Oracle Flow Manufacturing CVE-2026-62498

Exploitation requires network HTTP access to an Oracle E-Business Suite deployment running the Flow Manufacturing module (Internal Operations component) at version 12.2.7 through 12.2.15, plus a valid low-privileged EBS application account (CVSS PR:L). No user interaction and no elevated privileges are needed once authenticated (AC:L, UI:N). Limiting factors: the attacker must already possess valid credentials, so purely anonymous internet exploitation is not indicated, and only the 12.2.7-12.2.15 code line with Flow Manufacturing enabled is affected; installations without this module deployed or on unaffected releases are not exposed.

The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: network attack vector, low complexity, low privileges required, no user interaction, and high impact to all three security properties - an attractive profile because the only barrier is holding a low-privilege EBS account, which is common in large enterprises with many internal users. No EPSS score, SSVC decision, POC, or KEV entry was provided, so exploitation probability cannot be quantified from the input and there is no evidence of active exploitation. The realistic priority is High rather than Critical: the PR:L requirement meaningfully narrows the attacker population to those who already have (or can obtain) valid EBS credentials, but given the ease of exploitation once authenticated and the sensitivity of ERP manufacturing data, this warrants prompt patching. Note the tension between the 'Information Disclosure' tag (suggesting read-only exposure) and the C:H/I:H/A:H 'takeover' rating - the CVSS impact should be treated as authoritative; verify scope with Oracle's advisory.

An attacker who has obtained any low-privilege Oracle EBS account - through phishing, credential reuse, or a rogue insider - sends crafted HTTP requests to the Flow Manufacturing Internal Operations interface and, because attack complexity is low and no user interaction is needed, escalates to full control of the module, reading and modifying manufacturing data. No public POC was identified at time of analysis, so exploitation would require the attacker to independently develop the technique.