EUVD-2026-61497
GHSA-38q8-hxwp-g8pq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP access with low-privilege credentials required and no interaction; full takeover impact across C/I/A is consistent with vendor-described compromise.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Flow Manufacturing. Successful attacks of this vulnerability can result in takeover of Oracle Flow Manufacturing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Oracle Flow Manufacturing versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains a vulnerability in its Internal Operations component that allows a low-privileged, network-authenticated attacker to fully compromise the system via HTTP with no user interaction required. The vendor characterizes this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete loss of confidentiality, integrity, and availability - constituting a full product takeover rather than the narrower 'Information Disclosure' tag in the intelligence metadata would suggest. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged Oracle E-Business Suite user account (CVSS PR:L) - this is the primary gating condition and the main factor limiting exploitation to authenticated actors. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) paints a high-priority picture: network-accessible via HTTP, low attack complexity, no user interaction, and full system takeover on successful exploitation - the only meaningful barrier is the PR:L requirement for a low-privileged account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Security Patch Update (CPU) for August 2026, published at https://www.oracle.com/security-alerts/cspuaug2026.html, which contains the fix for this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all systems running Oracle Flow Manufacturing versions 12.2.3-12.2.15 and immediately restrict network access to the HTTP service using firewall rules, limiting to only necessary users and systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Flow Manufacturing
View allFull compromise of Oracle Flow Manufacturing (Internal Operations component of Oracle E-Business Suite) is achievable by
Data compromise in Oracle Flow Manufacturing (Oracle E-Business Suite 12.2.13-12.2.15, Internal Operations component) al
Unauthorized data access in Oracle Flow Manufacturing 12.2.3 through 12.2.15 allows network-authenticated low-privileged
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today