EUVD-2026-47528
GHSA-f73v-4gr6-9w9f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reach with low complexity and no user interaction, but a valid low-privilege EBS account is required (PR:L); full module takeover yields C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Flow Manufacturing. Successful attacks of this vulnerability can result in takeover of Oracle Flow Manufacturing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full compromise of Oracle Flow Manufacturing (Internal Operations component of Oracle E-Business Suite) is achievable by a low-privileged attacker over the network via HTTP, per Oracle's July 2026 Critical Patch Update. Any authenticated EBS user can leverage the flaw to take over the module, exposing and altering confidential manufacturing data (high confidentiality, integrity, and availability impact, CVSS 8.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle EBS is a recurring target for opportunistic and targeted attackers.
Technical ContextAI
Oracle Flow Manufacturing is a module within Oracle E-Business Suite (EBS), the vendor's on-premises ERP platform, and the flaw resides in its Internal Operations component. EBS exposes web-facing servlets and pages through Oracle Application Server / WebLogic over HTTP, and this vulnerability is reached through that network-facing HTTP surface by an already-authenticated application user. No CWE was assigned in the source data, so the precise root-cause class (e.g., injection, access control, or deserialization) cannot be confirmed; the 'Information Disclosure' tag plus the full C/I/A impact and 'takeover' language suggest a flaw that breaks the module's authorization or data-access boundary rather than a pure read-only disclosure.
RemediationAI
Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle delivers EBS 12.2 fixes as cumulative CPU patches applied over the 12.2.x codeline rather than as a single named version, so identify and apply the specific CPU July 2026 patch for your installed release (12.2.7-12.2.15) - treat this as 'Patch available per vendor advisory' since no discrete fixed version string was provided in the input. Until patched, reduce exposure by restricting network access to the EBS application tier and the Flow Manufacturing / Internal Operations URLs to trusted internal networks or VPN, tightening user provisioning so low-privilege accounts are minimized and audited, and enabling web-tier logging/WAF rules in front of the EBS servlets - with the trade-off that URL restrictions may disrupt legitimate internal manufacturing workflows and must be validated before enforcement. Do not rely on workarounds as a substitute for the CPU patch.
More in Flow Manufacturing
View allOracle Flow Manufacturing versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains a vulnerabil
Data compromise in Oracle Flow Manufacturing (Oracle E-Business Suite 12.2.13-12.2.15, Internal Operations component) al
Unauthorized data access in Oracle Flow Manufacturing 12.2.3 through 12.2.15 allows network-authenticated low-privileged
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today