EUVD-2026-61635
GHSA-rr8c-284v-p438
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Network-exploitable over HTTP with low privilege required; high confidentiality impact from full AD data exposure; no integrity impact; low availability from partial DoS; scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications DBA. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications DBA accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Applications DBA. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
AnalysisAI
Oracle Applications DBA, the administrative component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, exposes critical internal operations over HTTP to low-privileged attackers. Successful exploitation enables unauthorized access to critical or complete data accessible by the Applications DBA component, along with the ability to trigger partial denial-of-service conditions against the same component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged Oracle E-Business Suite account (confirmed by PR:L in the CVSS vector), with network access to the application over HTTP. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.1 (High) reflects a network-exploitable vulnerability with low attack complexity (AC:L), low privilege requirements (PR:L), no user interaction (UI:N), and high confidentiality impact alongside low availability impact, with no integrity effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Security Update for August 2026 by consulting the Oracle Security Alerts page at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediate action (within 24 hours): Inventory all Oracle E-Business Suite deployments to identify systems running versions 12.2.3 through 12.2.15 and map their network accessibility. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Applications Dba
View allPrivilege escalation to full component takeover in Oracle E-Business Suite (Oracle Applications DBA, ADPatch component)
Full takeover of Oracle Applications DBA within Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible via
Full compromise of the Oracle Applications DBA component (Internal Operations) in Oracle E-Business Suite versions 12.2.
Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: AD Utilities). Rated me
Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: AD Utilities). Rated me
Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.1.3 and 12.2.3 through
Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.2.3 through 12.2.6 allo
Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.1.3 and 12.2.3 through
Local privilege abuse in Oracle Applications DBA (E-Business Suite component: Internal Operations) allows a low-privileg
Oracle Applications DBA versions 12.2.3-12.2.15 contain an authorization flaw in the Java utilities component that allow
Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: Patching). Rated medium
Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.1.3 allows local users
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today