EUVD-2026-33016
GHSA-52wf-x2gw-qm74
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Oracle EBS instance
-
DeliveryObtain low-privileged EBS credentials
-
ExploitAuthenticate to Flow Manufacturing
-
ExecutionSubmit malicious SQL-based request
-
PersistTrigger vulnerable component logic
-
ImpactAchieve full Flow Manufacturing takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must possess a valid low-privileged account on the Oracle E-Business Suite instance (PR:L per CVSS) and have network reachability to the Flow Manufacturing component, with the attack channel being SQL per Oracle's description. No user interaction is required (UI:N) and attack complexity is low (AC:L). The exploit is limited to Oracle EBS deployments running Flow Manufacturing versions 12.2.9 through 12.2.15 specifically - older or newer EBS branches and EBS installations without the Flow Manufacturing module enabled are out of scope. Organizations that gate EBS behind VPN, MFA, or IP allowlisting materially raise the bar to acquiring the required low-privileged foothold. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact on the affected component - a strong technical risk profile. EPSS and CISA KEV data are not provided in the input, so real-world exploitation probability cannot be quantified, and no public exploit has been identified at time of analysis. Oracle EBS deployments are historically high-value targets handling financial and operational data, so even absent KEV listing this should be treated as a priority patch for any organization running affected versions, particularly where the EBS instance is reachable from untrusted networks. The 'low privileged' requirement is a meaningful but not severe limiter - any authenticated EBS user with SQL access to this component is in scope. |
| Exploit ScenarioDerived | An attacker with a low-privileged EBS application account - obtained via phishing, credential reuse, or insider access - connects to Oracle Flow Manufacturing over the network and submits a crafted SQL-based request that abuses the vulnerable component. The request results in full compromise of Flow Manufacturing, giving the attacker read, modify, and disrupt capability over manufacturing data and processes. No public exploit has been identified at time of analysis, but the AC:L rating indicates exploitation is straightforward once access is achieved. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 28, 2026
Full product takeover of Oracle Flow Manufacturing (versions 12.2.9 through 12.2.15) is achievable by a low-privileged remote attacker via SQL-based network access, per Oracle's advisory. The flaw scores CVSS 8.8 with high impact across confidentiality, integrity, and availability, and no public exploit has been identified at time of analysis. As a component of Oracle E-Business Suite, exploitation provides an attacker with control over a business-critical manufacturing execution system.
RemediationAI
Apply the fixes from Oracle's May 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspumay2026.html) to all Oracle E-Business Suite 12.2.9-12.2.15 deployments running Flow Manufacturing; the specific patch identifier should be sourced from that CPU document since an exact fixed version is not enumerated in the input data. Patch availability is confirmed by the vendor advisory but no discrete fix version string is provided here, so cite the CPU as the authoritative reference. As compensating controls until patching is complete, restrict network access to the EBS application tier so only trusted internal subnets and VPN users can reach Flow Manufacturing endpoints (side effect: may disrupt external integrations or partner access), enforce least-privilege on EBS application accounts to reduce the pool of low-privileged users who could exploit this, and increase monitoring of database audit logs for anomalous SQL patterns originating from Flow Manufacturing sessions (side effect: log volume and storage increase).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Flow Manufacturing is a module within Oracle E-Business Suite (EBS) used to manage mixed-model production lines and just-in-time manufacturing workflows. The CPE string cpe:2.3:a:oracle_corporation:oracle_flow_manufacturing:*:*:*:*:*:*:*:* confirms the Oracle Corporation product is the sole affected component. The advisory categorizes the issue under the Security component and notes the attack channel is SQL, strongly implying a SQL-layer weakness (such as SQL injection or insufficient query authorization) - though Oracle does not assign a CWE in its CPU disclosures, so the precise weakness class is not formally documented.
Know when Oracle Flow Manufacturing gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Security). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Flow Manufacturing. Successful attacks of this vulnerability can result in takeover of Oracle Flow Manufacturing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Flow Manufacturing (versions 12.2.9-12.2.15) contains a vulnerability allowing authenticated attackers with low-level privileges to gain complete control over manufacturing operations and data. For organizations dependent on Oracle E-Business Suite, this creates immediate risk to production scheduling, supply chain visibility, and operational continuity, with no patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to Flow Manufacturing via IP whitelisting and VPN enforcement; implement strict least-privilege database account policies and eliminate unnecessary low-privilege user roles; deploy real-time SQL query monitoring and alerting for suspicious patterns; isolate Flow Manufacturing infrastructure on segregated network segments; maintain detailed audit logs of all user authentication, privilege changes, and database modifications; disable remote access to Flow Manufacturing systems where operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB