Bills Of Material
Monthly
Authenticated, low-privileged users with network HTTP access to the Oracle Bills of Material Setup Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Bills of Material data they are not authorized to see, including data belonging to other integrated Oracle products because the vulnerability crosses a security scope boundary (CVSS 3.1 base score 7.7, High). The weakness is confidentiality-only - there is no integrity or availability impact - and exploitation requires a valid low-privileged application account (PR:L) plus reachable HTTP access to the affected component, with no user interaction needed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied; the limiting factors are the authentication prerequisite and the read-only nature of the impact.
Authenticated attackers holding a low-privileged Oracle E-Business Suite account can fully take over the Bills of Material module in versions 12.2.3 through 12.2.15, achieving high impact against confidentiality, integrity, and availability (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw lives in the module's Setup Workbench component and needs only HTTP reachability plus a valid low-privilege login — no victim interaction — making it a strong privilege-escalation stepping stone for anyone with a foothold in the EBS environment. Oracle documents the issue in its September 2026 Critical Security Patch Update advisory; no public exploit code, EPSS score, or CISA KEV entry accompanies this record, so active exploitation is unconfirmed and no public exploit was identified at time of analysis.
High-privileged users who can already authenticate to Oracle E-Business Suite can trigger a hard-to-reach flaw in the Bills of Material Setup Workbench component of versions 12.2.3 through 12.2.15 and take full control of that module, with the potential to pivot into other connected EBS products because of the scope change. Oracle rates the issue CVSS 3.1 base 8.0 with high confidentiality, integrity and availability impact, but exploitation is described as difficult and requires an authenticated, privileged position plus network access over HTTP. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and the only reference available is Oracle's Critical Security Patch Update advisory.
A low-privileged authenticated attacker with HTTP access to the Oracle Bills of Material module in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Bills of Material data beyond their authorization and partially degrade availability of the module, with the impact extending into other, additional Oracle products (scope change). Oracle rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) in its 2026 Critical Security Patch Update advisory, and the flaw is considered easily exploitable because it needs no user interaction or complex timing. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; no EPSS score or POC reference was supplied with the intelligence for this analysis.
Low-privileged Oracle E-Business Suite accounts can read and modify all Bills of Material data by reaching the Internal Operations component of Oracle Bills of Material over HTTP in versions 12.2.3 through 12.2.15 (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The flaw is rated easily exploitable, but it is not pre-authentication: an attacker must first hold a valid low-privileged EBS account, which is the primary limiting factor, and no user interaction or elevated privileges are needed. Impact is confined to confidentiality and integrity - creation, deletion, modification and disclosure of Bills of Material-accessible data - with availability unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Oracle Bills of Material, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations component that fails to properly restrict what a low-privileged authenticated user can do over HTTP. An attacker holding any valid low-privilege E-Business Suite account can send crafted HTTP requests that read all Bills of Material data and create, delete, or modify it, giving full confidentiality and integrity compromise of the module's records without any user interaction. At the time of analysis there is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied, so the practical near-term risk is driven by whether the target EBS instance is internet-facing or reachable from a compromised low-privilege account.
Oracle E-Business Suite's Bills of Material module (versions 12.2.13 through 12.2.15) contains a difficult-to-exploit flaw in the Internal Operations component that lets a low-privileged, authenticated attacker with HTTP network access read and tamper with critical manufacturing data. Successful exploitation yields high confidentiality and integrity impact and, per Oracle, can spill over into other EBS modules because of a scope change, though availability is unaffected. There is no CISA KEV listing and no public exploit code identified at time of analysis; the vendor advisory is the primary source of truth.
Full system compromise of Oracle Bills of Material - a component of Oracle E-Business Suite - across versions 12.2.3 through 12.2.15 is achievable by a network-reachable, low-privileged attacker via crafted HTTP requests, with Oracle confirming potential for complete takeover covering confidentiality, integrity, and availability. The scope change designation in the CVSS vector indicates that successful exploitation can cascade beyond the Bills of Material module to affect additional Oracle E-Business Suite components. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Oracle has issued a patch in the August 2026 Critical Patch Update.
Data compromise in Oracle Bills of Material (Internal Operations component) of Oracle E-Business Suite versions 12.2.13 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the Bills of Material module via HTTP. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, the flaw is easily exploitable and requires only low privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag references an 'Authentication Bypass' class though the CVSS vector requires PR:L.
Account/component takeover in Oracle Bills of Material (component: Internal Operations) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the module when a legitimate user is lured into interacting with attacker-supplied content. Per the CVSS vector (PR:L/UI:R), exploitation requires an existing low-level account plus victim interaction, but a successful attack yields high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). No public exploit identified at time of analysis; disclosed via Oracle's July 2026 Critical Patch Update.
Oracle Bills of Material's Web Services component in E-Business Suite 12.2.3-12.2.15 exposes a medium-severity flaw allowing low-privileged authenticated attackers to compromise data confidentiality, integrity, and availability via HTTP. Exploitation yields unauthorized read access to a subset of Bills of Material data, unauthorized insert, update, or delete capability, and the ability to cause a partial denial of service against the module. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Bill Issues). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Authenticated, low-privileged users with network HTTP access to the Oracle Bills of Material Setup Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Bills of Material data they are not authorized to see, including data belonging to other integrated Oracle products because the vulnerability crosses a security scope boundary (CVSS 3.1 base score 7.7, High). The weakness is confidentiality-only - there is no integrity or availability impact - and exploitation requires a valid low-privileged application account (PR:L) plus reachable HTTP access to the affected component, with no user interaction needed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied; the limiting factors are the authentication prerequisite and the read-only nature of the impact.
Authenticated attackers holding a low-privileged Oracle E-Business Suite account can fully take over the Bills of Material module in versions 12.2.3 through 12.2.15, achieving high impact against confidentiality, integrity, and availability (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw lives in the module's Setup Workbench component and needs only HTTP reachability plus a valid low-privilege login — no victim interaction — making it a strong privilege-escalation stepping stone for anyone with a foothold in the EBS environment. Oracle documents the issue in its September 2026 Critical Security Patch Update advisory; no public exploit code, EPSS score, or CISA KEV entry accompanies this record, so active exploitation is unconfirmed and no public exploit was identified at time of analysis.
High-privileged users who can already authenticate to Oracle E-Business Suite can trigger a hard-to-reach flaw in the Bills of Material Setup Workbench component of versions 12.2.3 through 12.2.15 and take full control of that module, with the potential to pivot into other connected EBS products because of the scope change. Oracle rates the issue CVSS 3.1 base 8.0 with high confidentiality, integrity and availability impact, but exploitation is described as difficult and requires an authenticated, privileged position plus network access over HTTP. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and the only reference available is Oracle's Critical Security Patch Update advisory.
A low-privileged authenticated attacker with HTTP access to the Oracle Bills of Material module in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Bills of Material data beyond their authorization and partially degrade availability of the module, with the impact extending into other, additional Oracle products (scope change). Oracle rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) in its 2026 Critical Security Patch Update advisory, and the flaw is considered easily exploitable because it needs no user interaction or complex timing. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; no EPSS score or POC reference was supplied with the intelligence for this analysis.
Low-privileged Oracle E-Business Suite accounts can read and modify all Bills of Material data by reaching the Internal Operations component of Oracle Bills of Material over HTTP in versions 12.2.3 through 12.2.15 (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The flaw is rated easily exploitable, but it is not pre-authentication: an attacker must first hold a valid low-privileged EBS account, which is the primary limiting factor, and no user interaction or elevated privileges are needed. Impact is confined to confidentiality and integrity - creation, deletion, modification and disclosure of Bills of Material-accessible data - with availability unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Oracle Bills of Material, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations component that fails to properly restrict what a low-privileged authenticated user can do over HTTP. An attacker holding any valid low-privilege E-Business Suite account can send crafted HTTP requests that read all Bills of Material data and create, delete, or modify it, giving full confidentiality and integrity compromise of the module's records without any user interaction. At the time of analysis there is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied, so the practical near-term risk is driven by whether the target EBS instance is internet-facing or reachable from a compromised low-privilege account.
Oracle E-Business Suite's Bills of Material module (versions 12.2.13 through 12.2.15) contains a difficult-to-exploit flaw in the Internal Operations component that lets a low-privileged, authenticated attacker with HTTP network access read and tamper with critical manufacturing data. Successful exploitation yields high confidentiality and integrity impact and, per Oracle, can spill over into other EBS modules because of a scope change, though availability is unaffected. There is no CISA KEV listing and no public exploit code identified at time of analysis; the vendor advisory is the primary source of truth.
Full system compromise of Oracle Bills of Material - a component of Oracle E-Business Suite - across versions 12.2.3 through 12.2.15 is achievable by a network-reachable, low-privileged attacker via crafted HTTP requests, with Oracle confirming potential for complete takeover covering confidentiality, integrity, and availability. The scope change designation in the CVSS vector indicates that successful exploitation can cascade beyond the Bills of Material module to affect additional Oracle E-Business Suite components. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Oracle has issued a patch in the August 2026 Critical Patch Update.
Data compromise in Oracle Bills of Material (Internal Operations component) of Oracle E-Business Suite versions 12.2.13 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the Bills of Material module via HTTP. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, the flaw is easily exploitable and requires only low privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag references an 'Authentication Bypass' class though the CVSS vector requires PR:L.
Account/component takeover in Oracle Bills of Material (component: Internal Operations) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the module when a legitimate user is lured into interacting with attacker-supplied content. Per the CVSS vector (PR:L/UI:R), exploitation requires an existing low-level account plus victim interaction, but a successful attack yields high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). No public exploit identified at time of analysis; disclosed via Oracle's July 2026 Critical Patch Update.
Oracle Bills of Material's Web Services component in E-Business Suite 12.2.3-12.2.15 exposes a medium-severity flaw allowing low-privileged authenticated attackers to compromise data confidentiality, integrity, and availability via HTTP. Exploitation yields unauthorized read access to a subset of Bills of Material data, unauthorized insert, update, or delete capability, and the ability to cause a partial denial of service against the module. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Bill Issues). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.