EUVD-2026-37282Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
DeliveryReach EBS web tier over HTTP
-
ExploitSend crafted request to Internal Operations component
-
ExecutionExploit flaw in Outsourced Mfg module
-
PersistAchieve full module takeover
-
ImpactRead/modify manufacturing and supply-chain data
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker needs (1) network HTTP/HTTPS reachability to the Oracle E-Business Suite web tier hosting the Outsourced Mfg for Discrete Industries module, and (2) a valid low-privileged EBS account (PR:L) with access to the Internal Operations component - typical EBS end-user credentials are sufficient, no admin role required. The deployment must be running an unpatched version in the 12.2.3-12.2.15 range. Limiting factors: EBS instances isolated from untrusted networks (VPN-only, internal-only) shrink the attacker pool to insiders and lateral-movement scenarios, and organizations that do not license/enable the Outsourced Mfg for Discrete Industries module are not exposed. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) makes this a high-priority issue: network-reachable, low complexity, requires only a low-privileged EBS account, no user interaction, and yields full takeover of the module. Oracle's own description calls it 'easily exploitable.' However, no EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so real-world exploitation pressure cannot be quantified beyond the CVSS signal. Practical risk is highest for organizations exposing EBS to the internet or to large untrusted user populations; internally-scoped EBS deployments still face insider/lateral-movement risk because PR:L is trivially met by any standard EBS user. |
| Exploit ScenarioDerived | An attacker with any low-privileged Oracle EBS account - for example a contractor or compromised supplier user - sends a crafted HTTP request to the Internal Operations component of the Outsourced Mfg module and takes over the product, gaining the ability to read, modify, and destroy manufacturing and supply-chain data. No user interaction is required, complexity is low, and a single account is sufficient; no public exploit identified at time of analysis, but Oracle explicitly labels it easily exploitable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Full takeover of Oracle Outsourced Mfg for Discrete Industries (component: Internal Operations) is achievable by a low-privileged authenticated attacker over HTTP, per Oracle's June 2026 Critical Patch Update advisory. The CVSS 3.1 base score of 8.8 reflects high impact across confidentiality, integrity, and availability with low attack complexity, though no public exploit identified at time of analysis. Affected versions span 12.2.3 through 12.2.15 of Oracle E-Business Suite.
RemediationAI
Apply patch available per vendor advisory by installing the fixes bundled in Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html); exact patch numbers are listed in the CPU's E-Business Suite patch availability matrix and should be applied to all instances on 12.2.3-12.2.15 in line with Oracle's standard adop/ad utility procedures, followed by post-patch validation of the Outsourced Mfg module. Until patched, restrict network reachability to the EBS web tier by placing it behind a VPN or reverse proxy with IP allow-listing, audit and reduce accounts with access to the Outsourced Mfg / Internal Operations responsibilities (since any low-privileged EBS user can exploit), and consider WAF rules in front of the affected servlet paths once Oracle identifies them in the CPU notes; these controls reduce attack surface but do not address the underlying flaw and may break legitimate workflows for outsourced manufacturing partners.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite (EBS) is Oracle's flagship enterprise resource planning (ERP) platform, with the Outsourced Mfg for Discrete Industries module supporting manufacturers who delegate production to third parties. The vulnerable Internal Operations component is reached over HTTP, indicating exposure through the EBS web-tier (typically the Oracle HTTP Server fronting OAF/Forms servlets). No CWE was assigned by Oracle (their CPU advisories routinely omit CWE classification), but the combination of low privileges, network HTTP vector, and full C/I/A compromise is consistent with an authenticated injection, deserialization, or access-control bypass in an EBS servlet or PL/SQL gateway endpoint.
Know when Oracle Outsourced Mfg For Discrete Industries gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
HTTP-reachable EBS web tier (AV:N), Oracle labels easily exploitable (AC:L), requires a low-privileged EBS account (PR:L), no user interaction, and description states full module takeover (C:H/I:H/A:H).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outsourced Mfg for Discrete Industries. Successful attacks of this vulnerability can result in takeover of Oracle Outsourced Mfg for Discrete Industries. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
A critical vulnerability in Oracle E-Business Suite Outsourced Manufacturing module (versions 12.2.3-12.2.15) allows low-privileged authenticated users to achieve complete system takeover with high impact to confidentiality, integrity, and availability. Organizations running affected versions face full operational compromise of manufacturing systems and exposure of sensitive production data to any internal user with system access.
No vendor-released patch identified at time of analysis. Interim mitigations: Restrict network access to manufacturing module endpoint via firewall/WAF rules; implement HTTP request filtering and rate limiting on module endpoints; enable real-time alerting on suspicious login patterns and unauthorized data access; enforce multi-factor authentication for manufacturing module access; restrict database privileges for application service accounts to minimum required permissions; consider temporary disabling of manufacturing operations module if business continuity planning permits.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB