EUVD-2026-106280
GHSA-c2wf-fw8v-wqxh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
ExploitReach Order Management over HTTP
-
ExecutionAbuse Product Diagnostic Tools component
-
ImpactRead unauthorized critical data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged Oracle E-Business Suite account (PR:L) with HTTP network access to the Oracle Order Management application, specifically its Product Diagnostic Tools component; only affected EBS versions 12.2.3 through 12.2.15 are vulnerable. No user interaction is needed and attack complexity is low. The primary limiting factors are the authentication requirement (unauthenticated external attackers cannot exploit it directly) and the confidentiality-only scope - there is no integrity or availability impact, so the flaw enables data disclosure rather than modification or disruption. |
| Impact | This is a moderate-severity, confidentiality-only information-disclosure flaw in the Product Diagnostic Tools component of Oracle Order Management (Oracle E-Business Suite 12.2.3-12.2.15). The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates network-reachable, low-complexity exploitation requiring only low privileges (an authenticated but minimally-privileged account), no user interaction, yielding high confidentiality impact with no integrity or availability effect. No EPSS score was provided in the input, the CVE is NOT on CISA KEV, and no public exploit is referenced, so there is no evidence of active exploitation or weaponization - this reads as a priority-to-patch issue for EBS operators rather than an emergency. Two signals conflict and must be flagged: the 'Authentication Bypass' tag contradicts the CVSS PR:L requirement and the description's 'low privileged attacker' language - this vulnerability requires valid (if low) credentials, so the tag appears mislabeled; verify with Oracle CPU October 2026. Overall real-world risk is tempered by the authentication requirement and the confidentiality-only impact, but EBS's large enterprise footprint and the network/low-complexity profile justify timely remediation. |
| Exploit ScenarioDerived | An attacker holding a low-privileged, authenticated Oracle E-Business Suite account sends crafted HTTP requests to the Product Diagnostic Tools functionality of Oracle Order Management. Because attack complexity is low and no user interaction is needed, the attacker reads critical Order Management data (or all data accessible to that module) beyond their authorization level. No public proof-of-concept or active exploitation is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Authenticated information disclosure in the Product Diagnostic Tools component of Oracle Order Management (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged user reach data they should not see over plain HTTP, with no user interaction and low attack complexity. Because the CVSS vector carries PR:L with C:H and no integrity or availability impact, the practical outcome is read-only exposure of critical application data rather than tampering or denial of service - the authentication requirement is the main barrier an outside attacker must clear. Oracle addressed the flaw in its October 2026 Critical Patch Update; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
Patch status: patch available per vendor advisory - Oracle published the fix in its October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the authoritative source for the exact patch revision applicable to your 12.2.3-12.2.15 EBS installation; apply that CPU level rather than relying on an inferred version number. Until the CPU is applied, reduce exposure with compensating controls matched to the PR:L requirement: audit which EBS users hold responsibilities that can reach the Order Management Product Diagnostic Tools and strip that access from anyone who does not need it, since removing the diagnostic responsibility removes the attack path entirely (trade-off: support staff lose troubleshooting capability and must be granted it temporarily under change control). Restrict network access to the EBS application tier - front it with a reverse proxy or WAF that only exposes the self-service and forms endpoints in genuine use, and block direct client access to diagnostic servlet paths from untrusted networks (trade-off: legitimate remote support work needs a VPN or bastion exception). Enable and monitor application-tier audit logging and database audit for unusual read patterns against Order Management tables by low-privileged accounts, treating anomalous bulk reads as the detection signal, since the flaw produces no write activity to alert on. Note that these measures only narrow exposure; they do not remediate the underlying authorization weakness, so completing the CPU application remains required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the Product Diagnostic Tools module that ships within Oracle E-Business Suite's Order Management application stack, an Oracle Forms/HTML-based enterprise order-capture and fulfillment suite typically fronted by an HTTP(S) listener and an application-tier middle tier. Product Diagnostic Tools are the troubleshooting and inspection utilities intended for support and administrative workflows; when such utilities do not properly enforce the caller's privileges or object-level access rules, an authenticated session holding only minimal responsibilities can query them and pull back records belonging to other users, operating units, or business functions. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N describes exactly that shape: network reachable over HTTP, no special conditions or race required (AC:L), no victim interaction (UI:N), unchanged scope (S:U), and a high confidentiality impact only. No CWE identifier was assigned in the available data, but the behavior class is an authorization/access-control weakness (missing or insufficient privilege checks on a diagnostic endpoint) rather than memory corruption or injection. The tags labeling this as an 'Authentication Bypass' should be read carefully: the assessed vector requires a valid low-privileged EBS account, so the weakness is best characterized as privilege/authorization bypass on the diagnostic functionality - escalation of read access within an authenticated session - not a route to unauthenticated entry.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP vector with low complexity; a low-privileged authenticated account is required (PR:L), and impact is confidentiality-only (C:H, I:N, A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB