What is the CVSS score of EUVD-2026-37256?

EUVD-2026-37256 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Process Manufacturing are affected by EUVD-2026-37256?

Oracle Process Manufacturing versions 12.2.3-12.2.15 in E-Business Suite contain a critical vulnerability (CVSS 8.8) allowing remote low-privileged attackers to achieve complete system takeover,…

How to fix or mitigate EUVD-2026-37256?

Within 24 hours: Identify and inventory all Oracle E-Business Suite instances running Process Manufacturing versions 12.2.3 through 12.2.15. Within 7 days: Implement network-level access controls restricting HTTP access to the Internal Operations component; deploy web application firewall rules to monitor and block exploitation attempts. Within 30 days: Monitor Oracle Security Advisories for patch release and establish upgrade timeline; escalate to change management for priority scheduling once patch becomes available.

Oracle Process Manufacturing EUVD-2026-37256

| CVE-2026-46942 HIGH

Improper Privilege Management (CWE-269)

2026-06-16 oracle

Privilege Escalation Oracle Oracle Process Manufacturing Process Planning Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

HTTP-reachable EBS module exploitable by any low-privileged user without interaction, yielding full module takeover, so AV:N/AC:L/PR:L/UI:N with C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:00 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Process Planning product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Process Planning. Successful attacks of this vulnerability can result in takeover of Oracle Process Manufacturing Process Planning. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Process Manufacturing Process Planning (versions 12.2.3 through 12.2.15) is achievable by a low-privileged remote attacker over HTTP through the Internal Operations component of Oracle E-Business Suite. The flaw carries a CVSS 3.1 base score of 8.8 with full confidentiality, integrity, and availability impact, and Oracle has classified it as easily exploitable. There is no public exploit identified at time of analysis, but the low complexity and minimal authentication threshold make it a high-priority patching target for any EBS deployment.

Technical ContextAI

Oracle Process Manufacturing (OPM) Process Planning is a module within the Oracle E-Business Suite (EBS) 12.2 line, specifically inside the Internal Operations subcomponent, which orchestrates production planning, batch records, and inventory transactions for process-industry manufacturers. The CPE 'cpe:2.3:a:oracle_corporation:oracle_process_manufacturing_process_planning' confirms the issue is scoped to the OPM Process Planning application layer running on top of the EBS 12.2 stack (typically Oracle Forms/OAF on WebLogic with an Oracle Database backend). No CWE was assigned in the input, but the combination of HTTP attack vector, low-privilege precondition, and full CIA impact is consistent with the access-control or injection-class flaws (e.g., authorization bypass or unsafe deserialization/SQL flow) that Oracle has historically disclosed in EBS Critical Patch Updates affecting OPM modules.

RemediationAI

Apply the patch available per vendor advisory in the Oracle Critical Security Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html), which covers OPM Process Planning 12.2.3-12.2.15; Oracle does not publish per-CVE point versions, so apply the CPU bundle aligned to your EBS 12.2 baseline. Until the CPU can be deployed, restrict HTTP access to the OPM Process Planning URLs and Internal Operations endpoints to trusted networks via reverse proxy, WAF, or Oracle E-Business Suite URL firewall rules, and audit and tighten responsibilities so that the population of users with any OPM access (PR:L) is minimised; note this can disrupt legitimate manufacturing planning workflows and should be coordinated with operations. Enable and monitor FND audit trails plus database fine-grained auditing on OPM schemas to detect anomalous activity during the exposure window.