EUVD-2026-61780
GHSA-22g6-8j3m-p386
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network access via HTTP confirmed; AC:H reflects 'difficult to exploit' per description; PR:L required per description; full CIA takeover confirmed; scope unchanged per S:U.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Systems. Successful attacks of this vulnerability can result in takeover of Oracle Process Manufacturing Systems. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full system takeover is possible in Oracle Process Manufacturing Systems (OPM), an Oracle E-Business Suite component, via a network-accessible flaw in the Internal Operations sub-component affecting versions 12.2.3 through 12.2.15. A low-privileged attacker operating over HTTP can, under high-complexity conditions, compromise confidentiality, integrity, and availability simultaneously - Oracle's own language is 'takeover of Oracle Process Manufacturing Systems.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope of impact makes this a priority patch target for manufacturing-sector organizations running Oracle EBS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) network-level HTTP connectivity to the Oracle E-Business Suite instance hosting OPM; (2) a valid, low-privileged account within the EBS environment (PR:L - unauthenticated exploitation is not supported by the CVSS vector); (3) high attack complexity (AC:H), meaning the attacker must satisfy non-trivial preconditions - the exact nature of these conditions is not disclosed by Oracle, but AC:H in Oracle CPU context typically indicates a race condition, specific server state, or chained prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 Base Score of 7.5 (High) reflects the full-CIA impact of successful exploitation, but AC:H is a material exploitability limiter - real-world exploitation requires the attacker to satisfy conditions beyond simple network connectivity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patches distributed in Oracle's Critical Patch Update (CPU) for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Oracle OPM deployments and identify instances running versions 12.2.3 through 12.2.15, prioritizing those supporting critical manufacturing operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Account/instance takeover in Oracle Process Manufacturing Systems (Internal Operations component of Oracle E-Business Su
Data compromise in Oracle Process Manufacturing Systems (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-priv
Data compromise in Oracle Process Manufacturing Systems (Oracle E-Business Suite, Internal Operations component) version
Oracle Process Manufacturing Systems (OPM), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes a h
Full compromise of the Oracle Process Manufacturing Systems module in Oracle E-Business Suite 12.2.11 through 12.2.15 is
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today