EUVD-2026-47486
GHSA-qjrr-88gg-wvhm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged EBS account
-
DeliveryReach BOM Internal Operations over HTTP
-
ExploitSend crafted request bypassing authorization
-
ExecutionRead or modify all BOM-accessible data
-
ImpactExfiltrate or tamper with product data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have a low-privileged authenticated account on the Oracle E-Business Suite instance (CVSS PR:L) with network HTTP access to the Bills of Material Internal Operations component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). It is limited to EBS 12.2.13-12.2.15 running the BOM module, so instances without BOM deployed or on unaffected version trains are not exposed. The vendor's 'Authentication Bypass' tag conflicts with the PR:L scoring; if the flaw genuinely bypasses authentication the low-privilege prerequisite may be weaker than scored - verify with the Oracle CPU advisory. Availability is unaffected (A:N), so this is a data confidentiality/integrity issue, not a service-disruption vector. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) indicates a genuinely high-priority, network-reachable, low-complexity flaw needing only a low-privileged account and no user interaction, yielding full read and write access to BOM data. No EPSS score, SSVC decision, KEV listing, or POC was provided, so probabilistic exploitation signals are absent - meaning severity here rests on the CVSS impact metrics rather than confirmed exploitation activity. One notable tension: the vendor tag labels this an 'Authentication Bypass,' which normally implies PR:N, yet Oracle scored it PR:L (requires some authentication); this discrepancy should be verified against the Oracle advisory, as the true auth prerequisite materially affects prioritization. Oracle EBS is a high-value target historically subject to opportunistic exploitation, so despite the missing EPSS/KEV data, treat this as a real priority for organizations running affected versions. |
| Exploit ScenarioDerived | An attacker who obtains or is granted a low-privileged Oracle EBS application account sends crafted HTTP requests to the Bills of Material Internal Operations component and, exploiting the access-control weakness, reads and alters BOM data outside their authorized scope. This could let them exfiltrate sensitive manufacturing/product structure data or tamper with bills of material to sabotage production planning. No public POC was identified at time of analysis, but the low attack complexity means a working request could be developed once details are known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Data compromise in Oracle Bills of Material (Internal Operations component) of Oracle E-Business Suite versions 12.2.13 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the Bills of Material module via HTTP. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, the flaw is easily exploitable and requires only low privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag references an 'Authentication Bypass' class though the CVSS vector requires PR:L.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update, which is the primary and only vendor-sanctioned remediation; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact EBS 12.2.x patch numbers corresponding to your version (no discrete fix version string was provided in the input beyond the CPU reference, so obtain the specific patch from the advisory). Because the CPU is cumulative, ensure the latest 12.2 patch level is installed. As compensating controls until patching, restrict network access to the EBS HTTP endpoints and the Bills of Material/Internal Operations pages to trusted internal networks or VPN only, tighten application-level role and responsibility assignments to minimize which low-privileged users can reach BOM functions, and increase monitoring/auditing of BOM data create/delete/modify operations to detect anomalous access - noting that access restrictions may disrupt legitimate remote or integration users and should be validated against business workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Bills of Material (BOM) is a manufacturing/ERP module within Oracle E-Business Suite (EBS) 12.2, a large Java/PL-SQL enterprise application stack fronted by Oracle Application Server / WebLogic and accessed over HTTP. The affected 'Internal Operations' component handles internal BOM data operations. No CWE was assigned by Oracle, but the 'Authentication Bypass' tag combined with high confidentiality and integrity impact suggests a broken access control or authorization flaw allowing a low-privileged authenticated user to reach data and operations beyond their intended scope. Oracle groups this under its quarterly Critical Patch Update (CPU) process; the affected supported versions are the EBS 12.2.13-12.2.15 release train.
Know when Bills Of Material gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network HTTP reachable (AV:N) with low complexity and a low-privileged account (PR:L) yielding full read/write to BOM data (C:H/I:H) but no availability impact (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.13-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Bills of Material accessible data as well as unauthorized access to critical data or complete access to all Oracle Bills of Material accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle E-Business Suite versions 12.2.13-12.2.15 contain an authorization flaw in the Bills of Material Internal Operations component that permits authenticated low-privilege users to read, create, delete, and modify all BOM data via HTTP. This vulnerability directly threatens operational data integrity and compliance for organizations using affected versions, as any minimally-privileged user can compromise critical manufacturing and supply chain records. No vendor-released patch identified at time of analysis, requiring immediate compensating controls to protect this sensitive operational module.
Restrict network access to the BOM module via firewall rules limiting connections to trusted administrative networks; implement Web Application Firewall policies to prevent unauthorized BOM data operations; enable detailed audit logging and real-time alerting for all BOM data access, creation, modification, or deletion events; enforce multi-factor authentication for all BOM module access; conduct weekly audits of BOM data integrity and access logs to detect unauthorized changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Bills Of Material
View allAuthenticated attackers holding a low-privileged Oracle E-Business Suite account can fully take over the Bills of Materi
Full system compromise of Oracle Bills of Material - a component of Oracle E-Business Suite - across versions 12.2.3 thr
A low-privileged authenticated attacker with HTTP access to the Oracle Bills of Material module in Oracle E-Business Sui
Oracle E-Business Suite's Bills of Material module (versions 12.2.13 through 12.2.15) contains a difficult-to-exploit fl
Oracle Bills of Material, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations
Low-privileged Oracle E-Business Suite accounts can read and modify all Bills of Material data by reaching the Internal
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Bill Issues). Rated high se
High-privileged users who can already authenticate to Oracle E-Business Suite can trigger a hard-to-reach flaw in the Bi
Account/component takeover in Oracle Bills of Material (component: Internal Operations) within Oracle E-Business Suite 1
Authenticated, low-privileged users with network HTTP access to the Oracle Bills of Material Setup Workbench in Oracle E
Oracle Bills of Material's Web Services component in E-Business Suite 12.2.3-12.2.15 exposes a medium-severity flaw allo
Exploit-DB