Applications Technology Stack
Monthly
Full takeover of the Oracle Applications Technology Stack is possible in Oracle E-Business Suite 12.2.3 through 12.2.15 via the Client System Analyzer component, which is reachable over HTTP by unauthenticated network attackers. Exploitation is rated difficult (high attack complexity) but a successful attack yields complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege abuse in Oracle E-Business Suite's Applications Technology Stack Configuration component exposes critical data to high-privileged local attackers across versions 12.2.3 through 12.2.15. The vulnerability allows an authenticated, high-privileged attacker with local infrastructure access to achieve both full confidentiality and integrity compromise of all data accessible to the Applications Technology Stack, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and the vulnerability is tagged as an authentication bypass despite the PR:H requirement - suggesting the bypass may escalate effective access beyond what the initial privilege level should permit.
Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Configuration). Rated low severity (CVSS 3.6), this vulnerability is no authentication required.
Vulnerability in the Oracle Applications Technology product of Oracle E-Business Suite (component: Templates). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Full takeover of the Oracle Applications Technology Stack is possible in Oracle E-Business Suite 12.2.3 through 12.2.15 via the Client System Analyzer component, which is reachable over HTTP by unauthenticated network attackers. Exploitation is rated difficult (high attack complexity) but a successful attack yields complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege abuse in Oracle E-Business Suite's Applications Technology Stack Configuration component exposes critical data to high-privileged local attackers across versions 12.2.3 through 12.2.15. The vulnerability allows an authenticated, high-privileged attacker with local infrastructure access to achieve both full confidentiality and integrity compromise of all data accessible to the Applications Technology Stack, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and the vulnerability is tagged as an authentication bypass despite the PR:H requirement - suggesting the bypass may escalate effective access beyond what the initial privilege level should permit.
Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Configuration). Rated low severity (CVSS 3.6), this vulnerability is no authentication required.
Vulnerability in the Oracle Applications Technology product of Oracle E-Business Suite (component: Templates). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.