EUVD-2026-37264Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege EBS credentials
-
DeliveryReach EBS web tier over HTTP
-
ExploitSend crafted request to Quality Internal Operations endpoint
-
ExecutionExploit server-side flaw
-
PersistEscalate within Oracle Quality module
-
ImpactRead/modify/destroy Quality data
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must reach the Oracle E-Business Suite web tier over HTTP/HTTPS and hold valid credentials for any low-privilege EBS account (PR:L), with no user interaction required and no scope change. The affected deployment must be running Oracle EBS 12.2.3 through 12.2.15 with the Oracle Quality module licensed and enabled and its Internal Operations functionality reachable by the attacker's responsibility set; deployments that have either disabled the Quality module or restricted the EBS web tier to a small administrator population materially limit the exploit surface, and earlier or later EBS major releases are not listed as affected. |
| Impact | The CVSS vector AV:N/AC:L/PR:L/UI:N with full C/I/A high and unchanged scope makes this a credible priority for any internet-facing or broadly accessible EBS deployment: any authenticated EBS user - including low-privilege internal accounts often issued to many employees, suppliers, or contractors via iSupplier/iStore portals - can take over the Quality component without user interaction. No EPSS score, KEV listing, or POC was supplied, so real-world exploitation pressure is currently unmeasured; absence of these signals is not reassurance, since Oracle CPU vulnerabilities historically attract exploit development within weeks of disclosure. The chief uncertainty is the exact meaning of 'takeover of Oracle Quality' - Oracle's wording typically implies full module compromise but does not by itself prove lateral movement to the broader EBS schema or OS, so defenders should treat horizontal reach as plausible but unconfirmed. |
| Exploit ScenarioDerived | A contractor or internal employee with any low-privilege EBS responsibility authenticates to the Oracle E-Business Suite web tier and issues crafted HTTP requests to the Oracle Quality module's Internal Operations endpoints, abusing the flaw to escalate within the Quality application and read, modify, or destroy quality-management data such as inspection records, supplier non-conformance reports, and collection plans. With Oracle stating exploitation is 'easy' and requires only PR:L, the scenario is realistic against any organization that issues broad authenticated EBS access; no public POC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Account takeover in the Oracle Quality module of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the Quality component, impacting confidentiality, integrity, and availability (CVSS 3.1 8.8). The flaw resides in the Internal Operations component and is rated easily exploitable by Oracle's own advisory, though no public exploit identified at time of analysis and the issue is not yet listed in CISA KEV.
RemediationAI
Apply the fixes shipped in Oracle's June 2026 Critical Patch Update (Patch available per vendor advisory at https://www.oracle.com/security-alerts/cspujun2026.html); Oracle does not publish individual fix-version numbers per CVE, so administrators must apply the CPU bundle that covers EBS 12.2.3-12.2.15. Until the CPU is applied, restrict network reach to the EBS web tier by placing it behind a VPN or reverse proxy with IP allow-listing, audit and disable unused low-privilege EBS responsibilities that grant access to the Quality module, and increase monitoring of Oracle HTTP Server access logs for anomalous requests to /OA_HTML/ Quality endpoints; the trade-off is that VPN/allow-list controls do not stop authenticated insider abuse, which is the very threat model this CVE describes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Quality is a manufacturing-quality management module within Oracle E-Business Suite (EBS) 12.2, the long-running ERP platform built on Oracle Application Server / WebLogic and the Oracle Database. The CPE 'cpe:2.3:a:oracle_corporation:oracle_quality' confirms the Quality application itself is the vulnerable surface, exposed over HTTP through the EBS web tier (typically the Oracle HTTP Server forms/OAF stack). No CWE is published by Oracle, which is consistent with their standard practice of withholding root-cause detail; the 'Internal Operations' component label combined with the network/HTTP attack vector points to a server-side flaw reachable through an authenticated EBS session rather than a client-side or forms-applet weakness.
Know when Oracle Quality gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Reachable over HTTP with any low-privilege EBS account and no user interaction; Oracle states full takeover of the Quality module, giving high C/I/A within an unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality. Successful attacks of this vulnerability can result in takeover of Oracle Quality. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite Quality module (versions 12.2.3-12.2.15) contains an account takeover vulnerability allowing low-privileged attackers to fully compromise the Quality component. Organizations using affected EBS versions face risk of unauthorized data access, manipulation of quality records, and potential operational disruption in supply chain and manufacturing processes.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Quality module network access via IP whitelisting and network segmentation; deploy Web Application Firewall protecting the Internal Operations component; enforce multi-factor authentication for all module users; apply least-privilege access restrictions by removing module access for non-essential users; enable real-time monitoring and alerting for unauthorized account activity and privilege escalation attempts; conduct monthly access reviews; maintain current backups for recovery capability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB