EUVD-2026-37251Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
HTTP-reachable EBS module needing a valid low-privilege account (PR:L) and non-trivial conditions (AC:H); successful exploitation takes over CMRO so C:H/I:H/A:H within unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair and Overhaul. Successful attacks of this vulnerability can result in takeover of Oracle Complex Maintenance, Repair and Overhaul. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of Oracle Complex Maintenance, Repair and Overhaul (CMRO) versions 12.2.3 through 12.2.15 is possible by an authenticated low-privileged attacker over HTTP against the Internal Operations component. Successful exploitation yields high impact to confidentiality, integrity, and availability of the CMRO module, though Oracle rates the attack complexity as high. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must (1) have network reachability to the Oracle E-Business Suite application tier over HTTP/HTTPS - typically internal LAN, VPN, or an exposed EBS portal - and (2) possess valid credentials for an EBS account with at least low privileges, per PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact tempered by AC:H (non-trivial exploitation conditions, e.g. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or been issued a low-privilege Oracle EBS account (for example a contractor, a phished maintenance technician, or a compromised vendor login) reaches the CMRO Internal Operations endpoints over HTTP and submits a crafted request sequence that abuses the vulnerable logic to escalate within the module. Because Oracle classifies the result as 'takeover' of CMRO, the attacker can then read, modify, or destroy maintenance work orders, parts records, and operational data tied to high-value assets. … |
| Remediation | Apply the fixes bundled in Oracle's June 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cspujun2026.html; an exact patched build number is not stated in the provided data, so administrators should consult the CPU matrix for their EBS 12.2.x level and apply the corresponding CMRO patch through AutoPatch/adop. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Oracle CMRO 12.2.3-12.2.15 deployments; restrict HTTP access to Internal Operations component to explicit trusted internal networks; review current low-privileged user base. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Takeover of Oracle Complex Maintenance, Repair and Overhaul (cMRO) versions 12.2.3 through 12.2.15 is achievable by a lo
Takeover of Oracle Complex Maintenance, Repair and Overhaul (CMRO) in Oracle E-Business Suite versions 12.2.3 through 12
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today