EUVD-2026-79812
GHSA-w4xr-9jr4-4wfx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network HTTP with low complexity and no UI; PR:L because a low-privileged account is required; full C/I compromise of module data but no availability impact, scope unchanged.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.4-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Order Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Authenticated low-privileged users with network HTTP access can fully compromise Order Management data in Oracle E-Business Suite 12.2.4 through 12.2.15, gaining unauthorized read, creation, deletion, and modification of any Order Management data reachable through the Product Diagnostic Tools component. Rated CVSS 3.1 base 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the issue needs only a valid low-privileged account, no user interaction, and no elevated privileges, so any authenticated foothold on the instance is enough; there is no availability impact and no scope change. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid low-privileged account on the target Oracle E-Business Suite instance (PR:L) with network HTTP access to the Order Management product's Product Diagnostic Tools component; affected versions are 12.2.4 through 12.2.15. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but authenticated-access-gated priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle fix distributed through the Oracle Security Alert at https://www.oracle.com/security-alerts/cspusep2026.html (Oracle Critical Patch Update / security alert for E-Business Suite); patch availability is confirmed per the vendor advisory, but no explicit fix version was provided in the source data, so consult the advisory for the exact 12.2.x patch level and apply it to both the application tier and the database tier as directed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Oracle E-Business Suite instances and confirm which run versions 12.2.4 through 12.2.15, then restrict network reachability to the Product Diagnostic Tools component using firewall rules, web-tier ACLs, or Oracle EBS access controls so only explicitly required administrative hosts and users can reach it, and pull authentication and Product Diagnostic Tools access logs for the past 30 days to check for anomalous Order Management reads or writes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today