EUVD-2026-37251Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
HTTP-reachable EBS module needing a valid low-privilege account (PR:L) and non-trivial conditions (AC:H); successful exploitation takes over CMRO so C:H/I:H/A:H within unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair and Overhaul. Successful attacks of this vulnerability can result in takeover of Oracle Complex Maintenance, Repair and Overhaul. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of Oracle Complex Maintenance, Repair and Overhaul (CMRO) versions 12.2.3 through 12.2.15 is possible by an authenticated low-privileged attacker over HTTP against the Internal Operations component. Successful exploitation yields high impact to confidentiality, integrity, and availability of the CMRO module, though Oracle rates the attack complexity as high. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Oracle Complex Maintenance, Repair and Overhaul is a module of Oracle E-Business Suite (EBS) used by asset-intensive industries (aerospace, defense, transportation) to manage maintenance workflows for complex assets. The flaw resides in the Internal Operations component, which handles back-end business logic exposed through the EBS HTTP-based application tier (Oracle HTTP Server/WebLogic fronting Forms and OA Framework servlets). No CWE was assigned by Oracle in the advisory, but the combination of HTTP vector, low-privilege requirement, and full C/I/A impact within an unchanged scope is consistent with an authenticated authorization-bypass or input-handling weakness inside the CMRO module rather than a pre-auth RCE. CPE data identifies the affected product as oracle_complex_maintenance,_repair_and_overhaul across all listed versions of EBS 12.2.
RemediationAI
Apply the fixes bundled in Oracle's June 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cspujun2026.html; an exact patched build number is not stated in the provided data, so administrators should consult the CPU matrix for their EBS 12.2.x level and apply the corresponding CMRO patch through AutoPatch/adop. Until the CPU is deployed, compensating controls include restricting HTTP access to the CMRO responsibilities and the Internal Operations URLs to a smaller set of trusted internal networks via the EBS URL firewall (mod_security/AllowedResources rules) and the Oracle Application Server reverse proxy, removing the CMRO responsibility from non-essential users to reduce the PR:L attacker pool, and increasing auditing of CMRO transactions in FND_LOG_MESSAGES - these controls may break legitimate maintenance workflows for users whose access is revoked and add audit storage overhead. Do not expose the EBS application tier directly to the internet during the mitigation window.
Takeover of Oracle Complex Maintenance, Repair and Overhaul (cMRO) versions 12.2.3 through 12.2.15 is achievable by a lo
Takeover of Oracle Complex Maintenance, Repair and Overhaul (CMRO) in Oracle E-Business Suite versions 12.2.3 through 12
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today