EUVD-2026-61877
GHSA-cpmq-37jj-r2j6
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible diagnostic endpoint requires a valid low-privilege EBS credential and high-complexity conditions; full takeover justifies C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Oracle Order Management's Product Diagnostic Tools component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 can be fully compromised by a low-privileged attacker over HTTP, resulting in complete system takeover with high confidentiality, integrity, and availability impact. The attack requires low privileges and high complexity to execute, reducing the immediacy of the threat but not its severity if conditions are met. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess a valid low-privileged account with network access to the Oracle E-Business Suite HTTP interface (PR:L, AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 is driven by network reachability (AV:N), low privilege requirement (PR:L), and full C/H/I/H/A:H impact, offset by high attack complexity (AC:H) which reflects a genuinely difficult exploitation path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle August 2026 Critical Patch Update (CPU), available via Oracle's security advisory at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses this vulnerability across the affected 12.2.3 to 12.2.15 version range. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of Oracle E-Business Suite deployments to identify all instances running versions 12.2.3 through 12.2.15 and confirm which have the Product Diagnostic Tools component enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Order Management
View allImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Veribilim So
Full compromise of Oracle Order Management, a module of Oracle E-Business Suite (EBS), is possible via the Product Diagn
Data compromise in Oracle Order Management (Product Diagnostic Tools component) of Oracle E-Business Suite versions 12.2
Full compromise of Oracle Order Management (part of Oracle E-Business Suite) is possible via the Product Diagnostic Tool
Oracle Order Management's Product Diagnostic Tools component exposes a local privilege-dependent flaw affecting versions
Unauthorized data access in Oracle Order Management's Product Diagnostic Tools component allows low-privileged authentic
Vulnerability in the Oracle Order Management component of Oracle E-Business Suite (subcomponent: Product Diagnostic Tool
Unauthorized critical data disclosure in Oracle Order Management (Oracle E-Business Suite) versions 12.2.3 through 12.2.
Unauthorized data disclosure in Oracle Order Management's Product Diagnostic Tools component (E-Business Suite 12.2.3-12
Oracle Order Management's Product Diagnostic Tools component in E-Business Suite versions 12.2.3 through 12.2.15 can be
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today