EUVD-2026-106254
GHSA-chwh-p687-2jv9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
DeliveryReach Order Management over HTTP
-
ExploitSend crafted request to Product Diagnostic Tools
-
ExecutionBypass data access controls
-
ImpactExfiltrate critical Order Management data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an attacker to hold a valid low-privileged account on Oracle Order Management within Oracle E-Business Suite (PR:L) and network HTTP access to the Product Diagnostic Tools component; affected supported versions are 12.2.3 through 12.2.15. No user interaction is required (UI:N) and complexity is low (AC:L). The key limiting factor is the authenticated-access prerequisite: an unauthenticated outsider cannot exploit this directly, so exposure scales with how many low-privileged users can reach the Order Management module and whether EBS is internet-facing. |
| Impact | This is a moderate-priority, not top-tier, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity flaw that nonetheless requires an attacker to already hold a low-privileged, authenticated account (PR:L) on the Oracle Order Management module. Impact is confidentiality-only (C:H) with no integrity or availability effect (I:N/A:N), so this is a data-disclosure bug, not a code-execution or takeover bug. No EPSS score, no CISA KEV listing, and no POC were supplied in the input, so there is no public exploit identified at time of analysis - the real-world exploitation signal is currently absent, and the medium severity rests on the authenticated-access precondition. The 'Authentication Bypass' input tag directly contradicts the CVSS vector (PR:L means authentication is required, not bypassed); treat that tag as suspect and verify against Oracle CPU Oct 2026. Net: a real but contained risk for environments exposing EBS Order Management to many low-privileged users, and a lower practical risk where that module is tightly scoped; prioritize patching in the normal Oracle Critical Patch Update cycle rather than as an emergency. |
| Exploit ScenarioDerived | A low-privileged user with a valid Oracle E-Business Suite account (or an attacker who has phished/obtained such credentials) sends crafted HTTP requests to the Product Diagnostic Tools component of Order Management. Because attack complexity is low and no user interaction is needed, the request returns critical Order Management data the user was not authorized to see. No public exploit code is known, so an attacker would need to develop the request logic themselves. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Sensitive-data exposure in Oracle Order Management 12.2.3 through 12.2.15 lets a low-privileged authenticated user read critical or all Order Management-accessible data through the Product Diagnostic Tools component. The CVSS 6.5 rating reflects a network-reachable, low-complexity flaw with high confidentiality impact and no integrity or availability effect, gated by the need for a valid low-privileged EBS account (PR:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and this is assessed as a moderate-priority issue.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor advisory covering this issue; the supplied data does not name a specific patched build, so confirm the CPU-applicable patch level for EBS 12.2.3-12.2.15 during change planning. Until patching is complete, reduce exposure by restricting network and HTTP reachability to the Product Diagnostic Tools component to trusted administrative segments and by reviewing and minimizing the population of low-privileged Order Management accounts that can reach the module-trade-offs are that tighter network controls may disrupt legitimate diagnostic or integration workflows, and reducing accounts can affect business users who rely on the module. Monitor EBS application and database logs for anomalous access to Product Diagnostic Tools endpoints by low-privileged users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is Oracle's integrated ERP application suite; Order Management is its order-capture and fulfillment module, and Product Diagnostic Tools is a supporting component used for troubleshooting and diagnostics. The evaluated vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates that the defect is reachable over HTTP by any holder of a low-privileged Order Management account, with no user interaction and low attack complexity, and that successful abuse yields high confidentiality loss without integrity or availability impact. Although the source tags label this an 'Authentication Bypass', the assessed PR:L vector means the weakness is better characterized as an access-control or missing-authorization problem that lets an authenticated low-privileged user reach data outside their intended scope within the Product Diagnostic Tools component. No CWE was assigned in the supplied data, so the precise root-cause class (for example, improper authorization or exposure of diagnostic data) is not formally confirmed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP vector with low complexity but a required low-privileged account (PR:L); impact is confidentiality-only disclosure of Order Management data, so I:N/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB