EUVD-2026-61661
GHSA-xw2x-85c3-8vf3
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vendor vector accepted as-is; PR:L confirmed by description requiring a low-privileged account, AC:H consistent with non-trivial exploitation conditions, full C/I/A impact consistent with stated system takeover.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Sales product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales. Successful attacks of this vulnerability can result in takeover of Oracle Sales. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full compromise of Oracle Sales (E-Business Suite component: Internal Operations) is achievable by a low-privileged network attacker via HTTP across versions 12.2.3 through 12.2.15, with successful exploitation resulting in complete takeover - high confidentiality, integrity, and availability impact. The attack is constrained by high complexity (AC:H), meaning reliable exploitation requires meeting specific, non-trivial conditions rather than simple request crafting. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged Oracle E-Business Suite account (PR:L) with network access via HTTP to an instance running Oracle Sales 12.2.3 through 12.2.15. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-impact vulnerability meaningfully constrained by elevated attack complexity and the need for at least low-level credentials - precluding unauthenticated, automated mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's August 2026 Critical Security Patch Update, available via the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html; consult Oracle My Oracle Support (MOS) for the specific patch bundle applicable to your EBS release within the 12.2.3-12.2.15 range, as no discrete patched version number was independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all systems running Oracle Sales 12.2.3-12.2.15 and assess exposure level (internet-facing versus internal network). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Sales versions 12.2.3 through 12.2.15 within Oracle E-Business Suite allows low-privileged, network-authenticated
Oracle Sales within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes an authorization flaw in its Interna
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today