EUVD-2026-79812
GHSA-w4xr-9jr4-4wfx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
ExploitReach Order Management Product Diagnostic Tools over HTTP
-
ExecutionSend crafted request exploiting the flaw
-
ImpactRead and modify critical Order Management data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged account on the target Oracle E-Business Suite instance (PR:L) with network HTTP access to the Order Management product's Product Diagnostic Tools component; affected versions are 12.2.4 through 12.2.15. No user interaction and no elevated privileges are needed, and attack complexity is low, so any authenticated foothold suffices. The primary limiting factors are the authentication requirement (not remotely exploitable pre-auth) and that only deployments running Order Management within EBS 12.2.4-12.2.15 are exposed; there is no availability/DoS impact. |
| Impact | This is a genuine but authenticated-access-gated priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) shows a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, yielding high confidentiality and integrity impact but no availability impact - hence the 8.1 (High, not Critical) score. The absence of A:N and the PR:L requirement are what keep it below the 9.8 pre-auth E-Business Suite issues in the same Oracle September 2026 CPU. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no signal of active or imminent mass exploitation; this is a patch-on-cycle item rather than an emergency. Note a data conflict: the input Tags include 'Authentication Bypass,' but the CVSS vector is PR:L (an authenticated low-privileged attacker), so this is NOT an authentication bypass - the tag is mislabeled. Oracle's advisory provides no technical detail, so exploitation mechanics are unconfirmed beyond the vector and description. |
| Exploit ScenarioDerived | A low-privileged authenticated user of an Oracle E-Business Suite deployment (or an attacker who has obtained any valid low-level EBS account, e.g. via phishing) sends crafted HTTP requests to the Order Management Product Diagnostic Tools component. Because attack complexity is low and no user interaction is needed, the attacker can then read, create, delete, or modify all Order Management-accessible data. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authenticated low-privileged users with network HTTP access can fully compromise Order Management data in Oracle E-Business Suite 12.2.4 through 12.2.15, gaining unauthorized read, creation, deletion, and modification of any Order Management data reachable through the Product Diagnostic Tools component. Rated CVSS 3.1 base 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the issue needs only a valid low-privileged account, no user interaction, and no elevated privileges, so any authenticated foothold on the instance is enough; there is no availability impact and no scope change. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though no EPSS score was provided in the source data.
RemediationAI
Apply the Oracle fix distributed through the Oracle Security Alert at https://www.oracle.com/security-alerts/cspusep2026.html (Oracle Critical Patch Update / security alert for E-Business Suite); patch availability is confirmed per the vendor advisory, but no explicit fix version was provided in the source data, so consult the advisory for the exact 12.2.x patch level and apply it to both the application tier and the database tier as directed. Because the flaw requires only a low-privileged authenticated account (PR:L), the highest-value compensating controls are to restrict which accounts have access to the Order Management module and its Product Diagnostic Tools component, removing that component's responsibilities from routine business roles and reserving them for a small administrative group, and to prevent untrusted networks from reaching the Order Management HTTP endpoints at the web tier - the trade-off being that legitimate diagnostic use and any integrations calling those paths will need to be re-permissioned or proxied. Also enforce strong credential hygiene and session controls on low-privileged accounts, since any such account is a viable exploit foothold, and enable database and application auditing on Order Management data changes to detect unauthorized create/delete/modify activity; auditing adds log volume and storage overhead but is the main detective control given there is no availability impact to alert on. No vendor patch-free workaround is documented in the supplied sources, so mitigation should be treated as temporary until the security alert patch is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is Oracle's enterprise resource planning platform, and Order Management is the order-capture, pricing, and fulfillment module within it; the affected surface here is the module's Product Diagnostic Tools component, which is reached over HTTP from the application tier. The vulnerability is described by the reporter as an 'Authentication Bypass' alongside an Oracle tag, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates an authorization/access-control weakness in that component that lets a merely low-privileged authenticated session act with privileges it should not have, rather than a memory-safety or injection defect. No CWE identifier was supplied with the CVE data; the characteristics are consistent with the improper-access-control / incorrect-authorization class (CWE-284/CWE-863), but that assignment is inferential and should be treated as such. Because Scope is Unchanged and Availability is None, the compromise stays within the Order Management security authority and is a confidentiality and integrity problem - read and write access to business-critical order data - not a denial-of-service or host-takeover primitive. Exploitation is gated only by the PR:L authentication prerequisite and by the deployment running the affected release within the 12.2.4-12.2.15 window.
Know when Order Management Enterprise Command Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network HTTP with low complexity and no UI; PR:L because a low-privileged account is required; full C/I compromise of module data but no availability impact, scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.4-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Order Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle E-Business Suite versions 12.2.4 through 12.2.15 contain a high-severity flaw that allows any authenticated user with ordinary network access to read, create, modify, or delete Order Management data reachable through the Product Diagnostic Tools component, placing order, pricing, and fulfillment records at risk of unauthorized manipulation. Because only a valid low-privileged account is required and no patch is currently available, every user, service account, contractor, or partner credential on an affected instance represents a potential path to ERP data corruption. Leadership should treat this as a data-integrity and potential fraud exposure affecting finance, supply chain, and customer commitments rather than a narrowly technical issue.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the Product Diagnostic Tools component to trusted administrative hosts only; minimize and rotate low-privileged accounts with access to affected instances and enforce least privilege; enable and monitor authentication and Order Management audit logging for unauthorized read, creation, deletion, or modification activity; apply database and application change-detection alerting on Order Management tables; and engage Oracle Support for any available one-off fix or backport while tracking the next Critical Patch Update.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB