EUVD-2026-61781
GHSA-98q8-hcp4-52jg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Low-privilege authenticated network access sufficient; no availability impact; confidentiality and integrity fully compromised per Oracle advisory description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Systems. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Process Manufacturing Systems accessible data as well as unauthorized access to critical data or complete access to all Oracle Process Manufacturing Systems accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Oracle Process Manufacturing Systems (OPM), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes a high-severity authenticated network vulnerability in the Internal Operations component that allows low-privileged attackers to both read and manipulate critical data. The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impact with no availability impact, exploitable over HTTP without user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged user account on the Oracle E-Business Suite instance - the CVSS vector PR:L confirms authenticated access is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.1 with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N reflects a network-exploitable, low-complexity vulnerability requiring only a low-privileged account - a realistic attacker profile in any multi-tenant ERP environment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply Oracle's August 2026 Critical Patch Update (CPU), available via My Oracle Support and referenced at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Enumerate all OPM instances and confirm versions (12.2.3-12.2.15) in your environment; review access logs for unusual activity in the Internal Operations component. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Account/instance takeover in Oracle Process Manufacturing Systems (Internal Operations component of Oracle E-Business Su
Data compromise in Oracle Process Manufacturing Systems (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-priv
Data compromise in Oracle Process Manufacturing Systems (Oracle E-Business Suite, Internal Operations component) version
Full system takeover is possible in Oracle Process Manufacturing Systems (OPM), an Oracle E-Business Suite component, vi
Full compromise of the Oracle Process Manufacturing Systems module in Oracle E-Business Suite 12.2.11 through 12.2.15 is
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today