EUVD-2026-79806
GHSA-crg3-4772-rmh3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS credentials
-
DeliveryReach BOM Setup Workbench over HTTP
-
ExploitSend crafted request exploiting flaw
-
ExecutionCross scope boundary to other products
-
ImpactExfiltrate critical Bills of Material data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network HTTP access to the Oracle Bills of Material Setup Workbench component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) AND a valid low-privileged application account (PR:L) - this is authenticated, not pre-auth. No user interaction is needed (UI:N) and no special non-default configuration is called out in the description. The primary limiting factors are the authentication requirement and that impact is confidentiality-only (no data modification or denial of service); the scope change means disclosed data may extend beyond Bills of Material to additional integrated Oracle products. |
| Impact | CVSS 3.1 base score is 7.7 (High) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - network-reachable, low attack complexity, but requiring low-level authentication (PR:L). The elevated 7.7 is driven almost entirely by the scope change (S:C); intrinsically this is a confidentiality-only issue (C:H, I:N, A:N) with no integrity or availability impact, so it is a data-disclosure flaw rather than a takeover. No EPSS score, no CISA KEV listing, and no public exploit code are provided in the intelligence, so there is no signal of active or automated exploitation - this is no public exploit identified at time of analysis. Oracle's Critical Patch Update advisory (cspusep2026) provides zero technical detail and no CWE is assigned, which is standard for Oracle CPU entries and limits independent verification. Net: a real but second-tier priority - it demands valid application credentials (not pre-auth) and yields only data disclosure, so it ranks well below the pre-auth full-takeover EBS/Fusion Middleware bugs in the same CPU. Note the input 'Authentication Bypass' tag conflicts with the CVSS vector (PR:L means authentication is required, not bypassed) - treat the tag as mislabeled. |
| Exploit ScenarioDerived | A low-privileged user with a valid Oracle E-Business Suite account (or an attacker who has phished/obtained such credentials) sends crafted HTTP requests to the Bills of Material Setup Workbench component. Successful exploitation reads critical data across all Bills of Material accessible data and, due to the scope change, may expose data belonging to other integrated Oracle products. No public proof-of-concept is available and Oracle discloses no technical detail, so weaponization currently requires original research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authenticated, low-privileged users with network HTTP access to the Oracle Bills of Material Setup Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Bills of Material data they are not authorized to see, including data belonging to other integrated Oracle products because the vulnerability crosses a security scope boundary (CVSS 3.1 base score 7.7, High). The weakness is confidentiality-only - there is no integrity or availability impact - and exploitation requires a valid low-privileged application account (PR:L) plus reachable HTTP access to the affected component, with no user interaction needed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied; the limiting factors are the authentication prerequisite and the read-only nature of the impact.
RemediationAI
No vendor-released patch version is identified in the available data, so the authoritative remediation source is the Oracle Security Alert / Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html, which is expected to carry the fix and any prerequisite patch levels for EBS 12.2.3 through 12.2.15; confirm the exact patched version there before upgrading and treat the absence of a version number here as missing data, not as confirmation that no fix exists. Pending that patch, prioritize compensating controls that directly address what makes this exploitable - network reachability and low-privileged entitlement. First, restrict HTTP access to the EBS application tier so only trusted networks, VPN ranges, or a reverse proxy with allow-listing can reach the Setup Workbench paths; the trade-off is that legitimate remote and partner users lose direct access unless routed through the same proxy. Second, review and reduce assigned responsibilities so that accounts that do not need Setup Workbench access (especially generic, shared, or legacy low-privileged accounts) have those menus and functions revoked via EBS function/responsibility security - this closes the PR:L prerequisite for those accounts but will break setup workflows for anyone who legitimately uses the workbench, so stage the change and document exceptions. Third, add monitoring and alerting on unusual Setup Workbench queries and on reads that span multiple Oracle modules, since the Scope change means exfiltration may show up outside Bills of Material. Fourth, because the impact is confidentiality-only, prioritize detection and data-access review over service-disabling measures; there is no need to shut the component down, and doing so would halt legitimate bill-of-material setup operations for no integrity or availability benefit. Also apply the standard EBS hygiene of enforcing least privilege, rotating credentials for low-privileged application accounts, and validating that no public exploit is being used against exposed HTTP endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite (EBS) is a large, modular enterprise application stack in which components such as Bills of Material are exposed to users through the EBS web tier over HTTP(S) and governed by application-level responsibilities, menus, and function security rather than by the database alone. The affected surface is the Setup Workbench component of Bills of Material, meaning the flaw lies in how that workbench enforces (or fails to enforce) authorization checks on data retrieval rather than in a memory-safety defect. No CWE was assigned in the provided data, but the behavior described - a low-privileged, authenticated user obtaining data beyond their entitlement, with high confidentiality impact and no integrity or availability impact - is characteristic of improper access control / missing authorization enforcement (CWE-284 / CWE-862 family); this classification is inferred from behavior and is not an official CWE assignment. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N indicates a network-reachable, low-complexity path requiring a low-privileged account, needing no user interaction, with a Scope change (S:C) that the authoritative assessment interprets as disclosure extending beyond Bills of Material into additional integrated Oracle products. The absence of I and A metrics means an attacker cannot use this path to modify or destroy data or to cause denial of service, and no special non-default configuration is required for exploitation.
Know when Bills Of Material gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network HTTP with low-privilege account (PR:L), no user interaction; scope change per description; confidentiality-only impact so I:N/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. While the vulnerability is in Oracle Bills of Material, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Bills of Material accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Executive ViewAI
Oracle E-Business Suite 12.2.3 through 12.2.15 environments are exposed to unauthorized read access of Bills of Material data - including records belonging to other integrated Oracle products - by any authenticated low-privileged user who can reach the Bills of Material Setup Workbench over HTTP. Because the flaw crosses a security scope boundary and no vendor patch is available, the exposure is read-only but persistent, and the affected data can span multiple business systems. Leadership should care because containment currently depends on access controls and network restrictions rather than a fix, and the leaked data may include sensitive product structure and manufacturing information subject to internal and regulatory confidentiality obligations.
No vendor-released patch identified at time of analysis; interim mitigations: restrict HTTP access to the Bills of Material Setup Workbench via network segmentation, firewall rules, or a reverse proxy limited to trusted sources; minimize and audit accounts holding the low-privileged access needed to reach the component; enforce least-privilege roles and remove unnecessary Bills of Material authorizations; enable and monitor audit logging for anomalous cross-organization or bulk Bills of Material queries; and pursue Oracle Support for patch availability and interim guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Bills Of Material
View allAuthenticated attackers holding a low-privileged Oracle E-Business Suite account can fully take over the Bills of Materi
Full system compromise of Oracle Bills of Material - a component of Oracle E-Business Suite - across versions 12.2.3 thr
A low-privileged authenticated attacker with HTTP access to the Oracle Bills of Material module in Oracle E-Business Sui
Oracle E-Business Suite's Bills of Material module (versions 12.2.13 through 12.2.15) contains a difficult-to-exploit fl
Oracle Bills of Material, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations
Data compromise in Oracle Bills of Material (Internal Operations component) of Oracle E-Business Suite versions 12.2.13
Low-privileged Oracle E-Business Suite accounts can read and modify all Bills of Material data by reaching the Internal
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Bill Issues). Rated high se
High-privileged users who can already authenticate to Oracle E-Business Suite can trigger a hard-to-reach flaw in the Bi
Account/component takeover in Oracle Bills of Material (component: Internal Operations) within Oracle E-Business Suite 1
Oracle Bills of Material's Web Services component in E-Business Suite 12.2.3-12.2.15 exposes a medium-severity flaw allo
Exploit-DB