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical vulnerability in the Oracle Service Delivery Platform Messaging Enabler component allows unauthenticated attackers to achieve full system takeover via network-accessible SOAP requests.

Executive Summary:
An unauthenticated, remotely exploitable vulnerability in Oracle Service Delivery Platform poses a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-60379

Affected Software: Oracle Service Delivery Platform

Affected Versions: 12.2.1.4.0, 14.1.2.0.0

Vulnerability: This is a critical security flaw in the Messaging Enabler component that allows an unauthenticated attacker to execute arbitrary actions via SOAP. The vulnerability supports remote exploitation without requiring user interaction or prior authentication.

Business Impact

The CVSS 3.1 score of 10.0 reflects the maximum severity of this flaw, indicating that a successful exploit can lead to a complete takeover of the platform. Because the vulnerability allows for scope change, attackers may leverage this access to pivot into and compromise other connected infrastructure, resulting in significant data loss, service outages, and severe reputational damage.

Remediation Plan

Immediate Action: Administrators must review the July 2026 Oracle Critical Patch Update advisory and apply the necessary patches for versions 12.2.1.4.0 and 14.1.2.0.0 immediately.

Proactive Monitoring: Security teams should monitor network traffic for anomalous SOAP requests targeting the Messaging Enabler and review system logs for unauthorized administrative activity.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall (WAF) with custom rules to filter out suspicious or malformed SOAP traffic directed at the Service Delivery Platform.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly dangerous due to its ease of exploitation and the lack of authentication requirements.

Analyst Recommendation

Given the critical CVSS score of 10.0, this vulnerability must be treated as a top priority for remediation. Organizations running the affected Oracle Service Delivery Platform versions should apply vendor-supplied patches as soon as they are made available to prevent unauthorized system takeover.

---METADATA---
VENDOR: Oracle
PRODUCT: Service Delivery Platform
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical vulnerability in Oracle Service Delivery Platform allows authenticated attackers to perform unauthorized data modification and partial denial of service via T3 or IIOP protocols.

Executive Summary:
A critical vulnerability in Oracle Service Delivery Platform permits authenticated attackers to manipulate sensitive data and disrupt service operations.

Vulnerability Details

CVE-ID: CVE-2026-60377

Affected Software: Oracle Service Delivery Platform

Affected Versions: 12.2.1.4.0, 14.1.2.0.0

Vulnerability: This vulnerability affects the Messaging Enabler component and is easily exploitable by an attacker with low-level privileges. By leveraging network access via T3 or IIOP protocols, an attacker can gain unauthorized access to critical data or perform destructive actions, such as data deletion or modification, alongside causing a partial denial of service.

Business Impact

The CVSS score of 9.9 underscores the severity of this flaw, which poses a significant threat to data integrity and service availability. Because this affects the Service Delivery Platform, the scope of the impact can extend to other integrated systems, potentially leading to widespread operational disruption and the compromise of sensitive business data.

Remediation Plan

Immediate Action: Apply the relevant security patches provided by Oracle in the July 2026 Critical Patch Update.

Proactive Monitoring: Review system logs for anomalous T3 or IIOP traffic patterns, specifically focusing on unauthorized attempts to modify or delete data records.

Compensating Controls: Restrict T3 and IIOP protocol access at the network layer to authorized application servers only to reduce the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The combination of easy exploitability and high-impact access makes this a priority for any environment utilizing the Messaging Enabler.

Analyst Recommendation

The potential for unauthorized data modification and service disruption requires urgent attention. Security teams should move quickly to verify their current version and apply the necessary patches to protect the integrity of the Service Delivery Platform.

---METADATA---
VENDOR: Oracle
PRODUCT: Oracle Platform Security for Java
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the Centralized Thirdparty Jars component of Oracle Platform Security for Java allows a low privileged attacker to compromise the platform via HTTP requests.

Executive Summary:
An authenticated network vulnerability in Oracle Platform Security for Java allows low privileged attackers to achieve full system takeover via HTTP.

Vulnerability Details

CVE-ID: CVE-2026-60373

Affected Software: Oracle Platform Security for Java

Affected Versions: 12.2.1.4.0, 14.1.2.0.0

Vulnerability: The flaw resides in the Centralized Thirdparty Jars component and is easily exploitable by a low privileged attacker with network access via the HTTP protocol, resulting in potential platform takeover.

Business Impact

The ability to compromise the Oracle Platform Security for Java product via standard HTTP traffic presents a significant risk to enterprise middleware infrastructure. With a CVSS score of 8.8, successful exploitation could lead to unauthorized administrative control and severe impacts on the security posture of the entire application environment.

Remediation Plan

Immediate Action: Apply the July 2026 Oracle Critical Patch Update to secure the affected Fusion Middleware components.

Proactive Monitoring: Monitor web application logs for suspicious HTTP requests and patterns indicative of exploitation attempts against the platform.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and filter incoming HTTP traffic for malicious payloads targeting the middleware.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While this vulnerability requires low privileges, the accessibility of HTTP interfaces makes it a high-priority target.

Analyst Recommendation

Immediate application of the vendor-supplied security patches is required to protect against this vulnerability. Administrators should prioritize identifying and patching all affected Oracle Fusion Middleware instances across the network.

---METADATA---
VENDOR: Oracle
PRODUCT: Oracle Platform Security for Java
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A security vulnerability exists in Oracle Platform Security for Java, allowing an authenticated low-privileged attacker to achieve full system takeover via the physical communication segment.

Executive Summary:
A critical vulnerability in Oracle Platform Security for Java allows for unauthorized system takeover, posing a significant risk to the integrity and availability of Fusion Middleware environments.

Vulnerability Details

CVE-ID: CVE-2026-60371

Affected Software: Oracle Platform Security for Java

Affected Versions: 12.2.1.4.0, 14.1.2.0.0

Vulnerability: This vulnerability involves the Centralized Thirdparty Jars component and requires an attacker to have low-level privileges and access to the local physical communication segment. It is classified as an authenticated attack vector that results in a scope change, allowing the compromise of the underlying platform and potentially associated products.

Business Impact

The successful exploitation of this vulnerability can result in the complete takeover of the Oracle Platform Security for Java component. Given the CVSS score of 8.0, this represents a high-severity risk that could lead to unauthorized data access, service disruption, and the compromise of broader Fusion Middleware infrastructure due to the scope change associated with this flaw.

Remediation Plan

Immediate Action: Organizations should review the official Oracle July 2026 Critical Patch Update and apply all relevant security patches as soon as they become available.

Proactive Monitoring: Security teams should monitor network traffic for anomalous activity originating from within the local physical segment and review authentication logs for suspicious low-privileged user behavior.

Compensating Controls: Restrict access to the physical communication segment where the Oracle Fusion Middleware components reside and implement strict network segmentation to limit the potential impact of an internal attacker.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is theoretically significant, the requirement for physical communication segment access and low-privileged authentication makes it more difficult to weaponize in a standard enterprise environment.

Analyst Recommendation

While the complexity of this attack is high, the potential for total system takeover necessitates a proactive posture. Administrators should prioritize the deployment of the vendor-supplied patches once released and maintain strict access controls over the physical network segments housing critical middleware infrastructure to minimize the attack surface.

---METADATA---
VENDOR: Oracle
PRODUCT: Oracle Platform Security for Java
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical vulnerability in Oracle Platform Security for Java allows low privileged attackers to compromise the environment via HTTP.

Executive Summary:
This critical vulnerability in Oracle Platform Security for Java allows low privileged attackers to escalate their access and achieve full system takeover.

Vulnerability Details

CVE-ID: CVE-2026-60369

Affected Software: Oracle Platform Security for Java

Affected Versions: 12.2.1.4.0, 14.1.2.0.0

Vulnerability: This flaw exists in the Centralized Thirdparty Jars component and allows an attacker with low privileges to execute arbitrary commands over HTTP, resulting in a complete takeover of the component and potentially impacting other integrated products.

Business Impact

The CVSS score of 9.9 highlights an extreme risk of unauthorized access and system control. Even though the attacker requires low privileges, the potential for a scope change means that a successful attack could compromise the entire Oracle Fusion Middleware ecosystem, causing significant operational disruption and data loss.

Remediation Plan

Immediate Action: Update to the latest version of Oracle Platform Security for Java as specified in the July 2026 Oracle Critical Patch Update.

Proactive Monitoring: Review access logs for suspicious activity originating from low-privileged service accounts and monitor for unexpected changes in system configuration.

Compensating Controls: Enforce the principle of least privilege for all accounts with access to the middleware environment and utilize WAF protections to inspect incoming traffic for exploitation patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's high severity stems from the potential for internal privilege escalation leading to full system takeover.

Analyst Recommendation

Organizations should prioritize applying the July 2026 CPU patches to all affected Oracle instances. While this vulnerability requires low-level privileges, the ability to escalate to a full takeover warrants immediate remediation to prevent internal threats or compromised accounts from expanding their access.

---METADATA---
VENDOR: Oracle
PRODUCT: Oracle Platform Security for Java
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the Centralized Thirdparty Jars component of Oracle Platform Security for Java allows a low privileged attacker to compromise the platform via SOAP requests.

Executive Summary:
An authenticated network vulnerability in Oracle Platform Security for Java allows low privileged attackers to achieve full system takeover.

Vulnerability Details

CVE-ID: CVE-2026-60368

Affected Software: Oracle Platform Security for Java

Affected Versions: 12.2.1.4.0, 14.1.2.0.0

Vulnerability: This flaw exists in the Centralized Thirdparty Jars component and is easily exploitable by an attacker with low privileges who has network access to the target via the SOAP protocol.

Business Impact

A successful exploit allows for the complete takeover of the Oracle Platform Security for Java environment. With a CVSS score of 8.8, this vulnerability poses a severe risk to the confidentiality, integrity, and availability of critical middleware services, potentially leading to unauthorized data access or service disruption.

Remediation Plan

Immediate Action: Apply the latest Oracle Critical Patch Update for July 2026 to address the identified vulnerability in the middleware stack.

Proactive Monitoring: Monitor network traffic for anomalous SOAP requests and review server access logs for unauthorized attempts to interact with the security platform.

Compensating Controls: Implement strict network segmentation and firewall rules to restrict access to the affected middleware components to authorized personnel only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for low privileged access reduces the attack surface but remains a critical risk for internal threat scenarios.

Analyst Recommendation

Given the potential for full system takeover, organizations running Oracle Fusion Middleware should treat this update as a high priority. Ensure the latest Oracle security patches are applied in accordance with vendor guidelines to mitigate this risk.

---METADATA---
VENDOR: Oracle
PRODUCT: Oracle Platform Security for Java
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical vulnerability in Oracle Platform Security for Java allows unauthenticated, remote attackers to achieve a full takeover of the application via HTTP.

Executive Summary:
This critical, easily exploitable vulnerability in Oracle Platform Security for Java allows unauthenticated remote attackers to achieve full system compromise with cross-product impact.

Vulnerability Details

CVE-ID: CVE-2026-60366

Affected Software: Oracle Platform Security for Java

Affected Versions: 12.2.1.4.0, 14.1.2.0.0

Vulnerability: This is a critical security flaw in the Centralized Thirdparty Jars component that enables an unauthenticated attacker with network access to execute unauthorized actions, resulting in a full takeover of the component and potentially impacting related middleware products.

Business Impact

With a CVSS score of 10.0, this vulnerability represents the highest level of risk to confidentiality, integrity, and availability. Successful exploitation could lead to total system compromise, unauthorized data access, and the potential for lateral movement across the broader Oracle Fusion Middleware environment.

Remediation Plan

Immediate Action: Apply the latest Oracle Critical Patch Update (CPU) for July 2026 to address this vulnerability.

Proactive Monitoring: Monitor network traffic for anomalous HTTP requests directed at middleware components and audit system logs for signs of unauthorized execution or privilege escalation.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall (WAF) with updated rulesets to detect and block malicious payloads targeting Oracle middleware.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. However, the ease of exploitation and high severity necessitate an aggressive patching posture.

Analyst Recommendation

Given the perfect 10.0 CVSS score and the potential for cross-scope impact, this vulnerability must be treated as a top-tier priority. Administrators should consult the July 2026 Oracle security alert and apply necessary patches during the next maintenance window.

---METADATA---
VENDOR: Oracle
PRODUCT: Oracle HTTP Server
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.0.0, 15.1.1.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical, unauthenticated remote code execution vulnerability exists in the Oracle WebLogic Server Proxy Plug-in for third-party web servers.

Executive Summary:
A critical, unauthenticated vulnerability in the Oracle WebLogic Server Proxy Plug-in allows attackers to compromise sensitive data and manipulate web server operations.

Vulnerability Details

CVE-ID: CVE-2026-60365

Affected Software: Oracle HTTP Server and WebLogic Server Proxy Plug-in

Affected Versions: 12.2.1.4.0, 14.1.2.0.0, 15.1.1.0.0

Vulnerability: This is an easily exploitable, unauthenticated vulnerability allowing remote attackers to send malicious HTTP requests to the proxy plug-in. This flaw enables unauthorized access to critical data and the ability to modify or delete sensitive information.

Business Impact

This vulnerability holds a CVSS score of 10.0, signifying the maximum level of severity. An unauthenticated attacker can achieve full access to data managed by the proxy, potentially leading to massive data breaches, service disruption, and compromise of the entire web application architecture.

Remediation Plan

Immediate Action: Update the Oracle HTTP Server and WebLogic Server Proxy Plug-in to the versions specified in the July 2026 Oracle Critical Patch Update. Verify the deployment of these patches across all affected web server instances.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests, specifically those targeting the proxy configuration or unusual patterns that suggest injection attempts. Alert on unauthorized modifications to the web server environment.

Compensating Controls: Deploy a WAF with strict input validation rules to inspect and filter traffic destined for the WebLogic Proxy Plug-in. Ensure that the web server is configured with the principle of least privilege to limit the impact of a potential breach.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Its status as an unauthenticated, critical vulnerability makes it highly susceptible to future automated exploitation.

Analyst Recommendation

Due to the critical severity and unauthenticated nature of this flaw, immediate patching is required. Security teams should treat this as a high-urgency task to protect the integrity of the web-facing infrastructure and the data contained within.

---METADATA---
VENDOR: Oracle
PRODUCT: Oracle Unified Directory
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical vulnerability in Oracle Unified Directory allows an authenticated attacker with low privileges to achieve full system compromise via network access.

Executive Summary:
A critical vulnerability in Oracle Unified Directory allows authenticated network attackers to achieve a full system takeover.

Vulnerability Details

CVE-ID: CVE-2026-60361

Affected Software: Oracle Unified Directory

Affected Versions: 12.2.1.4.0, 14.1.2.1.0

Vulnerability: This is an easily exploitable flaw in the OUD Core component that allows an attacker with low-level administrative credentials and network access via LDAP to compromise the directory server. The vulnerability allows for scope changes, meaning the impact can extend beyond the directory service to other integrated infrastructure components.

Business Impact

With a CVSS score of 9.9, this vulnerability represents an extreme risk to organizational security. Successful exploitation grants an attacker full control over the directory service, which typically acts as a central identity provider. This could lead to a massive breach of user credentials, unauthorized access to connected enterprise applications, and a complete loss of confidentiality, integrity, and availability for the entire identity management infrastructure.

Remediation Plan

Immediate Action: Administrators must apply the latest Oracle Critical Patch Update (CPU) available at the official Oracle Security Alerts website.

Proactive Monitoring: Monitor LDAP traffic for unusual authentication patterns or unauthorized administrative queries originating from low-privileged accounts.

Compensating Controls: Implement strict network segmentation to restrict access to the LDAP service to known, trusted management hosts only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's high exploitability rating suggests that while no public exploit is confirmed, the barrier to entry for a motivated attacker is low.

Analyst Recommendation

Given the critical nature of this identity-based vulnerability and the potential for a full system takeover, immediate patching is required. Organizations should prioritize this update in their next maintenance cycle to prevent unauthorized access to core directory services.

---METADATA---
VENDOR: Oracle
PRODUCT: Unified Directory
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical vulnerability in the Oracle Unified Directory OUD Core allows unauthenticated, remote attackers to achieve a full system takeover via LDAP.

Executive Summary:
A critical, unauthenticated remote vulnerability in Oracle Unified Directory allows for total system takeover via the LDAP protocol.

Vulnerability Details

CVE-ID: CVE-2026-60360

Affected Software: Oracle Unified Directory

Affected Versions: 12.2.1.4.0, 14.1.2.1.0

Vulnerability: The vulnerability is located in the OUD Core component. It allows an unauthenticated attacker with network access to the LDAP service to fully compromise the directory server, enabling unauthorized access to stored identity data.

Business Impact

A CVSS score of 10.0 reflects the extreme risk posed by this vulnerability. Successful exploitation grants the attacker full control over the directory service, allowing them to extract, modify, or delete identity information, which effectively compromises the security of every system that relies on the directory for authentication and authorization.

Remediation Plan

Immediate Action: Apply the security patches provided in the July 2026 Oracle Critical Patch Update immediately.

Proactive Monitoring: Review LDAP traffic logs for unauthorized access attempts or suspicious queries that deviate from standard operational behavior.

Compensating Controls: Implement strict network-level access controls to limit LDAP connectivity to authorized clients and internal segments only, reducing the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Because this affects the core directory service, it should be considered a high-priority target for threat actors.

Analyst Recommendation

Due to the critical nature of the directory service, this vulnerability must be addressed with the highest urgency. Administrators should verify their versions of Oracle Unified Directory and apply the necessary patches as soon as they are made available by the vendor.

---METADATA---
VENDOR: Oracle
PRODUCT: Access Manager
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical vulnerability in the Oracle Access Manager Authentication Engine allows unauthenticated, remote attackers to achieve a full system takeover via HTTP.

Executive Summary:
A critical, unauthenticated remote code execution vulnerability in Oracle Access Manager allows for total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-60358

Affected Software: Oracle Access Manager

Affected Versions: 12.2.1.4.0, 14.1.2.1.0

Vulnerability: The vulnerability exists in the Authentication Engine component. It allows an unauthenticated attacker with network access to achieve a complete takeover of the application, representing a total compromise of the authentication infrastructure.

Business Impact

With a CVSS score of 10.0, this vulnerability represents the highest level of risk. An attacker gaining control of the Access Manager can compromise the entire identity and access management fabric of an organization, leading to unauthorized access to all protected downstream applications and sensitive corporate data.

Remediation Plan

Immediate Action: Apply the security patches provided in the July 2026 Oracle Critical Patch Update immediately.

Proactive Monitoring: Monitor authentication logs for anomalous activity or unexpected administrative access patterns that may indicate a breach of the authentication engine.

Compensating Controls: Restrict network access to the Oracle Access Manager interface to known, trusted subnets and employ a Web Application Firewall to block suspicious HTTP requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this flaw particularly dangerous for any internet-facing instances.

Analyst Recommendation

This vulnerability demands immediate attention due to its critical severity and the potential for total system takeover. Security teams should treat this as a top-priority item and ensure that all affected Oracle Access Manager servers are patched immediately to prevent potential exploitation.

---METADATA---
VENDOR: Oracle
PRODUCT: WebLogic Server
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.1.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the core component of Oracle WebLogic Server allows an authenticated attacker with network access to achieve a full system takeover.

Executive Summary:
A high-severity vulnerability in Oracle WebLogic Server enables low-privileged attackers to gain unauthorized control over the application.

Vulnerability Details

CVE-ID: CVE-2026-60343

Affected Software: Oracle WebLogic Server

Affected Versions: 12.2.1.4.0, 14.1.1.0.0

Vulnerability: This vulnerability resides in the core of Oracle WebLogic Server and allows a low-privileged, authenticated attacker to compromise the server environment through network-based HTTP interactions.

Business Impact

The potential for a full system takeover makes this an extremely high-risk issue for any organization running WebLogic Server. With a CVSS score of 8.8, successful exploitation could lead to total loss of system confidentiality, integrity, and availability, potentially exposing backend databases or interconnected enterprise applications.

Remediation Plan

Immediate Action: Apply the relevant security patches released in the July 2026 Oracle Critical Patch Update without delay.

Proactive Monitoring: Regularly audit WebLogic server logs for unusual activity and monitor for unexpected service interruptions or unauthorized configuration changes.

Compensating Controls: Utilize a Web Application Firewall to block malicious payloads that attempt to exploit server-side vulnerabilities within the WebLogic environment.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The core nature of the affected component makes this a priority target for threat actors.

Analyst Recommendation

Given the central role of WebLogic Server in many enterprise architectures, the risk of compromise is significant. IT teams should ensure that all instances are updated to the latest vendor-recommended versions to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Content
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the Oracle WebCenter Content Content Server component allows an authenticated attacker with network access to achieve a full system takeover.

Executive Summary:
A high-severity vulnerability in Oracle WebCenter Content allows low-privileged attackers to gain unauthorized control over the application.

Vulnerability Details

CVE-ID: CVE-2026-60334

Affected Software: Oracle WebCenter Content

Affected Versions: 12.2.1.4.0, 14.1.2.0.0

Vulnerability: This is an easily exploitable flaw within the Content Server component, which allows a low-privileged, authenticated attacker to compromise the integrity, availability, and confidentiality of the system via HTTP network access.

Business Impact

Successful exploitation poses a critical risk to business operations, as it grants an attacker the ability to perform a complete takeover of the affected WebCenter Content instance. Given the CVSS score of 8.8, this vulnerability could lead to the exposure of sensitive corporate documents, unauthorized modification of content, and significant service disruption, potentially resulting in severe reputational and operational damage.

Remediation Plan

Immediate Action: Administrators must apply the latest security updates provided in the July 2026 Oracle Critical Patch Update.

Proactive Monitoring: Security teams should monitor network traffic for anomalous HTTP requests directed at the Content Server and review access logs for suspicious administrative actions.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to inspect and filter traffic for known attack patterns targeting Oracle Fusion Middleware components.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to the low-privilege requirement for a full system takeover.

Analyst Recommendation

The severity of this vulnerability necessitates prompt remediation. Organizations using affected versions of Oracle WebCenter Content should prioritize the application of vendor-supplied patches to eliminate the risk of unauthorized system access and potential data compromise.

---METADATA---
VENDOR: Oracle
PRODUCT: Access Manager
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical vulnerability in the Oracle Access Manager Authentication Engine allows a low-privileged attacker to achieve full system takeover via network access.

Executive Summary:
A high-severity vulnerability in the Oracle Access Manager Authentication Engine allows low-privileged attackers to compromise the entire system through scope escalation.

Vulnerability Details

CVE-ID: CVE-2026-60333

Affected Software: Oracle Access Manager

Affected Versions: 12.2.1.4.0, 14.1.2.1.0

Vulnerability: This vulnerability affects the Authentication Engine and allows an attacker with low-level privileges to perform an unauthorized system takeover via HTTP, impacting the security of the broader environment due to scope change.

Business Impact

The CVSS score of 9.9 underscores the extreme risk posed by this vulnerability. By exploiting the authentication engine, an attacker with minimal access can escalate their privileges to take control of the entire Access Manager instance. This represents a catastrophic failure of identity and access management, potentially exposing all downstream applications and services protected by the Oracle platform.

Remediation Plan

Immediate Action: Apply the July 2026 Oracle Critical Patch Update to all instances of Oracle Access Manager immediately.

Proactive Monitoring: Monitor authentication logs for suspicious activity or anomalous behavior from low-privileged user accounts, and review server logs for signs of privilege escalation attempts.

Compensating Controls: Reduce the attack surface by limiting the number of users with low-level access to the management interfaces until the patches are applied.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While this requires an attacker to already possess low-level credentials, the ability to escalate to full system control makes it a primary target for malicious actors.

Analyst Recommendation

This vulnerability represents a significant threat to internal security and identity integrity. It is essential to treat this as a high-priority remediation task and deploy the available vendor patches across all affected environments as quickly as possible.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU router is vulnerable to remote OS command injection in the setVpnAccountCfg function, which is publicly exploitable.

Executive Summary:
A critical remote command injection vulnerability in Totolink A7100RU routers allows unauthenticated attackers to execute arbitrary code via manipulated user arguments.

Vulnerability Details

CVE-ID: CVE-2026-6029

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This is an OS command injection vulnerability located in the /cgi-bin/cstecgi.cgi file. Attackers can manipulate the User argument to execute system commands remotely without authentication.

Business Impact

With a CVSS score of 9.8, the impact is severe. Successful exploitation allows for complete takeover of the router, potentially leading to network-wide surveillance or the redirection of traffic to malicious destinations.

Remediation Plan

Immediate Action: Update the firmware of all affected Totolink A7100RU devices to the latest available version.

Proactive Monitoring: Inspect router logs for anomalous entries in the setVpnAccountCfg function and unusual administrative activity.

Compensating Controls: Restrict access to the router's web management interface to trusted internal segments only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, the exploit has been disclosed publicly and may be actively used by threat actors. Immediate action is required.

Analyst Recommendation

Given the public availability of an exploit, this vulnerability poses an imminent threat. Organizations must prioritize firmware updates to mitigate the risk of remote system control.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU router is vulnerable to remote OS command injection in the setPptpServerCfg function, which is publicly exploitable.

Executive Summary:
A critical remote command injection vulnerability in Totolink A7100RU routers allows unauthenticated attackers to execute arbitrary commands with root-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-6028

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This is an OS command injection vulnerability located in the /cgi-bin/cstecgi.cgi file. Attackers can manipulate the enable argument to execute system commands remotely without authentication.

Business Impact

With a CVSS score of 9.8, the impact is catastrophic. An attacker can gain full control over the networking device, facilitating man-in-the-middle attacks, data interception, and persistence within the local network.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink to the affected A7100RU devices.

Proactive Monitoring: Monitor network traffic for suspicious cgi-bin activity and unexpected outbound connections from the router.

Compensating Controls: Disable remote management interfaces on the router and ensure it is not directly exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, the exploit has been disclosed publicly and may be actively used by threat actors. Immediate action is required.

Analyst Recommendation

The availability of a public exploit significantly increases the risk of this vulnerability. Administrators must update affected hardware immediately to prevent compromise.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability in the Totolink A7100RU CGI handler allows unauthenticated remote attackers to execute commands via the enable argument in setUrlFilterRules.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU router allows unauthenticated attackers to execute arbitrary commands, leading to full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-6027

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This vulnerability affects the setUrlFilterRules function in /cgi-bin/cstecgi.cgi. An unauthenticated attacker can trigger command injection by manipulating the enable argument.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an extreme risk. Successful exploitation allows for complete takeover of the router, potentially leading to widespread data interception, unauthorized network access, and the deployment of persistent malware on the device.

Remediation Plan

Immediate Action: Update the device firmware to the latest version to patch the vulnerable CGI handler.

Proactive Monitoring: Maintain vigilance for anomalous device behavior and audit all management interface logs for unauthorized access attempts.

Compensating Controls: Implement network-level segmentation to isolate the management interface and use a WAF to block requests containing malicious command payloads.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploit code is available. Because this vulnerability is remotely triggerable without authentication, it poses a severe threat to any internet-facing device.

Analyst Recommendation

Immediate action is mandatory to mitigate this critical vulnerability. Administrators should apply the vendor's firmware update as soon as possible and ensure that no vulnerable devices remain exposed to the public internet.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A7100RU CGI handler, allowing unauthenticated attackers to execute commands via the enable argument in setPortalConfWeChat.

Executive Summary:
A critical remote OS command injection flaw in the Totolink A7100RU router allows unauthenticated attackers to execute arbitrary commands, threatening network integrity.

Vulnerability Details

CVE-ID: CVE-2026-6026

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The vulnerability is located in the setPortalConfWeChat function of the /cgi-bin/cstecgi.cgi component. Unauthenticated remote attackers can perform OS command injection by manipulating the enable argument.

Business Impact

The CVSS score of 9.8 justifies the classification of this vulnerability as critical. Successful exploitation provides attackers with arbitrary code execution capabilities, which can be leveraged to compromise the device, perform man-in-the-middle attacks, or facilitate further unauthorized access to the protected network.

Remediation Plan

Immediate Action: Update the affected Totolink A7100RU devices to the latest firmware provided by the manufacturer.

Proactive Monitoring: Monitor network traffic for suspicious requests to the CGI handler and review device logs for signs of unauthorized configuration changes or command execution.

Compensating Controls: Restrict management interface access to trusted networks and monitor for unauthorized attempts to invoke the vulnerable CGI function.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploit code is available. The ability for unauthenticated remote attackers to trigger this command injection makes it an urgent security priority.

Analyst Recommendation

Given the critical severity and the existence of public exploits, immediate remediation is required. Organizations should ensure all affected hardware is updated to the latest available firmware to mitigate this high-risk vulnerability.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Totolink A7100RU CGI handler allows unauthenticated remote attackers to execute arbitrary commands via the enable argument in setSyslogCfg.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU router enables unauthenticated attackers to achieve full system execution.

Vulnerability Details

CVE-ID: CVE-2026-6025

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This vulnerability affects the setSyslogCfg function within /cgi-bin/cstecgi.cgi. Unauthenticated attackers can inject operating system commands by manipulating the enable parameter.

Business Impact

A CVSS score of 9.8 reflects the high severity of this command injection flaw. Successful exploitation allows an attacker to bypass authentication, execute arbitrary code, and potentially exfiltrate logs or sensitive configuration data, resulting in a significant security breach and loss of device control.

Remediation Plan

Immediate Action: Apply the vendor-provided firmware update to resolve the command injection vulnerability in the CGI handler.

Proactive Monitoring: Inspect system logs for unexpected execution of system commands or unusual traffic patterns associated with the syslog configuration component.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent inspection tool to filter malicious payloads containing shell metacharacters from requests targeting the CGI interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploit code is available for this vulnerability. The ease of triggering this flaw remotely makes it a prime target for automated exploitation tools.

Analyst Recommendation

The risk posed by this vulnerability is critical. Security teams must prioritize patching or isolating the affected A7100RU devices to prevent potential compromise and unauthorized access to the underlying operating system.

---METADATA---
VENDOR: Oracle
PRODUCT: Coherence
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical vulnerability in the Oracle Coherence Core component allows an unauthenticated attacker to achieve full system takeover via network access.

Executive Summary:
A critical, unauthenticated remote takeover vulnerability in Oracle Coherence poses a severe risk of complete system compromise and cross-product exploitation.

Vulnerability Details

CVE-ID: CVE-2026-60217

Affected Software: Oracle Coherence

Affected Versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0

Vulnerability: The vulnerability resides in the Core component of Oracle Coherence and permits an unauthenticated attacker with network access via TCP to execute unauthorized commands and seize control of the application.

Business Impact

With a CVSS score of 10.0, this vulnerability presents an existential risk to the integrity of the affected Oracle Coherence environment. Exploitation allows for complete data exfiltration and total loss of system control. Furthermore, the capacity for scope change indicates that an attacker could leverage this entry point to compromise other integrated components within the Oracle Fusion Middleware stack.

Remediation Plan

Immediate Action: Update all affected instances of Oracle Coherence to the latest patched versions as detailed in the July 2026 Oracle Critical Patch Update.

Proactive Monitoring: Review TCP traffic logs for anomalous patterns directed at the Coherence service and monitor for unauthorized changes to system configurations or unexpected new processes.

Compensating Controls: Ensure that Coherence services are not exposed to the public internet and utilize internal firewalls to restrict network access to trusted administrative and application nodes only.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly attractive to attackers because it requires no authentication to trigger.

Analyst Recommendation

The severity of this vulnerability necessitates an emergency patching cycle. Organizations should isolate affected systems from the network until the vendor-supplied patches can be successfully deployed to eliminate the risk of remote takeover.

---METADATA---
VENDOR: Oracle
PRODUCT: Coherence
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the Oracle Coherence Core component allows an unauthenticated attacker on the physical communication segment to take over the software.

Executive Summary:
An unauthenticated attacker with physical network segment access can exploit this vulnerability to take over Oracle Coherence.

Vulnerability Details

CVE-ID: CVE-2026-60211

Affected Software: Oracle Coherence

Affected Versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0

Vulnerability: This is an easily exploitable flaw in the Core component of Oracle Coherence. It allows an unauthenticated attacker who has access to the physical communication segment attached to the hardware to compromise the application.

Business Impact

By allowing unauthenticated access to the underlying hardware segment, this vulnerability poses a severe threat to the overall security posture of the Oracle Coherence environment. A successful exploit results in total system takeover, which could lead to significant data loss or service disruption, justifying the 8.8 CVSS score.

Remediation Plan

Immediate Action: Review the Oracle July 2026 Critical Patch Update and apply the required security patches to all affected Coherence deployments.

Proactive Monitoring: Monitor network traffic for unusual activity on the communication segments where Coherence is deployed and restrict physical access to these segments as much as possible.

Compensating Controls: Implement network segmentation and strong access controls to ensure that only authorized devices can communicate with the hardware segments hosting Oracle Coherence.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the attack requires physical segment access, the lack of authentication makes the exploitation path straightforward for an attacker already present on the network.

Analyst Recommendation

Security teams must prioritize patching this vulnerability to prevent unauthorized access. Given the requirement for network segment access, tightening physical and logical access controls to the infrastructure is a critical secondary defense measure.

---METADATA---
VENDOR: Oracle
PRODUCT: WebLogic Server
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.2.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the Oracle WebLogic Server Core component permits low privileged attackers to compromise the system via network access.

Executive Summary:
An authenticated attacker can exploit a vulnerability in Oracle WebLogic Server to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-60207

Affected Software: Oracle WebLogic Server

Affected Versions: 12.2.1.4.0, 14.1.2.0.0

Vulnerability: The Core component of Oracle WebLogic Server contains an easily exploitable flaw that allows an attacker with low privileges to execute commands or manipulate the application remotely via HTTP.

Business Impact

Successful exploitation leads to a complete takeover of the Oracle WebLogic Server, jeopardizing the confidentiality and integrity of hosted applications and data. The high CVSS score of 8.8 highlights the urgency of addressing this flaw to prevent unauthorized access or system-wide disruption.

Remediation Plan

Immediate Action: Consult the Oracle July 2026 Critical Patch Update and apply the corresponding security updates to all identified instances of WebLogic Server.

Proactive Monitoring: Audit access logs for anomalous activity and increase the logging level for the Core component to capture potential exploitation attempts.

Compensating Controls: Utilize a WAF to block unauthorized or malformed HTTP requests that attempt to interact with the vulnerable WebLogic Core functions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is considered high risk due to its ability to facilitate remote takeover.

Analyst Recommendation

The risk of full system compromise necessitates immediate action. Security teams should identify all vulnerable WebLogic versions in their infrastructure and plan to apply the vendor-provided updates immediately upon release.

---METADATA---
VENDOR: Oracle
PRODUCT: WebLogic Server
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the Oracle WebLogic Server Core component allows a low privileged attacker to compromise the server via network access.

Executive Summary:
A high severity vulnerability in Oracle WebLogic Server enables an authenticated attacker to gain complete control over the affected system.

Vulnerability Details

CVE-ID: CVE-2026-60203

Affected Software: Oracle WebLogic Server

Affected Versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0

Vulnerability: This is an easily exploitable flaw in the Core component of Oracle WebLogic Server. It requires an attacker to have low privileges and network access via HTTP to execute the attack, which can result in a full server takeover.

Business Impact

The potential for a total server takeover poses a critical threat to business operations, as it allows attackers to exfiltrate sensitive data, manipulate application logic, or disrupt services. With a CVSS score of 8.8, this vulnerability represents a significant risk to the integrity and availability of the enterprise environment.

Remediation Plan

Immediate Action: Review the Oracle July 2026 Critical Patch Update advisory and apply the necessary security patches to all affected WebLogic instances as soon as they become available.

Proactive Monitoring: Monitor server logs for unusual HTTP requests or unauthorized attempts to access administrative functions that deviate from established user behavior baselines.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and filter inbound HTTP traffic, specifically targeting suspicious patterns directed at the WebLogic Core component.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the low privilege requirement and the high impact of a successful takeover.

Analyst Recommendation

Given the high CVSS score and the potential for full server compromise, administrators must prioritize the installation of vendor-provided patches. Until patches are applied, restrict network access to the WebLogic management interface to trusted internal segments only to reduce the attack surface.

---METADATA---
VENDOR: Oracle
PRODUCT: Oracle Database Server
AFFECTED_VERSIONS: 19.3 through 19.31, 21.3 through 21.22, 23.4.0 through 23.26.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the Oracle Database Server RDBMS component allows an authenticated user to perform a complete system takeover.

Executive Summary:
A critical vulnerability in Oracle Database Server enables authenticated users to gain full control of the RDBMS, creating a severe risk of database compromise.

Vulnerability Details

CVE-ID: CVE-2026-60175

Affected Software: Oracle Database Server

Affected Versions: 19.3 through 19.31, 21.3 through 21.22, 23.4.0 through 23.26.2

Vulnerability: This vulnerability affects the RDBMS component and allows an authenticated user with network access via Oracle Net to compromise the database. Successful exploitation results in a full takeover of the database server.

Business Impact

The CVSS score of 8.8 underscores the severity of this flaw. Unauthorized takeover of an RDBMS can lead to total data exfiltration, destruction of sensitive records, and a total loss of confidentiality, integrity, and availability for mission-critical business applications.

Remediation Plan

Immediate Action: Deploy the July 2026 Oracle Critical Patch Update to all affected database environments.

Proactive Monitoring: Review database audit logs for suspicious administrative commands or unexpected privilege escalation by low-level user accounts.

Compensating Controls: Limit network access to the database listener and enforce the principle of least privilege for all database users to reduce the potential attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly concerning as it allows an authenticated user to escalate privileges to a full system compromise.

Analyst Recommendation

Database administrators should prioritize this update immediately. Given the potential for total data loss, ensuring the RDBMS is patched is essential to protecting the organization's most critical information assets.

---METADATA---
VENDOR: Oracle
PRODUCT: Oracle GoldenGate
AFFECTED_VERSIONS: 19.1.0.0.0 through 19.29.0.0, 21.3 through 21.21, 23.4 through 23.26.1.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the Oracle GoldenGate Service Manager allows a low privileged attacker with network access to gain full control of the application.

Executive Summary:
A high severity vulnerability in Oracle GoldenGate allows low privileged attackers to seize control of the Service Manager, threatening data replication and integration integrity.

Vulnerability Details

CVE-ID: CVE-2026-60157

Affected Software: Oracle GoldenGate

Affected Versions: 19.1.0.0.0 through 19.29.0.0, 21.3 through 21.21, 23.4 through 23.26.1.0.0

Vulnerability: The vulnerability exists in the Service Manager component. It permits a low privileged attacker with network access to perform a full system takeover via HTTP.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to data consistency and availability. A successful compromise could allow an attacker to intercept, modify, or disrupt data replication streams between databases, leading to significant operational downtime or data corruption.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches from the July 2026 Oracle Critical Patch Update.

Proactive Monitoring: Audit access to the Service Manager interface and monitor for unauthorized configuration changes or anomalous traffic patterns.

Compensating Controls: Restrict network access to the Service Manager to known management IP addresses and employ a WAF to inspect incoming HTTP traffic for malicious payloads.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is considered highly exploitable given the lack of complex preconditions beyond basic network access and low privileges.

Analyst Recommendation

Given the critical nature of GoldenGate in enterprise data architectures, organizations must treat this vulnerability with high urgency. Patching should be performed during the next maintenance window to mitigate the risk of unauthorized takeover.

---METADATA---
VENDOR: WordPress
PRODUCT: Core
AFFECTED_VERSIONS: 6.8.0 to 6.8.5, 6.9.0 to 6.9.4, 7.0.0 to 7.0.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
WordPress Core is affected by a SQL injection vulnerability that allows unauthenticated attackers to execute unauthorized database queries.

Executive Summary:
A critical SQL injection vulnerability in WordPress Core is being actively exploited in the wild, posing a severe risk of unauthorized database access.

Vulnerability Details

CVE-ID: CVE-2026-60137

Affected Software: WordPress Core

Affected Versions: 6.8.0 up to 6.8.6, 6.9.0 up to 6.9.5, 7.0.0 up to 7.0.2

Vulnerability: This is a SQL injection flaw (CWE-89) within WordPress Core that permits an unauthenticated attacker to manipulate database queries. Successful exploitation allows for unauthorized data extraction from the underlying database.

Business Impact

The vulnerability carries a CVSS score of 9.5, reflecting its critical nature and ease of exploitation. Successful attacks can lead to the complete compromise of sensitive site data, including user credentials, personal information, and proprietary content, resulting in significant reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: Update all WordPress installations to version 6.8.6, 6.9.5, or 7.0.2 immediately. These versions contain the necessary security patches to remediate the vulnerability.

Proactive Monitoring: Review database query logs for anomalous or high-volume requests that deviate from typical application behavior. Monitor for unexpected account creation or administrative privilege escalation attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection patterns. Restrict administrative access to known, trusted IP addresses to limit the attack surface.

Exploitation Status

Public Exploit Available: Yes, multiple public proofs-of-concept exist on GitHub.

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of July 21, 2026. Given the presence of multiple public exploit repositories, the risk of automated mass exploitation is extremely high.

Analyst Recommendation

The active exploitation of this vulnerability in the wild makes it a top-tier priority for all organizations using WordPress. Administrators must bypass standard update cycles and apply the vendor-provided patches immediately to prevent data exfiltration.

---METADATA---
VENDOR: Weintek
PRODUCT: cMT3092X firmware
AFFECTED_VERSIONS: cMT3092X firmware: < 20210218; EasyWeb: < v2.1.20
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Weintek cMT3092X HMI allows authenticated non-privileged users to modify cookies to escalate their privileges.

Executive Summary:
A high-severity privilege escalation vulnerability in Weintek cMT3092X HMI allows authenticated users to bypass security controls by manipulating session cookies.

Vulnerability Details

CVE-ID: CVE-2026-60134

Affected Software: Weintek cMT3092X firmware and EasyWeb interface.

Affected Versions: Firmware versions prior to 20210218; EasyWeb versions prior to v2.1.20.

Vulnerability: This is a privilege management flaw (CWE-784) where the software incorrectly validates session cookies. An authenticated, non-privileged user can modify these cookies to gain elevated administrative privileges.

Business Impact

Successful exploitation grants an attacker administrative control over the HMI, which could lead to unauthorized modification of industrial processes or unauthorized access to sensitive system configurations. With a CVSS score of 8.8, the potential for operational disruption and unauthorized system access is severe.

Remediation Plan

Immediate Action: Apply the specific patch package cmt_typeB_20260316_007.patch provided by Weintek, which updates EasyWeb to 2.3.17-typeb.

Proactive Monitoring: Review system logs for unauthorized account changes or activity performed by standard user accounts that would typically require administrative privileges.

Compensating Controls: Strictly limit network access to the HMI interface to known, trusted IP addresses to reduce the likelihood of unauthorized users reaching the login interface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to be authenticated as a low-privileged user, which limits the attack surface but remains a critical risk once a foothold is established.

Analyst Recommendation

This vulnerability represents a significant risk to industrial control environments. Administrators should obtain the necessary patch directly from Weintek support or authorized distributors and apply it immediately to prevent unauthorized privilege escalation.

---METADATA---
VENDOR: gpsd
PRODUCT: gpsd
AFFECTED_VERSIONS: 0 through 3.27.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The gpsd software is susceptible to code injection via the sky satellites used field, which may allow for arbitrary code execution.

Executive Summary:
A code injection vulnerability in the gpsd service could allow a local attacker with user interaction to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-60122

Affected Software: gpsd gpsd

Affected Versions: 0 through 3.27.5

Vulnerability: This vulnerability (CWE-94) stems from improper control of code generation when processing specific fields, allowing an attacker to inject malicious code. The attack vector requires local access and user interaction to trigger the flaw.

Business Impact

Successful exploitation could lead to full system compromise, as the vulnerability allows for arbitrary code execution with the privileges of the gpsd process. With a CVSS score of 7.8, the impact on system integrity and availability is critical, potentially resulting in unauthorized system control.

Remediation Plan

Immediate Action: Update gpsd to the version incorporating fix commit 5a9c44a42136b9bb98d460a8a716e9fd344a8d93 or later.

Proactive Monitoring: Monitor system logs for unusual process execution or unauthorized modifications to the gpsd configuration.

Compensating Controls: Restrict local access to the system and ensure that only trusted users can interact with the gpsd service.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The inherent exploitability of code injection flaws necessitates prompt remediation.

Analyst Recommendation

Users of the gpsd service must move to apply the necessary patches provided by the vendor. Prioritizing this update is essential to prevent potential code injection attacks that could lead to unauthorized system access.

---METADATA---
VENDOR: VITEC
PRODUCT: Flamingo
AFFECTED_VERSIONS: 4.12.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint due to improper shell argument handling.

Executive Summary:
A critical unauthenticated OS command injection vulnerability exists in Vitec Flamingo 4.12.2, allowing remote attackers to execute arbitrary commands with root privileges.

Vulnerability Details

CVE-ID: CVE-2026-60121

Affected Software: VITEC Flamingo

Affected Versions: 4.12.2

Vulnerability: This is an OS command injection vulnerability (CWE-78) occurring in the admin/ajax/ping.php endpoint. The application fails to properly sanitize user-supplied input, leading to a double-evaluation flaw where an attacker can execute arbitrary commands via passwordless sudo.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its potential for total system compromise. Successful exploitation grants an attacker full root-level control over the affected appliance, which may lead to complete data exfiltration, permanent service disruption, and the potential for the device to be used as a pivot point within the internal network.

Remediation Plan

Immediate Action: Identify and isolate all instances of Vitec Flamingo 4.12.2 from public-facing networks until a vendor-supplied patch is applied.

Proactive Monitoring: Monitor network traffic for unusual POST requests to the /admin/ajax/ping.php endpoint and review system logs for unexpected execution of shell commands.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or sanitize requests containing shell metacharacters directed at the identified endpoint.

Exploitation Status

Public Exploit Available: No (Exploit_available: unknown)

Analyst Notes: As of July 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of authentication and the high privilege level of the underlying command execution.

Analyst Recommendation

Given the critical severity and the existence of a proof-of-concept, users must prioritize the deployment of vendor-supplied security updates. Organizations should ensure that the affected systems are not exposed to the public internet and verify that access controls are strictly enforced for administrative interfaces.

---METADATA---
VENDOR: NASA-AMMOS
PRODUCT: AIT-DSN
AFFECTED_VERSIONS: 0 up to (excluding) 2.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authentication vulnerability in the NASA-AMMOS AIT-DSN Space Link Extension interface allows unauthenticated remote attackers to execute arbitrary API commands.

Executive Summary:
The NASA-AMMOS AIT-DSN toolkit contains a critical authentication bypass vulnerability that allows unauthenticated network attackers to control spacecraft communication sessions.

Vulnerability Details

CVE-ID: CVE-2026-60113

Affected Software: NASA-AMMOS AIT-DSN

Affected Versions: 0 up to (excluding) 2.2.2

Vulnerability: This vulnerability involves a lack of authentication checks within the Space Link Extension interface manager. An unauthenticated attacker can send direct HTTP requests to seven unprotected API routes, granting them the ability to manipulate DSN sessions and inject telemetry data.

Business Impact

Successful exploitation poses a severe risk to mission integrity and operational control. By manipulating Deep Space Network communication sessions or injecting arbitrary frames, an attacker could disrupt critical telemetry data or potentially influence spacecraft operations. Given the CVSS score of 9.8, this vulnerability represents a critical threat that could lead to complete loss of command authority over affected communication links.

Remediation Plan

Immediate Action: Upgrade to NASA-AMMOS AIT-DSN version 2.2.2 or later immediately to implement mandatory authentication for all API endpoints.

Proactive Monitoring: Review access logs for unusual HTTP traffic directed toward the Space Link Extension API routes, specifically looking for unauthorized session creation or termination requests.

Compensating Controls: Deploy a Web Application Firewall or network access control list to restrict access to the AIT-DSN interface to known, authorized IP addresses only.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of any authentication gate on critical operational functions.

Analyst Recommendation

This vulnerability presents a high-risk scenario for any organization utilizing the AIT-DSN toolkit. Administrators must prioritize updating to version 2.2.2 to ensure that critical API routes are properly protected against unauthorized access. Failure to patch allows any network-adjacent actor to interfere with sensitive spacecraft communication protocols.

---METADATA---
VENDOR: NASA-AMMOS
PRODUCT: AIT-GUI
AFFECTED_VERSIONS: 0 up to (excluding) 2.5.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authentication vulnerability in NASA-AMMOS AIT-GUI allows unauthenticated attackers to create sessions and issue arbitrary spacecraft commands.

Executive Summary:
The NASA-AMMOS AIT-GUI toolkit contains a critical authentication bypass vulnerability that allows unauthenticated network attackers to send unauthorized commands to the spacecraft command bus.

Vulnerability Details

CVE-ID: CVE-2026-60112

Affected Software: NASA-AMMOS AIT-GUI

Affected Versions: 0 up to (excluding) 2.5.1

Vulnerability: This vulnerability is caused by a failure to perform credential checks in the Sessions.create() function. An unauthenticated attacker can exploit this to establish a valid session and subsequently invoke handle_cmd() to inject arbitrary commands directly into the AIT command bus.

Business Impact

The ability for an unauthenticated user to inject commands into the spacecraft command bus poses a catastrophic risk to mission operations. Exploitation could lead to the loss of control over the spacecraft or unintended hardware actions. With a CVSS score of 9.8, this flaw constitutes a critical threat to the availability and integrity of mission-critical systems.

Remediation Plan

Immediate Action: Update NASA-AMMOS AIT-GUI to version 2.5.1 or later immediately to enforce authentication for session creation.

Proactive Monitoring: Review system logs for unexpected calls to Sessions.create() or handle_cmd() originating from unknown or unauthorized sources.

Compensating Controls: Restrict network access to the AIT-GUI interface using firewalls or VPNs to ensure that only trusted clients can communicate with the application.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly critical due to the lack of an authentication gate between session establishment and command dispatch.

Analyst Recommendation

Given the extreme potential impact of command injection on spacecraft systems, this update must be applied as a matter of urgency. Organizations using AIT-GUI must ensure that the patch is deployed and that access to the interface is strictly governed by robust network security policies.

---METADATA---
VENDOR: Monsta Limited
PRODUCT: Monsta FTP
AFFECTED_VERSIONS: 0 up to (excluding) 2.14.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Monsta FTP contains a Server-Side Request Forgery (SSRF) vulnerability that allows unauthenticated attackers to bypass address restrictions via IPv4-mapped IPv6 addresses.

Executive Summary:
An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in Monsta FTP allows attackers to bypass security controls and interact with internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-60105

Affected Software: Monsta Limited Monsta FTP

Affected Versions: 0 up to (excluding) 2.14.5

Vulnerability: The vulnerability (CWE-918) arises from the improper handling of IPv4-mapped IPv6 addresses. An unauthenticated attacker can leverage this flaw to trick the server into making arbitrary requests to internal network services, effectively bypassing existing security perimeters.

Business Impact

The CVSS score of 8.6 underscores the severity of this SSRF flaw. By bypassing internal network access controls, an attacker could probe internal services, access metadata endpoints, or interact with databases that are not intended to be exposed to the public internet, potentially leading to significant data exposure or further system compromise.

Remediation Plan

Immediate Action: Update Monsta FTP to version 2.14.5 or later to apply the necessary security fixes for address validation.

Proactive Monitoring: Review web server and application logs for unusual outbound requests or attempts to connect to internal IP ranges (e.g., 10.0.0.0/8, 192.168.0.0/16) originating from the Monsta FTP application.

Compensating Controls: Restrict the outbound network access of the server hosting Monsta FTP using an egress firewall policy to block connections to sensitive internal infrastructure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SSRF vulnerabilities are critical entry points for lateral movement within a network. Administrators must update to the latest version of Monsta FTP immediately and review existing network egress rules to minimize the blast radius of any potential SSRF attempt.