EUVD-2026-61796
GHSA-xgp2-wqqr-cqww
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Network HTTP access with low complexity aligns with AV:N/AC:L; PR:L confirmed as a valid EBS account is required; no confidentiality impact and scope unchanged per description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Loans. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Loans accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Loans. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
AnalysisAI
Oracle Loans 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes its Internal Operations component to network-based exploitation by low-privileged authenticated attackers over HTTP. Successful exploitation grants unauthorized ability to create, delete, or modify critical data across all Oracle Loans accessible records, and can induce a partial denial of service against the application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess a valid low-privileged Oracle E-Business Suite user account with network access to the EBS HTTP interface (PR:L, AV:N per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.1 reflects a genuinely meaningful integrity risk: an attacker with only a low-privileged EBS account can compromise the integrity of all Oracle Loans data over the network with low attack complexity and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Patch Update for August 2026, available via the Oracle security advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Oracle E-Business Suite instances running Oracle Loans versions 12.2.3 through 12.2.15 and document current user privilege levels and access patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Data compromise in Oracle Loans (Internal Operations component of Oracle E-Business Suite 12.2.3-12.2.15) allows a low-p
Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Loan Details, Loan Accounting Events).
Oracle Loans within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes all loan records to network-authen
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today