Oracle Process Manufacturing EUVD-2026-37256

Requires network reachability to the Oracle E-Business Suite HTTP tier hosting the Oracle Process Manufacturing Process Planning module (Internal Operations component) on versions 12.2.3 through 12.2.15, plus a valid low-privileged EBS account (CVSS PR:L) - no specific OPM responsibility or administrative role is indicated as required, and no user interaction is needed (UI:N). Limiting factors: the target EBS instance must actually have the Oracle Process Manufacturing Process Planning module licensed and deployed (it is not present in every EBS install), the attacker must possess or obtain credentials for any authenticated EBS session, and the Internal Operations HTTP endpoints must be reachable from the attacker's network position; deployments that front EBS with the Oracle URL firewall, VPN-only access, or strict responsibility-based menu restrictions raise the practical bar.

All available signals point to a genuinely high-priority issue rather than a paper tiger: the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network reach, no user interaction, only low-privilege authentication, and complete compromise of the module, which Oracle itself summarises as 'easily exploitable' and resulting in 'takeover'. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quantified, and the vulnerability is not currently listed in CISA KEV. No POC has surfaced in the references supplied (only the Oracle CPU advisory is cited), so risk today is driven by intrinsic exploitability rather than observed in-the-wild activity. The main caveat is that EBS instances are frequently internet-exposed or reachable from broad internal user populations, and the PR:L threshold is trivially met by any authenticated EBS user, so defenders should treat the patch as urgent even absent KEV listing.

An attacker who has obtained any low-privileged EBS account, for example through a phished plant operator or a contractor login, sends a crafted HTTP request to the OPM Process Planning Internal Operations endpoint and gains full takeover of the module, enabling tampering with production plans and exfiltration of manufacturing data. Because the vector is AV:N/AC:L/UI:N, the request can be issued directly from any host that can reach the EBS web tier, with no social engineering or chained bug required. No public exploit identified at time of analysis, but the simplicity of the precondition makes weaponisation straightforward once patch diffs are studied.