EUVD-2026-37250Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
HTTP-reachable EBS module needing a valid low-privileged account (PR:L) and non-trivial preconditions (AC:H); full takeover of CMRO yields C:H/I:H/A:H within the same security scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair and Overhaul. Successful attacks of this vulnerability can result in takeover of Oracle Complex Maintenance, Repair and Overhaul. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Takeover of Oracle Complex Maintenance, Repair and Overhaul (CMRO) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker with HTTP network access to fully compromise the Internal Operations component. Oracle's June 2026 Critical Patch Update advisory documents the issue with a CVSS 3.1 base score of 7.5 and high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the vulnerability is rated difficult to exploit due to high attack complexity.
Technical ContextAI
The flaw resides in the Internal Operations component of Oracle Complex Maintenance, Repair and Overhaul, an E-Business Suite module used by asset-intensive industries (aviation, defense, utilities) to manage maintenance workflows for complex equipment. Per the CPE string cpe:2.3:a:oracle_corporation:oracle_complex_maintenance,_repair_and_overhaul, the affected product is the CMRO application running atop the Oracle E-Business Suite 12.2 middle tier (OC4J/WebLogic plus Forms/OAF). Although no CWE is supplied, the AV:N/PR:L vector combined with full CIA impact and 'takeover' outcome is consistent with an authenticated web-tier flaw such as authorization bypass, injection, or insecure deserialization reachable through the EBS HTTP front-end after login.
RemediationAI
Apply the fixes from Patch available per vendor advisory: Oracle Critical Patch Update Advisory of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html), which covers CMRO on EBS 12.2.3-12.2.15; Oracle typically ships these as EBS 12.2 consolidated patches via My Oracle Support, so apply the relevant CMRO/Internal Operations patch and any prerequisite AD/TXK updates in a test environment first. Until the CPU is rolled out, reduce exposure by restricting HTTP access to the CMRO responsibilities and Internal Operations URLs to trusted internal networks via the EBS URL firewall (mod_rewrite / DMZ allowlist) and tightening responsibility/menu assignments so only required users hold CMRO privileges (trade-off: temporarily disrupts legitimate maintenance workflows for excluded users). Increase logging on the Apache/OAF tier and review oacore access logs for anomalous parameter or POST activity targeting CMRO functions; do not rely on WAF signatures alone, as no CWE or POC is available to build precise rules.
Takeover of Oracle Complex Maintenance, Repair and Overhaul (cMRO) versions 12.2.3 through 12.2.15 is achievable by a lo
Full takeover of Oracle Complex Maintenance, Repair and Overhaul (CMRO) versions 12.2.3 through 12.2.15 is possible by a
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today