Customer Care
Monthly
Unauthorized data access and modification in Oracle Customer Care (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by network-authenticated low-privileged attackers through the Internal Operations component via HTTP, with successful exploitation requiring victim interaction and producing a scope change that can compromise additional Oracle E-Business Suite components. The vulnerability carries a CVSS 3.1 score of 8.7, reflecting high confidentiality and integrity impacts with a cross-component blast radius. Oracle's August 2026 Critical Patch Update confirms the issue; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Oracle Customer Care (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 allows a high-privileged, remote attacker to achieve full confidentiality and integrity compromise via HTTP - with a confirmed scope change that can cascade to additional EBS products. Despite the PR:H requirement, the 'Authentication Bypass' tag suggests that controls within the authenticated context can be circumvented, enabling unauthorized read and write access to critical customer data. No public exploit code has been identified and CISA KEV listing is absent, but the 'easily exploitable' vendor qualifier and low attack complexity mean that any attacker who reaches this component with elevated credentials faces minimal technical barriers.
Account/component takeover in the Oracle Customer Care module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the Customer Care component. The flaw carries a CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, and low attack complexity. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Unauthorized data access and modification in Oracle Customer Care (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by network-authenticated low-privileged attackers through the Internal Operations component via HTTP, with successful exploitation requiring victim interaction and producing a scope change that can compromise additional Oracle E-Business Suite components. The vulnerability carries a CVSS 3.1 score of 8.7, reflecting high confidentiality and integrity impacts with a cross-component blast radius. Oracle's August 2026 Critical Patch Update confirms the issue; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Oracle Customer Care (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 allows a high-privileged, remote attacker to achieve full confidentiality and integrity compromise via HTTP - with a confirmed scope change that can cascade to additional EBS products. Despite the PR:H requirement, the 'Authentication Bypass' tag suggests that controls within the authenticated context can be circumvented, enabling unauthorized read and write access to critical customer data. No public exploit code has been identified and CISA KEV listing is absent, but the 'easily exploitable' vendor qualifier and low attack complexity mean that any attacker who reaches this component with elevated credentials faces minimal technical barriers.
Account/component takeover in the Oracle Customer Care module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the Customer Care component. The flaw carries a CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, and low attack complexity. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.