Bills Of Material
Monthly
Full system compromise of Oracle Bills of Material - a component of Oracle E-Business Suite - across versions 12.2.3 through 12.2.15 is achievable by a network-reachable, low-privileged attacker via crafted HTTP requests, with Oracle confirming potential for complete takeover covering confidentiality, integrity, and availability. The scope change designation in the CVSS vector indicates that successful exploitation can cascade beyond the Bills of Material module to affect additional Oracle E-Business Suite components. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Oracle has issued a patch in the August 2026 Critical Patch Update.
Data compromise in Oracle Bills of Material (Internal Operations component) of Oracle E-Business Suite versions 12.2.13 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the Bills of Material module via HTTP. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, the flaw is easily exploitable and requires only low privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag references an 'Authentication Bypass' class though the CVSS vector requires PR:L.
Account/component takeover in Oracle Bills of Material (component: Internal Operations) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the module when a legitimate user is lured into interacting with attacker-supplied content. Per the CVSS vector (PR:L/UI:R), exploitation requires an existing low-level account plus victim interaction, but a successful attack yields high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). No public exploit identified at time of analysis; disclosed via Oracle's July 2026 Critical Patch Update.
Oracle Bills of Material's Web Services component in E-Business Suite 12.2.3-12.2.15 exposes a medium-severity flaw allowing low-privileged authenticated attackers to compromise data confidentiality, integrity, and availability via HTTP. Exploitation yields unauthorized read access to a subset of Bills of Material data, unauthorized insert, update, or delete capability, and the ability to cause a partial denial of service against the module. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Bill Issues). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Full system compromise of Oracle Bills of Material - a component of Oracle E-Business Suite - across versions 12.2.3 through 12.2.15 is achievable by a network-reachable, low-privileged attacker via crafted HTTP requests, with Oracle confirming potential for complete takeover covering confidentiality, integrity, and availability. The scope change designation in the CVSS vector indicates that successful exploitation can cascade beyond the Bills of Material module to affect additional Oracle E-Business Suite components. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Oracle has issued a patch in the August 2026 Critical Patch Update.
Data compromise in Oracle Bills of Material (Internal Operations component) of Oracle E-Business Suite versions 12.2.13 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the Bills of Material module via HTTP. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, the flaw is easily exploitable and requires only low privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag references an 'Authentication Bypass' class though the CVSS vector requires PR:L.
Account/component takeover in Oracle Bills of Material (component: Internal Operations) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the module when a legitimate user is lured into interacting with attacker-supplied content. Per the CVSS vector (PR:L/UI:R), exploitation requires an existing low-level account plus victim interaction, but a successful attack yields high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). No public exploit identified at time of analysis; disclosed via Oracle's July 2026 Critical Patch Update.
Oracle Bills of Material's Web Services component in E-Business Suite 12.2.3-12.2.15 exposes a medium-severity flaw allowing low-privileged authenticated attackers to compromise data confidentiality, integrity, and availability via HTTP. Exploitation yields unauthorized read access to a subset of Bills of Material data, unauthorized insert, update, or delete capability, and the ability to cause a partial denial of service against the module. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Bill Issues). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.