EUVD-2026-61359
GHSA-cv46-6vvg-mmxm
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Network HTTP access with low-privilege authenticated requirement, mandatory victim interaction, scope change to adjacent EBS modules, high confidentiality and limited integrity loss with no availability impact match the vendor-supplied vector and description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Linear Asset Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Asset Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Asset Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Enterprise Asset Management accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).
AnalysisAI
Unauthorized data access in Oracle Enterprise Asset Management (E-Business Suite, Linear Asset Management component), versions 12.2.3 through 12.2.15, is achievable by a low-privileged authenticated network attacker over HTTP when a victim interacts with attacker-controlled content, resulting in complete confidentiality exposure and limited integrity compromise with a confirmed scope change to additional products. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) combined with an Authentication Bypass tag from the reporter suggests a client-side attack pathway - likely cross-site scripting or a similar injection technique - where a victim must interact with attacker-influenced material to trigger the exploit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold at minimum a low-privileged authenticated account within Oracle Enterprise Asset Management (PR:L per Oracle-supplied CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.6 (High) is driven primarily by the scope change, high confidentiality impact, and network accessibility at low complexity, partially offset by the low privilege requirement (PR:L) and mandatory human interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses this vulnerability across all affected Oracle Enterprise Asset Management versions 12.2.3 through 12.2.15. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Oracle E-Business Suite deployments and identify instances running LAM component versions 12.2.3-12.2.15; document user populations with access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Enterprise Asset Management
View allINFOR EAM V11.0 Build 201410 has SQL injection via search fields, related to the filtervalue parameter. Rated high sever
INFOR EAM V11.0 Build 201410 has XSS via comment fields. Rated medium severity (CVSS 5.4), this vulnerability is remotel
Takeover of Oracle Enterprise Asset Management (the eAM module of Oracle E-Business Suite, Internal Operations component
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Work Definition I
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Setup). Rated hig
High-privileged network exploitation of Oracle Enterprise Asset Management's Internal Operations component allows unauth
Oracle Enterprise Asset Management (EAM) versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contai
Cross-site scripting or authorization bypass in Oracle Enterprise Asset Management (E-Business Suite, Internal Operation
Oracle Enterprise Asset Management (EAM), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, expose
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today