EUVD-2026-79743
GHSA-c7j9-78qj-68qv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
HTTPS-reachable with no user interaction, but a valid low-privilege EBS session is required, so PR:L with full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Complex Maintenance, Repair and Overhaul. Successful attacks of this vulnerability can result in takeover of Oracle Complex Maintenance, Repair and Overhaul. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Low-privileged attackers with HTTPS network access can fully compromise the Internal Operations component of Oracle Complex Maintenance, Repair and Overhaul (CMRO) in Oracle E-Business Suite versions 12.2.3 through 12.2.15, achieving complete confidentiality, integrity, and availability impact on the affected module. The flaw carries a CVSS 3.1 base score of 8.8 and requires only an authenticated network session (PR:L) with no user interaction, making it a straightforward lateral escalation for any user holding a valid low-privilege EBS account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete preconditions: (1) a valid, authenticated Oracle E-Business Suite session at low privilege - the CVSS vector explicitly specifies PR:L, so unauthenticated attackers cannot trigger this; (2) network reachability over HTTPS to the CMRO Internal Operations component, meaning the EBS application tier must be exposed to the attacker's network path (directly or through a proxy/VPN); and (3) the target instance must be running Oracle Complex Maintenance, Repair and Overhaul on an affected release between 12.2.3 and 12.2.15, with typical EBS web-entry configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned vector is network-reachable, low complexity, requires low privileges, and needs no user interaction, producing a high 8.8 base score with uniform C:H/I:H/A:H impact - all of which argue for prompt patching. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Oracle released this fix through its Critical Security Patch Update program; consult https://www.oracle.com/security-alerts/cspusep2026.html for the precise CPU/CSPU patch set and apply it to E-Business Suite 12.2.3-12.2.15, then re-run the AD patch cycle and regenerate the file system. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today