EUVD-2026-37263Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS credentials
-
DeliveryReach Oracle Quality HTTP endpoint
-
ExploitSend crafted Internal Operations request
-
ExecutionBypass authorization in Quality module
-
ImpactTake over Oracle Quality data and functions
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) network reachability to the Oracle E-Business Suite web tier over HTTP/HTTPS, and (2) a valid low-privileged authenticated session on EBS (PR:L) capable of reaching the Oracle Quality module's Internal Operations component on a supported 12.2.3-12.2.15 deployment. There is no user-interaction requirement (UI:N) and attack complexity is low (AC:L), so no special timing, configuration toggle, or victim action is needed. The principal limiting factor is the authentication requirement: organizations that strictly segment EBS access (no internet-exposed login, MFA on all EBS accounts, minimized low-privilege role assignments) materially reduce the attacker population, whereas deployments with broad self-service or partner access to EBS are at near-default exposure. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H combined with Oracle's own 'easily exploitable' language indicates a genuinely high real-world risk for any EBS environment where low-privileged accounts can reach the Quality module over HTTP - this is the typical condition in EBS deployments, where many internal users hold low-privilege roles. No EPSS score, KEV listing, or POC was provided in the input, so exploitation probability data is missing; per the precision rules this is 'no public exploit identified at time of analysis,' not evidence of low interest. The lack of a CWE and the absence of vendor technical detail (standard for Oracle CPUs) is the main intelligence gap: defenders should treat the CVSS signal and vendor severity as the authoritative basis for prioritization, while recognizing that the 8.8 score may understate real risk if the Quality module is exposed beyond trusted internal users. |
| Exploit ScenarioDerived | An attacker who has obtained any low-privileged Oracle E-Business Suite account - for example a generic internal employee responsibility or a compromised contractor login - sends crafted HTTP requests to the Oracle Quality Internal Operations component over the EBS web tier and achieves full takeover of the Quality module, allowing them to read, modify, or destroy quality-management data. Because Oracle rates the issue 'easily exploitable' and the CVSS vector is AC:L/UI:N, no user interaction or unusual conditions are required once a low-privilege session exists, although no public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Account takeover of the Oracle Quality module in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to fully compromise the component over HTTP. Per the vendor's June 2026 Critical Patch Update advisory the issue is rated CVSS 8.8 with high impact on confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Risk is elevated for internet- or intranet-exposed EBS deployments because exploitation is rated 'easily exploitable' and only requires a valid low-privilege session.
RemediationAI
Apply the patch available per vendor advisory by installing the Oracle E-Business Suite fixes shipped in the June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html); Oracle does not publish a discrete fixed micro-version for EBS modules, so the CPU patch set itself is the authoritative remediation. Until the CPU can be applied, reduce exposure by restricting network access to the EBS application tier so that only trusted internal users can reach Oracle Quality URLs (for example via WAF/reverse-proxy ACLs on the Oracle Quality responsibility endpoints), and review and tighten EBS responsibilities so that the population of low-privileged accounts able to authenticate to the Quality module is minimized; both controls have the side effect of blocking some legitimate self-service users and should be coordinated with the EBS functional owners. Monitor EBS access logs for anomalous low-privileged session activity against Quality module URLs during the window before patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Quality is a manufacturing quality-management module of the Oracle E-Business Suite (EBS) 12.2 family, and the affected component is identified as Internal Operations - typically a set of authenticated HTTP-accessible business functions served by Oracle HTTP Server / WebLogic in front of the EBS application tier. The CPE 'cpe:2.3:a:oracle_corporation:oracle_quality' confirms the Oracle Quality product surface, and the entire EBS 12.2.x maintenance line (12.2.3 through 12.2.15) is in scope. No CWE was assigned by Oracle, which is consistent with their longstanding practice of not disclosing root-cause class in CPU advisories; based on the description (HTTP attack vector, low privileges, full CIA impact and 'takeover' wording), the underlying weakness is most plausibly an authorization or input-handling flaw in an EBS servlet/JSP that elevates a low-privileged user to full control of the Quality module.
Know when Oracle Quality gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
HTTP-reachable EBS component, vendor labels exploitation easy with no user interaction, requires a low-privileged EBS account, and results in full Quality module takeover (C/I/A High).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality. Successful attacks of this vulnerability can result in takeover of Oracle Quality. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite Quality module (versions 12.2.3-12.2.15) contains a vulnerability allowing any low-privilege user to take over accounts and fully compromise the module, exposing sensitive business data and disrupting critical operations. Organizations with internet- or intranet-exposed deployments face immediate exploitation risk, as no vendor patch has been released. This vulnerability poses a critical data security and operational continuity threat requiring urgent mitigation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to the Quality module using firewalls, WAF rules, or network segmentation to limit exposure to trusted networks only; (2) implement strict authentication and session management controls for all Quality module user accounts; (3) deploy continuous monitoring and real-time alerting for suspicious account activity and privilege escalation attempts; (4) minimize the number of low-privilege accounts with Quality module access through access reviews and principle of least privilege; (5) disable HTTP access to Quality module endpoints and enforce HTTPS only; (6) implement additional authentication factors or IP-based access controls for Quality module access; (7) coordinate with Oracle support regarding emergency guidance and patch timeline.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB