EUVD-2026-47256
GHSA-f9pr-gh9p-xp9x
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Full product takeover in Oracle Advanced Supply Chain Planning (Core component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an already high-privileged attacker with HTTP network access to fully compromise the module's confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.2 and describes it as easily exploitable once the required elevated privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle has addressed it in the July 2026 Critical Patch Update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Advanced Supply Chain Planning gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Advanced Supply Chain Planning product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Advanced Supply Chain Planning. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Supply Chain Planning. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Organizations running Oracle E-Business Suite versions 12.2.3-12.2.15 face supply chain planning disruption if high-privileged accounts are compromised, allowing complete takeover of the Advanced Supply Chain Planning module that threatens inventory optimization, demand forecasting, and supplier visibility. The vulnerability enables insiders or attackers with administrative access to steal, corrupt, or deny access to critical planning operations. While no public exploit has been identified at time of analysis, immediate patching is necessary to close this high-risk insider threat pathway.
Within 24 hours: Identify and document all systems running Oracle E-Business Suite versions 12.2.3-12.2.15 and categorize them by supply chain criticality level. Within 7 days: Apply Oracle's July 2026 Critical Patch Update to all affected systems in order of business criticality, and verify that the Advanced Supply Chain Planning module functions correctly post-patch. Within 30 days: Conduct a forensic audit of high-privilege account activities within E-Business Suite for the pre-patch period to identify any unauthorized supply chain planning module access, and implement enhanced transaction logging and alerting on supply chain planning module operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), th
Unspecified vulnerability in the Oracle Advanced Supply Chain Planning component in Oracle Supply Chain Products Suite 1
Vulnerability in the Oracle Advanced Supply Chain Planning product of Oracle Supply Chain (component: Core). Rated criti
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write acce
Exploit-DB