EUVD-2026-37283Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege EBS account
-
DeliveryReach EBS application tier over HTTP
-
ExploitSend crafted request to Outsourced Mfg module
-
ExecutionBypass authorization in Internal Operations component
-
PersistExecute privileged module actions
-
ImpactTake over Outsourced Mfg for Discrete Industries data and functions
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have a low-privileged authenticated session on Oracle E-Business Suite (PR:L) with network/HTTP reachability to the EBS application tier hosting the Outsourced Mfg for Discrete Industries module, and the target instance must be a supported EBS 12.2 release in the 12.2.3-12.2.15 range running that specific Internal Operations / Outsourced Manufacturing module. Limiting factors are that fully unauthenticated exploitation is not indicated by the CVSS vector, the scope is unchanged (S:U) so impact is confined to the affected module rather than the whole EBS instance, and deployments that do not license or enable Outsourced Mfg for Discrete Industries, or that hide the EBS app tier behind VPN/URL firewall, materially reduce exposure. |
| Impact | The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a network-reachable, low-complexity, low-privilege exploit with full CIA impact on the affected module, which is a genuinely high-severity profile for an internet- or intranet-exposed ERP. However, EPSS, KEV status, SSVC decision, and POC availability were not provided in the input, so real-world exploitation likelihood cannot be quantified at this time. Given Oracle EBS is a frequent target for ransomware and data-theft operators and has historically appeared in CISA KEV via other CVEs, this should be prioritized in the next patch cycle even though no public exploit identified at time of analysis; the main uncertainty is whether a 'low-privileged' EBS user account is easy to obtain in a given deployment, which materially changes the practical risk. |
| Exploit ScenarioDerived | An attacker who has obtained or been granted any low-privilege EBS application account - for example a contractor, supplier-portal user, or compromised internal employee - sends a crafted HTTP request to the Outsourced Mfg for Discrete Industries pages on the EBS application tier and abuses the flaw to perform actions outside their authorization, resulting in full takeover of the module's data and functions. No user interaction is required and attack complexity is low, but no public exploit identified at time of analysis, so realistic near-term exploitation would more likely come from a skilled insider or targeted intruder rather than mass scanning. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Account takeover in Oracle Outsourced Mfg for Discrete Industries (component: Internal Operations) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged remote attacker to fully compromise the module over HTTP. With CVSS 3.1 base score 8.8 and high impact on confidentiality, integrity, and availability, this is a high-priority patching item, though no public exploit identified at time of analysis and it is not currently listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: apply the fixes shipped in the Oracle Critical Patch Update June 2026 (CPUJUN2026) for Oracle E-Business Suite 12.2.3-12.2.15 as documented at https://www.oracle.com/security-alerts/cspujun2026.html; exact patch numbers and prerequisite bundle patches should be taken from the Oracle CPU advisory and My Oracle Support notes referenced therein. Until the CPU is applied, restrict network reachability of the EBS application tier so that the Outsourced Mfg for Discrete Industries pages are only accessible from trusted internal networks or via VPN, tighten EBS responsibility/menu assignments so that ordinary functional users do not have access to Internal Operations or Outsourced Manufacturing responsibilities, and enable URL firewall / DMZ allowlisting in EBS to drop unexpected module URLs at the web tier (note this can break legitimate integrations and self-service flows, so test in a clone first). Increase monitoring on FND_LOGINS, FND_UNSUCCESSFUL_LOGINS, and Apache access logs for anomalous requests to OutsourcedMfg / Internal Operations endpoints in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is a large integrated ERP/CRM/SCM platform; the Outsourced Mfg for Discrete Industries module supports contract manufacturing workflows within the Internal Operations component. The affected stack is the EBS 12.2 application tier, which runs on Oracle Application Server / WebLogic with Java/PL-SQL business logic exposed via HTTP servlets and OA Framework pages. No CWE was assigned by Oracle in the advisory, so the precise root cause class (e.g., improper authorization, deserialization, or SQL injection) is not disclosed, but the CVSS vector and 'takeover of the module' impact language are consistent with an authorization or input-handling flaw reachable through an authenticated HTTP request to the module.
Know when Oracle Outsourced Mfg For Discrete Industries gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Oracle states HTTP-reachable, easily exploitable by a low-privileged attacker with no user interaction, resulting in full module takeover, so AV:N/AC:L/PR:L/UI:N and C:H/I:H/A:H within unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outsourced Mfg for Discrete Industries. Successful attacks of this vulnerability can result in takeover of Oracle Outsourced Mfg for Discrete Industries. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Outsourced Manufacturing for Discrete Industries in E-Business Suite versions 12.2.3-12.2.15 contains a high-severity account takeover vulnerability allowing authenticated attackers with low privileges to fully compromise the module and access sensitive manufacturing operations data. Organizations operating this component face disruption of production systems, loss of supply chain visibility, and potential data breaches requiring immediate containment measures.
No vendor-released patch identified at time of analysis. Implement: (1) Network segmentation restricting HTTP access to the Outsourced Manufacturing component to internal/VPN networks only; (2) reduce low-privilege user accounts with module access to minimum necessary personnel; (3) enforce multi-factor authentication for all E-Business Suite users in affected environments; (4) deploy continuous monitoring and alerting on account activity, privilege escalation attempts, and data access within the module.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB