EUVD-2026-79728
GHSA-9c95-8w9v-j8c3
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Low-privileged users with network access to Oracle E-Business Suite's Product Workbench component (Internal Operations) can read, create, modify, and delete critical business data across the full 12.2.3–12.2.15 release range. Oracle rates this 8.1 with a network-accessible, low-complexity, no-user-interaction vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning a valid but unprivileged account is enough to reach full confidentiality and integrity impact on Product Workbench data, with no availability impact. No CISA KEV listing, no public exploit code, and no EPSS score were provided in the source data, so current exploitation activity is unconfirmed — though Oracle CPU-class issues in EBS are historically targeted by attackers who already hold a foothold account.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Product Workbench gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Workbench. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Workbench accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Workbench accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Product Workbench
View allAuthenticated takeover of Oracle Product Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a
Unauthorized read and write access to critical data in Oracle Product Workbench (Internal Operations component of Oracle
Unauthorized data compromise in Oracle Product Workbench (Oracle E-Business Suite, Internal Operations component), versi
Oracle Product Workbench, a module within Oracle E-Business Suite, permits a low-privileged attacker who already holds a
Oracle Product Workbench's WebUI component within E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged
Authenticated attackers holding only low-privileged credentials in Oracle E-Business Suite can exploit a WebUI flaw in O
Exploit-DB