Oracle Order Management CVE-2026-101856

Exploitation requires an authenticated, low-privilege account on the Oracle E-Business Suite / Order Management instance (CVSS PR:L) and network HTTP access to the Order Management Product Diagnostic Tools component; affected builds are Oracle Order Management 12.2.3 through 12.2.15. Limiting factors: the attacker cannot be fully unauthenticated, impact is read-only (confidentiality only - no data tampering or service disruption), and risk concentrates on EBS deployments that are internet-facing or that provision low-privilege accounts broadly. No special non-default configuration or user interaction is required beyond holding valid low-privilege credentials.

This is a moderate-priority, authenticated information-disclosure flaw rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates network-reachable exploitation over HTTP with low attack complexity and no user interaction, but it explicitly requires low-level privileges (PR:L) - so the attacker must already hold a valid, low-privilege Oracle Order Management / E-Business Suite account. Impact is confined to confidentiality (C:H, I:N, A:N): an attacker can read critical or all Order Management-accessible data but cannot modify data or disrupt availability. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no signal of active or probable exploitation; status is therefore 'no public exploit identified at time of analysis'. CONFLICT TO VERIFY: the input Tags include 'Authentication Bypass', which directly contradicts the CVSS PR:L requirement and the description's 'low privileged attacker' language - the authoritative Oracle/NVD data indicates an authenticated flaw, not an auth bypass, and the tag appears mislabeled. Net: real but not urgent; prioritize patching in the normal Oracle CPU cycle, with elevated attention for internet-facing EBS instances where low-privilege accounts are broadly provisioned.

An attacker who already holds a low-privilege Oracle E-Business Suite account sends crafted HTTP requests to the Order Management Product Diagnostic Tools component and retrieves confidential order-management data they should not be able to see. Because attack complexity is low and no user interaction is needed, exploitation is straightforward once authenticated, though no public exploit code was identified in the provided data.