EUVD-2026-61711
GHSA-86q4-5f8j-3cj7
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Network HTTP delivery with low-privilege auth and high-complexity preconditions; scope change to adjacent EBS components; no availability impact described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. While the vulnerability is in Oracle Order Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Order Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).
AnalysisAI
Unauthorized data access in Oracle Order Management's Product Diagnostic Tools component allows low-privileged authenticated attackers over HTTP to compromise confidentiality of critical order data and perform limited data manipulation, with a confirmed scope change that can extend impact to adjacent Oracle E-Business Suite components. Affected deployments span a wide version range, 12.2.3 through 12.2.15, and are addressed in Oracle's Critical Patch Update for August 2026. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged Oracle E-Business Suite user account; fully unauthenticated external attackers cannot directly trigger this vulnerability, as confirmed by the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.1 (High) is shaped primarily by the high confidentiality impact and scope change (S:C), which elevates the effective reach of exploitation across the EBS platform. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses this vulnerability in the Product Diagnostic Tools component of Oracle Order Management. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Oracle Order Management instances running versions 12.2.3 through 12.2.15 and assess business criticality and order data sensitivity; simultaneously restrict access to the Product Diagnostic Tools component to essential administrators only and enable detailed audit logging of all diagnostic tool access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Order Management
View allImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Veribilim So
Full compromise of Oracle Order Management, a module of Oracle E-Business Suite (EBS), is possible via the Product Diagn
Data compromise in Oracle Order Management (Product Diagnostic Tools component) of Oracle E-Business Suite versions 12.2
Oracle Order Management's Product Diagnostic Tools component in Oracle E-Business Suite versions 12.2.3 through 12.2.15
Full compromise of Oracle Order Management (part of Oracle E-Business Suite) is possible via the Product Diagnostic Tool
Oracle Order Management's Product Diagnostic Tools component exposes a local privilege-dependent flaw affecting versions
Vulnerability in the Oracle Order Management component of Oracle E-Business Suite (subcomponent: Product Diagnostic Tool
Unauthorized critical data disclosure in Oracle Order Management (Oracle E-Business Suite) versions 12.2.3 through 12.2.
Unauthorized data disclosure in Oracle Order Management's Product Diagnostic Tools component (E-Business Suite 12.2.3-12
Oracle Order Management's Product Diagnostic Tools component in E-Business Suite versions 12.2.3 through 12.2.15 can be
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today