EUVD-2026-61879
GHSA-w9r3-8r6w-38rq
Severity by source
AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Local infrastructure logon and high-privileged account required (AV:L, PR:H); difficult exploitation conditions (AC:H); scope change confirmed; no availability impact stated.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Order Management executes to compromise Oracle Order Management. While the vulnerability is in Oracle Order Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Order Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).
AnalysisAI
Oracle Order Management's Product Diagnostic Tools component exposes a local privilege-dependent flaw affecting versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, allowing a high-privileged local attacker to achieve unauthorized read and write access to critical data with scope impact extending beyond the Order Management module itself. The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) confirms that exploitation is constrained to infrastructure-level access, requiring both physical or logical logon to the host system and an elevated account, but successful exploitation yields complete confidentiality and integrity compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker must have an existing logon to the physical or virtual infrastructure where Oracle Order Management executes (AV:L), ruling out remote network-based exploitation; (2) the attacker must hold a high-privileged account within the Oracle E-Business Suite environment (PR:H), such as an EBS system administrator or equivalent; and (3) the attack is rated high complexity (AC:H), meaning specific environmental or configuration conditions must align for exploitation to succeed - the exact nature of these conditions is not detailed in available advisories. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.2 reflects a meaningful but heavily constrained attack surface: AV:L requires the attacker to have already achieved logon to the underlying infrastructure, AC:H signals that exploitation is not straightforward and requires specific conditions to be met, and PR:H mandates an existing high-privileged account - a significant barrier that limits the realistic threat actor population to insiders, compromised administrators, or attackers who have already achieved deep lateral movement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply Oracle's Critical Patch Update (CPU) for August 2026, referenced at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Oracle E-Business Suite systems and identify those running versions 12.2.3-12.2.15; document current access controls for the Product Diagnostic Tools component. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Order Management
View allImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Veribilim So
Full compromise of Oracle Order Management, a module of Oracle E-Business Suite (EBS), is possible via the Product Diagn
Data compromise in Oracle Order Management (Product Diagnostic Tools component) of Oracle E-Business Suite versions 12.2
Oracle Order Management's Product Diagnostic Tools component in Oracle E-Business Suite versions 12.2.3 through 12.2.15
Full compromise of Oracle Order Management (part of Oracle E-Business Suite) is possible via the Product Diagnostic Tool
Unauthorized data access in Oracle Order Management's Product Diagnostic Tools component allows low-privileged authentic
Vulnerability in the Oracle Order Management component of Oracle E-Business Suite (subcomponent: Product Diagnostic Tool
Unauthorized critical data disclosure in Oracle Order Management (Oracle E-Business Suite) versions 12.2.3 through 12.2.
Unauthorized data disclosure in Oracle Order Management's Product Diagnostic Tools component (E-Business Suite 12.2.3-12
Oracle Order Management's Product Diagnostic Tools component in E-Business Suite versions 12.2.3 through 12.2.15 can be
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today