EUVD-2026-79747
GHSA-h2g8-2g34-g77v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
DeliveryAuthenticate to E-Business Suite over HTTP
-
ExploitSend crafted request to BOM Internal Operations
-
ExecutionBypass data-access controls
-
ImpactRead and modify all Bills of Material data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged Oracle E-Business Suite account (PR:L) with network HTTP access to the Bills of Material product's Internal Operations component; affected versions are 12.2.3 through 12.2.15. No user interaction and no elevated privileges are needed, and the flaw is described as easily exploitable, but the authentication requirement is the primary limiting factor - this cannot be triggered by an unauthenticated attacker. Availability is unaffected (A:N); impact is limited to unauthorized read and write of BOM-accessible data. |
| Impact | The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) is well-calibrated: network-reachable over HTTP, low attack complexity, and - critically - requiring an authenticated low-privileged account (PR:L), which meaningfully limits the attacker population versus a pre-auth flaw. Full confidentiality and integrity impact (read/create/delete/modify all Oracle Bills of Material data) with no availability impact keeps it just below the 9.x pre-auth tier. No EPSS score, no CISA KEV listing, and no public POC were provided, so this is 'no public exploit identified at time of analysis' - a real but not emergency priority. The key tension in the input is the 'Authentication Bypass' tag, which directly contradicts the PR:L vector: PR:L means valid credentials are required, so this is an authenticated privilege/data-access flaw, NOT an auth bypass. Oracle's advisory (cspusep2026) carries zero technical detail, so root cause, CWE, and exploit specifics are unverifiable beyond the vector. |
| Exploit ScenarioDerived | An attacker who has obtained any low-privileged Oracle E-Business Suite application account (e.g., a limited employee or self-service user) sends crafted HTTP requests to the Bills of Material Internal Operations component. Because access controls fail to segregate BOM data, the attacker reads, creates, deletes, or modifies critical manufacturing bill-of-material records well beyond their intended authorization. No public exploit code is currently identified, and no user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Low-privileged Oracle E-Business Suite accounts can read and modify all Bills of Material data by reaching the Internal Operations component of Oracle Bills of Material over HTTP in versions 12.2.3 through 12.2.15 (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The flaw is rated easily exploitable, but it is not pre-authentication: an attacker must first hold a valid low-privileged EBS account, which is the primary limiting factor, and no user interaction or elevated privileges are needed. Impact is confined to confidentiality and integrity - creation, deletion, modification and disclosure of Bills of Material-accessible data - with availability unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis.
RemediationAI
Apply the fix published in Oracle's security alert for this CVE (https://www.oracle.com/security-alerts/cspusep2026.html), which covers the affected Bills of Material versions 12.2.3-12.2.15; because the available feeds do not specify an individual patch version, patch availability is per that vendor advisory and the applicable EBS 12.2 patch set should be confirmed against it before scheduling the change window (expect application-tier downtime during patching). Until the patch is applied, reduce exposure by restricting network access to the Bills of Material Internal Operations endpoints so that only trusted networks or application tiers can reach them - via firewall rules, a reverse proxy/WAF in front of the EBS HTTP listener, or EBS access controls - accepting the trade-off that legitimate remote and integration users on those paths will be blocked or must be re-routed. In parallel, prune BOM-related responsibilities and menu grants from low-privileged accounts so that fewer users can reach the vulnerable operations, noting this reduces functionality for any staff who legitimately need read or edit access to BOM data. Enable and review EBS audit logging on Bills of Material tables for unexpected create/delete/update activity, and monitor HTTP requests to the BOM internal endpoints for unusual callers, as a detection compensating control while remediation is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is a large integrated ERP platform, and its Bills of Material (BOM) module stores the manufacturing bills, routings and component structures that drive production and cost planning. The affected component, "Internal Operations," handles internal processing and HTTP-reachable operations for the BOM product rather than administrative UI screens, which is why the flaw is reachable over the network with low complexity. No CWE identifier is supplied in the available feeds, but the accompanying tag set flags an authentication-bypass class issue, and the assessed vector (PR:L with C:H/I:H) is most consistent with a missing or insufficient authorization/access-control check on those internal operations: a session that should only be able to act within its own responsibility or data scope can instead invoke BOM operations that disclose and mutate records it should not touch. CPE strings were not provided in the intelligence feed; the affected range is taken from the ENISA EUVD record (Oracle Bills of Material 12.2.3 ≤ 12.2.15), and availability impact is explicitly absent (A:N), so this is a data-integrity/confidentiality exposure rather than a denial-of-service vector.
Know when Bills Of Material gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network HTTP with low complexity, requires a low-privileged authenticated account (PR:L), full read/write of BOM data (C:H/I:H) but no availability impact (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Bills of Material accessible data as well as unauthorized access to critical data or complete access to all Oracle Bills of Material accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle E-Business Suite versions 12.2.3 through 12.2.15 expose Bills of Material data to unauthorized read and modification by any holder of a routine low-privileged account, meaning ordinary business users or compromised contractor credentials could tamper with product definitions, costing structures, and manufacturing records. Because no vendor patch exists and no public exploit code has been identified, the risk is currently driven by insider or credential-abuse scenarios rather than opportunistic external attack. Leadership should care because corrupted Bills of Material propagate directly into production, procurement, and financial reporting, creating operational and compliance exposure that is difficult to detect and expensive to unwind.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the Internal Operations component of Oracle Bills of Material over HTTP to trusted hosts or VPN only; enforce least privilege and remove or disable unnecessary low-privileged EBS accounts; rotate credentials for accounts with Bills of Material access; deploy WAF or reverse-proxy rules blocking unexpected requests to the Internal Operations endpoint; enable detailed audit logging and alerting on Bills of Material data access and modification; and reconcile Bills of Material records against a trusted baseline to detect tampering.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Bills Of Material
View allAuthenticated attackers holding a low-privileged Oracle E-Business Suite account can fully take over the Bills of Materi
Full system compromise of Oracle Bills of Material - a component of Oracle E-Business Suite - across versions 12.2.3 thr
A low-privileged authenticated attacker with HTTP access to the Oracle Bills of Material module in Oracle E-Business Sui
Oracle E-Business Suite's Bills of Material module (versions 12.2.13 through 12.2.15) contains a difficult-to-exploit fl
Oracle Bills of Material, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations
Data compromise in Oracle Bills of Material (Internal Operations component) of Oracle E-Business Suite versions 12.2.13
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Bill Issues). Rated high se
High-privileged users who can already authenticate to Oracle E-Business Suite can trigger a hard-to-reach flaw in the Bi
Account/component takeover in Oracle Bills of Material (component: Internal Operations) within Oracle E-Business Suite 1
Authenticated, low-privileged users with network HTTP access to the Oracle Bills of Material Setup Workbench in Oracle E
Oracle Bills of Material's Web Services component in E-Business Suite 12.2.3-12.2.15 exposes a medium-severity flaw allo
Exploit-DB