Customers Online
Monthly
Full takeover of Oracle Customers Online (E-Business Suite component) is achievable by any low-privileged authenticated user over HTTP, across versions 12.2.3 through 12.2.15. The Customer Tab component contains a flaw that, when exploited, yields complete confidentiality, integrity, and availability compromise - Oracle's own description uses the word 'takeover.' No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad authentication baseline (any portal account qualifies) make this a critical patching priority for Oracle EBS deployments.
Broad data compromise in Oracle Customers Online (part of Oracle E-Business Suite, component: Internal Operations) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High), it carries full confidentiality and integrity impact with no availability impact, and Oracle tags it as an authentication-bypass-class weakness. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and modest privilege requirement make it a high-priority fix.
Data compromise in Oracle Customers Online (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all data accessible to the application. Oracle rates this CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and the intelligence tag 'Authentication Bypass' suggests horizontal privilege escalation past intended access boundaries. No public exploit identified at time of analysis, and the flaw is fixed in the Oracle Critical Patch Update of July 2026.
Broad data compromise in Oracle Customers Online (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, allows a low-privileged attacker with network HTTP access to read, create, modify, and delete all data accessible to the application. The CVSS 3.1 base score is 8.1 (C:H/I:H) reflecting high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Customer Tab). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Full takeover of Oracle Customers Online (E-Business Suite component) is achievable by any low-privileged authenticated user over HTTP, across versions 12.2.3 through 12.2.15. The Customer Tab component contains a flaw that, when exploited, yields complete confidentiality, integrity, and availability compromise - Oracle's own description uses the word 'takeover.' No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad authentication baseline (any portal account qualifies) make this a critical patching priority for Oracle EBS deployments.
Broad data compromise in Oracle Customers Online (part of Oracle E-Business Suite, component: Internal Operations) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High), it carries full confidentiality and integrity impact with no availability impact, and Oracle tags it as an authentication-bypass-class weakness. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and modest privilege requirement make it a high-priority fix.
Data compromise in Oracle Customers Online (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all data accessible to the application. Oracle rates this CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and the intelligence tag 'Authentication Bypass' suggests horizontal privilege escalation past intended access boundaries. No public exploit identified at time of analysis, and the flaw is fixed in the Oracle Critical Patch Update of July 2026.
Broad data compromise in Oracle Customers Online (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, allows a low-privileged attacker with network HTTP access to read, create, modify, and delete all data accessible to the application. The CVSS 3.1 base score is 8.1 (C:H/I:H) reflecting high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Customer Tab). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.