Oracle Order Management CVE-2026-91357

Requires a valid low-privileged Oracle E-Business Suite account (PR:L - not unauthenticated) with network HTTP reachability to the Oracle Order Management Transaction Entry component, on affected releases 12.2.3 through 12.2.15. Exploitation is further limited by high attack complexity (AC:H): the Oracle advisory explicitly rates this 'difficult to exploit,' implying specific state, timing, or configuration conditions outside the attacker's control must hold. Impact is confined to confidentiality (reading critical data); no integrity modification or denial of service is possible. The main limiting factors for defenders are the authentication requirement and the difficulty of reliable exploitation, which reduce realistic risk below what the 5.3 score alone might suggest.

This is a moderate-severity, confidentiality-only issue (CVSS 3.1 base 5.3) whose real-world urgency is tempered by its own vector. AC:H means Oracle itself rates exploitation as 'difficult to exploit' - attack conditions exist that are beyond the attacker's control - and PR:L requires an already-authenticated low-privileged Oracle E-Business Suite account, which together substantially raise the bar versus an unauthenticated internet-facing flaw. Impact is limited to C:H (unauthorized read access to critical Order Management data) with no integrity or availability impact. No EPSS score was supplied in the input, so exploitation probability cannot be quantified; there is no CISA KEV listing and no public PoC, so there is no public exploit identified at time of analysis. Net: this is a real but second-tier priority - patch in the normal Oracle CPU cycle rather than as an emergency, prioritizing internet-exposed EBS instances where low-privileged accounts are broadly provisioned. Note a conflicting signal: the 'Authentication Bypass' tag contradicts the CVSS vector (PR:L requires valid authentication), so the tag appears mislabeled and should not drive triage.

A low-privileged user with a valid Oracle E-Business Suite account sends crafted HTTP requests to the Order Management Transaction Entry component and, under specific conditions that make exploitation difficult, obtains read access to critical order and customer data they should not be able to see. No public exploit code is known, and the high attack complexity means reliable exploitation likely requires specific timing, state, or configuration beyond the attacker's direct control.