EUVD-2026-61589
GHSA-6553-hgh6-8www
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Consistent with vendor vector; PR:H is upheld because the description explicitly requires a high-privileged attacker, and A:N because no availability impact is described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Customer Care. While the vulnerability is in Oracle Customer Care, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customer Care accessible data as well as unauthorized access to critical data or complete access to all Oracle Customer Care accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).
AnalysisAI
Oracle Customer Care (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 allows a high-privileged, remote attacker to achieve full confidentiality and integrity compromise via HTTP - with a confirmed scope change that can cascade to additional EBS products. Despite the PR:H requirement, the 'Authentication Bypass' tag suggests that controls within the authenticated context can be circumvented, enabling unauthorized read and write access to critical customer data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a high-privileged Oracle EBS user account with network access to the EBS application tier via HTTP. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.7 is well-supported by the vector components: network-reachable (AV:N), low complexity (AC:L), no user interaction (UI:N), and a scope change (S:C) that amplifies impact across the EBS platform. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Patch Update for August 2026, available via the vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 with the Internal Operations component and implement network-level access restrictions limiting connectivity to high-trust administrative accounts and systems only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Customer Care
View allAccount/component takeover in the Oracle Customer Care module of Oracle E-Business Suite (versions 12.2.3 through 12.2.1
Unauthorized data access and modification in Oracle Customer Care (E-Business Suite versions 12.2.3 through 12.2.15) is
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today