EUVD-2026-61751
GHSA-3g9g-24h5-3h53
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L
Local vector and high privileges confirmed by description; scope change retained per documented cross-product impact; integrity-dominant profile matches data modification capability with limited confidentiality and availability effects.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle SDP Number Portability executes to compromise Oracle SDP Number Portability. While the vulnerability is in Oracle SDP Number Portability, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle SDP Number Portability accessible data as well as unauthorized read access to a subset of Oracle SDP Number Portability accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SDP Number Portability. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L).
AnalysisAI
Oracle SDP Number Portability versions 12.2.3 through 12.2.15, a telecommunications management component of Oracle E-Business Suite, exposes a local privilege-abuse flaw in its Internal Operations component that enables high-privileged insiders or post-breach actors to compromise the affected system. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, read access to a subset of accessible data, and the ability to cause a partial denial of service - with a scope change (S:C) extending potential impact to additional Oracle products co-hosted in the same E-Business Suite environment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold high-privileged local access - specifically, the ability to log on to the infrastructure host where Oracle SDP Number Portability executes, as explicitly stated in the CVE description ('high privileged attacker with logon to the infrastructure'). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C) constrains real-world risk substantially: exploitation is local-only, requires pre-existing high-privileged access, and is therefore not automatable or remotely exploitable at scale. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patches distributed by Oracle as part of the August 2026 Critical Patch Update, available through the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html; consult Oracle My Oracle Support for the specific patch set IDs applicable to your installed version within the 12.2.3-12.2.15 range. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately inventory all Oracle E-Business Suite environments running SDP Number Portability versions 12.2.3 through 12.2.15 and restrict administrative access to only essential personnel, documenting all accounts with Internal Operations component privileges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Full compromise of Oracle SDP Number Portability (a Service Delivery Platform component of Oracle E-Business Suite versi
Unauthorized read and write access to Oracle SDP Number Portability (Oracle E-Business Suite, Internal Operations compon
Unauthenticated remote data exposure in Oracle SDP Number Portability (E-Business Suite versions 12.2.3 through 12.2.15)
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today