EUVD-2026-47527
GHSA-4c2q-pqjh-9v54
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
DeliveryReach Flow Manufacturing HTTP endpoint
-
ExploitSend crafted request bypassing authorization
-
ExecutionRead or modify accessible data
-
ImpactExfiltrate or tamper business data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Oracle E-Business Suite HTTP tier and a valid low-privileged EBS account (CVSS PR:L), with no user interaction and low attack complexity (AC:L). The affected deployment must be running Oracle Flow Manufacturing on EBS versions 12.2.13 through 12.2.15 with the Internal Operations component reachable. Limiting factors: an authenticated foothold is needed per the CVSS vector, so fully anonymous exploitation is not indicated despite the 'Authentication Bypass' tag; exposure is further limited where the EBS web tier is not reachable from untrusted networks. There is no availability impact (A:N), so this is a data confidentiality/integrity issue rather than a service-disruption one. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) signals easy network exploitation requiring only low privileges and no user interaction, with high confidentiality and integrity impact - a serious rating for an ERP holding sensitive manufacturing and business data. However, no EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation-likelihood signals are absent rather than low. There is a notable tension: the input Tags field labels this 'Authentication Bypass', which would normally imply PR:N (unauthenticated), yet the vendor CVSS vector states PR:L (a valid low-privileged account is required) - this discrepancy should be verified against Oracle's advisory, as it materially changes whether an authenticated foothold is a prerequisite. Treating the CVSS-provided PR:L as authoritative, this is a real prioritization item for EBS operators given trivial complexity and high data impact, even though widespread automated exploitation is unproven. |
| Exploit ScenarioDerived | An attacker who holds or phishes any low-privileged EBS user account sends crafted HTTP requests to the Flow Manufacturing Internal Operations functions and, exploiting the authorization weakness, reads and alters manufacturing and related business data beyond their assigned privileges. Because attack complexity is low and no user interaction is needed, a single valid low-tier credential is sufficient; no public POC is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Data compromise in Oracle Flow Manufacturing (Oracle E-Business Suite 12.2.13-12.2.15, Internal Operations component) allows a low-privileged remote attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (high) with full confidentiality and integrity impact but no availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV; disclosure is via Oracle's July 2026 Critical Patch Update.
RemediationAI
Apply the fixes in Oracle's July 2026 Critical Patch Update; Oracle ships EBS security fixes as CPU patches for the 12.2 release line rather than as new point versions, so an exact standalone fix version is not stated in the input - consult https://www.oracle.com/security-alerts/cpujul2026.html for the specific patch and My Oracle Support patch numbers matching your 12.2.13-12.2.15 level. Until patched, restrict network reachability of the EBS web tier by placing it behind a VPN or IP allowlist and terminating untrusted access at a reverse proxy/WAF, and tighten application role and responsibility assignments so low-privileged accounts cannot reach the Internal Operations/Flow Manufacturing functions - these controls reduce exposure but do not remove the flaw and may impede legitimate remote or partner users. Review application and database audit logs for anomalous data access or modification within Flow Manufacturing as a detective control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Flow Manufacturing is a module within Oracle E-Business Suite (EBS), Oracle's on-premises ERP application delivered over a web (HTTP) tier and backed by an Oracle Database. The flaw resides in the Internal Operations component. Oracle does not publish a CWE for CPU findings (CWE: N/A here), but the impact profile - a low-privileged authenticated user gaining broad access to all data the application can reach with no availability effect - is consistent with a broken access control / authorization weakness (CWE-284/CWE-285), corroborated by the supplied 'Authentication Bypass' tag. EBS deployments are typically internet- or intranet-facing multi-tier Java/PL-SQL applications, so an HTTP-reachable authorization flaw exposes the underlying business data set.
Know when Flow Manufacturing gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable HTTP flaw exploitable by a low-privileged account with no user interaction; full confidentiality and integrity loss but no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.13-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Flow Manufacturing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Flow Manufacturing accessible data as well as unauthorized access to critical data or complete access to all Oracle Flow Manufacturing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Flow Manufacturing (E-Business Suite 12.2.13-12.2.15) contains a critical data access flaw allowing authenticated low-privileged users to read, create, delete, and modify all data accessible to the application via HTTP. This fully compromises both confidentiality and data integrity of manufacturing operations data with no current vendor patch available. Organizations running these versions face immediate risk of unauthorized data access and manipulation.
No vendor-released patch identified at time of analysis. Implement network segmentation to restrict HTTP access to the application, require multifactor authentication for all low-privileged user accounts, minimize low-privileged account provisioning, enforce database-level access controls on sensitive manufacturing data where available, and deploy real-time audit logging on all data access, creation, deletion, and modification operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Flow Manufacturing
View allOracle Flow Manufacturing versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains a vulnerabil
Full compromise of Oracle Flow Manufacturing (Internal Operations component of Oracle E-Business Suite) is achievable by
Unauthorized data access in Oracle Flow Manufacturing 12.2.3 through 12.2.15 allows network-authenticated low-privileged
Exploit-DB