EUVD-2026-61659
GHSA-mvjr-r6x8-qj7p
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor-provided vector is independently consistent with the description: network-accessible, unauthenticated, high complexity barrier, no scope change, full triad impact reflecting system takeover.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite (component: Party Search UI). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trading Community. Successful attacks of this vulnerability can result in takeover of Oracle Trading Community. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of Oracle Trading Community within Oracle E-Business Suite is achievable by unauthenticated remote attackers via HTTP, targeting the Party Search UI component across versions 12.2.3 through 12.2.15. The Oracle-reported CVSS vector confirms network accessibility with no privilege or user-interaction requirement, though high attack complexity (AC:H) indicates exploitation is non-trivial and likely requires precise conditions such as timing, specific request sequencing, or environment-dependent state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability requires unauthenticated HTTP network access to the Oracle E-Business Suite instance running the Party Search UI component (CVSS PR:N, AV:N, UI:N confirms no authentication or user interaction is needed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 base score reflects a serious but conditionally exploitable vulnerability: network-accessible, unauthenticated, with no user interaction required, but constrained by high attack complexity (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Patch Update (CPU) for August 2026 as the primary remediation, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Oracle E-Business Suite instances running affected versions (12.2.3-12.2.15) and assess Party Search UI exposure to untrusted networks; isolate affected systems from direct internet access where operationally feasible and document baseline. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Trading Community
View allUnauthenticated remote data exposure in Oracle Trading Community (Oracle E-Business Suite) versions 12.2.3 through 12.2.
Unauthorized data compromise in Oracle Trading Community (Oracle E-Business Suite, Party Search UI component) allows a l
Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite (component: Party Search UI). Rated hig
Full takeover of the Oracle Trading Community module in Oracle E-Business Suite (versions 12.2.3 through 12.2.12) is ach
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today