Oracle Order Management CVE-2026-101832

Exploitation requires valid low-privilege Oracle E-Business Suite credentials (CVSS PR:L) and network HTTP access to the Oracle Order Management application, specifically its Product Diagnostic Tools component, on affected versions 12.2.3 through 12.2.15. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must already be authenticated to EBS, the EBS web tier must be network-reachable from the attacker, and only confidentiality is at risk (I:N/A:N) - no data modification or service disruption results. Impact is bounded to data accessible via Oracle Order Management.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-exploitable, low-complexity flaw requiring low privileges and no user interaction, with high confidentiality impact but no integrity or availability impact - a classic authenticated information-disclosure issue rather than a full compromise. No EPSS score, CISA KEV listing, SSVC decision data, or POC indicator is present in the input, so exploitation probability and real-world activity cannot be quantified from the available signals; absence of these is not evidence of low risk, only of missing telemetry. The one apparent conflict is the input tag 'Authentication Bypass', which contradicts both the CVSS vector (PR:L requires valid low-privilege credentials, not bypassed authentication) and the Oracle description ('low privileged attacker') - this tag appears mislabeled and should not drive prioritization. On balance this is a medium-severity, authenticated data-exposure issue in a high-value ERP product; it warrants prompt patching in exposed Oracle EBS environments but does not show the hallmarks (PR:N, confirmed exploitation, high EPSS) of an emergency remote-unauthenticated priority.

An attacker holding low-privilege Oracle E-Business Suite credentials sends crafted HTTP requests to the Product Diagnostic Tools component of Oracle Order Management, abusing it to read Order Management data the account is not authorized to see. The low attack complexity and lack of required user interaction make exploitation straightforward once authenticated, though valid credentials are a prerequisite. No public exploit identified at time of analysis.