EUVD-2026-37234Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Network HTTP attack surface (AV:N), needs authenticated low-priv EBS account (PR:L), Oracle states difficult to exploit (AC:H), scope change to other EBS products (S:C), full takeover (C/I/A:H).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Production). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair and Overhaul. While the vulnerability is in Oracle Complex Maintenance, Repair and Overhaul, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Complex Maintenance, Repair and Overhaul. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Takeover of Oracle Complex Maintenance, Repair and Overhaul (cMRO) versions 12.2.3 through 12.2.15 is achievable by a low-privileged attacker over HTTP, with the scope changing to impact additional Oracle E-Business Suite products beyond cMRO itself. The high CVSS 3.1 score of 8.5 reflects full confidentiality, integrity, and availability impact, though high attack complexity tempers exploitability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Oracle Complex Maintenance, Repair and Overhaul is a Production-component module of the Oracle E-Business Suite (EBS) 12.2.x application stack, typically deployed on Oracle Application Server / WebLogic with an Oracle Database back end and used by aviation, defense, and heavy-equipment operators to manage maintenance workflows. The CPE (cpe:2.3:a:oracle_corporation:oracle_complex_maintenance,_repair_and_overhaul) confirms the affected component, and the Scope:Changed flag in the CVSS vector indicates the vulnerable cMRO code can reach and impact other authorization domains within the broader EBS deployment (such as shared schemas, integrated modules, or the underlying application tier). No CWE was assigned by Oracle, which is consistent with Oracle's general practice of withholding root-cause class details in Critical Patch Update advisories.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html; patch available per vendor advisory, but a single tagged fix version is not independently confirmed in the input data - administrators should consult the CPU patch matrix to identify the cMRO bundle patch that corresponds to their 12.2.x baseline and apply it through adop/AutoConfig. Until the CPU is applied, restrict network reachability to the cMRO HTTP endpoints by allowlisting only trusted internal hosts at the load balancer or reverse proxy, tighten cMRO functional responsibility assignments so the smallest possible user population holds the low-privilege role required for exploitation, and increase auditing on cMRO-related URLs and JSP/OAF entry points via Oracle EBS audit policies. The trade-off of network restrictions is potential disruption to integrations with shop-floor and supply-chain systems, while role tightening can disrupt legitimate maintenance operations and should be validated against business workflows before enforcement.
Full takeover of Oracle Complex Maintenance, Repair and Overhaul (CMRO) versions 12.2.3 through 12.2.15 is possible by a
Takeover of Oracle Complex Maintenance, Repair and Overhaul (CMRO) in Oracle E-Business Suite versions 12.2.3 through 12
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today