E Business Suite
Monthly
Authenticated low-privileged network exploitation of Oracle Financials for Asia/Pacific (versions 12.2.3-12.2.15) enables unauthorized creation, deletion, or modification of critical financial data, with partial read access to additional records. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is reachable over HTTP without user interaction. No public exploit or active KEV listing has been identified at time of analysis, though Oracle classifies it as 'easily exploitable,' and the 'Authentication Bypass' tag suggests the low-privilege requirement may be bypassed or trivially satisfied under certain conditions.
Full system takeover of Oracle Call Center Technology - a component of Oracle E-Business Suite - is achievable by unauthenticated remote attackers via HTTP across versions 12.2.3 through 12.2.15, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The high attack complexity (AC:H) designation indicates that exploitation requires satisfying non-trivial preconditions beyond mere network reachability, but no authentication or user interaction is necessary, keeping the attack surface entirely external. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover is achievable in Oracle Call Center Technology (versions 12.2.3-12.2.15) by a low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The vendor describes this as 'easily exploitable' and confirms full Confidentiality, Integrity, and Availability compromise - consistent with a CVSS 8.8 High rating and system takeover outcome. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal privilege threshold lower the bar for exploitation significantly. Notably, the vulnerability tag 'Information Disclosure' understates the confirmed impact scope, which extends to full takeover.
Oracle Call Center Technology versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes a flaw in the Internal Operations component that allows a low-privileged authenticated network attacker to fully compromise the affected system via HTTP. The vendor-assigned CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability - consistent with the described 'takeover' outcome. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Unauthorized data access in Oracle Call Center Technology (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged remote attacker to gain complete read access to all data accessible by the application and limited write capability via HTTP, with a confirmed scope change enabling cascading impact on additional E-Business Suite components. The EUVD tags this as an Authentication Bypass, suggesting the Internal Operations component fails to enforce sufficient authorization boundaries for low-privilege accounts despite requiring initial authentication. No public exploit has been identified at time of analysis; this vulnerability was disclosed as part of Oracle's Critical Patch Update for August 2026.
Unauthorized data disclosure in Oracle Financials Common Modules (Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged authenticated attacker with HTTP network access to bypass access controls in the Common Components layer, gaining unauthorized read access to critical or complete financial data. The scope change (S:C) confirmed in the CVSS vector means successful exploitation can cascade into data exposure across additional Oracle EBS products beyond the directly vulnerable module. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this a straightforward exploitation path for any authenticated EBS user.
Full takeover of Oracle U.S. Federal Financials (versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker over HTTP, with successful exploitation resulting in complete compromise of confidentiality, integrity, and availability. The Internal Operations component within Oracle E-Business Suite exposes this attack surface to any authenticated network user, requiring no user interaction and no elevated permissions beyond a basic account. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and high impact make this a priority patching target for affected federal agencies.
Oracle Succession Planning within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a medium-severity, network-exploitable vulnerability in the Succession Plan component that allows low-privileged attackers to read, modify, or partially disrupt succession planning data via HTTP. The CVSS 3.1 vector confirms low attack complexity with no user interaction required, making exploitation straightforward for any authenticated EBS user. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Data tampering and partial denial-of-service in Oracle Production Scheduling (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker over HTTP create, delete, or modify critical data - with additional limited read access and a partial DoS. Oracle rates it CVSS 3.1 7.6, driven primarily by high integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-during-normal-cycle priority rather than an emergency.
Unauthorized access to critical data in Oracle Production Scheduling (versions 12.2.3 through 12.2.15) is achievable by unauthenticated remote attackers via a network-based authentication bypass in the Internal Operations component, though exploitation requires high attack complexity and human interaction from a third party. The confidentiality impact is complete - attackers can access all data accessible to Production Scheduling - while integrity and availability remain unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.
Privileged data compromise in Oracle Advanced Planning Command Center (Oracle E-Business Suite Internal Operations component, versions 12.2.3 through 12.2.15) lets an already high-privileged attacker with network HTTP access read all APCC-accessible data and perform limited unauthorized modifications. Because the flaw carries a scope change, successful attacks may significantly impact additional products beyond APCC itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.6; no public exploit identified at time of analysis.
Data compromise in Oracle Process Manufacturing Regulatory Management (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the component. Oracle rates it CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not in CISA KEV; an 'Authentication Bypass' tag is noted in intelligence sources but is not corroborated by the CVSS vector, which requires low privileges (PR:L).
Unauthorized critical-data access in Oracle E-Business Suite's Process Manufacturing Regulatory Management module (component: Internal Operations) allows a low-privileged, network-authenticated attacker to compromise the module over HTTP, with a scope change that may significantly impact additional Oracle products. Oracle rates it CVSS 3.1 8.5, reflecting high confidentiality impact plus limited integrity impact across a changed scope. There is no public exploit identified and it is not in CISA KEV, but Oracle self-reported it and shipped a fix in the July 2026 Critical Patch Update.
Full compromise (takeover) of Oracle Process Manufacturing Process Execution 12.2.15, a module of Oracle E-Business Suite (component: Internal Operations), is achievable by a low-privileged, authenticated attacker over HTTP. Successful exploitation yields high confidentiality, integrity, and availability impact against the module, though Oracle rates the attack complexity as high ('difficult to exploit'). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Takeover of Oracle Purchasing (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged, network-authenticated attacker in supported releases 12.2.11 through 12.2.15. Successful attacks yield full confidentiality, integrity, and availability compromise of the Purchasing application per Oracle's July 2026 Critical Patch Update. Exploitation is rated high-complexity (AC:H), and no public exploit identified at time of analysis; the issue was reported internally by Oracle's security alert team rather than a public researcher.
Confidential data exposure in Oracle Contracts Integration (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker with HTTP network access to bypass internal authorization controls in the Internal Operations component, gaining unauthorized access to critical or all accessible contract data. The CVSS confidentiality impact is rated High despite the moderate overall score of 5.3, reflecting complete in-scope data exposure when exploitation succeeds. No public exploit code or active exploitation has been identified at time of analysis; the high attack complexity (AC:H) constrains real-world opportunistic risk.
Partial authorization bypass in Oracle Contracts Integration (Oracle E-Business Suite 12.2.3-12.2.15) allows an authenticated low-privileged network attacker to perform unauthorized read, insert, update, or delete operations against a subset of contract data via HTTP under high-complexity conditions. Tagged as an Authentication Bypass, suggesting the flaw permits a low-privileged session to exceed its intended access boundary within the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity substantially limits opportunistic exploitation.
Unauthorized data manipulation in Oracle Contracts Integration (versions 12.2.3-12.2.15) allows a low-privileged authenticated attacker over HTTP to create, delete, or modify critical contract data without proper authorization. The 'Authentication Bypass' tag in source intelligence conflicts with the CVSS PR:L metric - this appears to be an authorization bypass within the Internal Operations component rather than a full authentication bypass, permitting privilege escalation beyond the attacker's intended access scope. Disclosed as part of Oracle's July 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Unauthorized data manipulation and read access in Oracle Contracts Integration (E-Business Suite 12.2.3-12.2.15) is achievable by unauthenticated network attackers over HTTP when a victim user interacts with a crafted request. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) combined with the reported 'Authentication Bypass' tag indicates a web-injection pattern - most likely reflected or stored Cross-Site Scripting - within the Internal Operations component, where a successful attack can pivot beyond the directly vulnerable module to affect adjacent Oracle EBS components due to scope change. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Oracle Contracts Integration within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a network-accessible HTTP endpoint susceptible to exploitation by unauthenticated remote attackers, contingent on high attack complexity and required victim interaction. Successful exploitation yields limited unauthorized read access to a subset of Contracts Integration data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the component. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the AC:H and UI:R constraints substantially lower real-world exploitation likelihood relative to the raw CVSS vector.
Oracle Contracts Integration (E-Business Suite Internal Operations component, versions 12.2.3-12.2.15) exposes a network-accessible authentication bypass that allows unauthenticated remote attackers to create, delete, or modify critical contract data via HTTP. The attack requires high complexity (AC:H), indicating specific timing, system state, or protocol conditions must be satisfied - ruling out trivial mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Authentication Bypass tag combined with PR:N and network exposure makes this a meaningful integrity risk for organizations running Oracle EBS in environments reachable from untrusted networks.
Cross-site scripting or client-side injection in Oracle Contracts Integration (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows unauthenticated remote attackers to compromise victim sessions via crafted HTTP requests requiring user interaction. The CVSS scope-change indicator (S:C) and UI:R flag confirm the attack pivots through a victim's browser to affect a secondary security context, resulting in unauthorized read access to a subset of data and unauthorized write/insert/delete to accessible Contracts Integration data. No public exploit code has been identified at time of analysis, and a patch is available through Oracle's Critical Patch Update for July 2026.
Data tampering and partial denial-of-service in Oracle Contracts Integration (a module of Oracle E-Business Suite, Internal Operations component) affects supported EBS releases 12.2.3 through 12.2.15. An unauthenticated remote attacker who can lure a legitimate user into interacting with a crafted HTTP request can create, delete, or modify all Contracts-Integration-accessible data and partially disrupt the service. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.1.
Data compromise in Oracle Contracts Integration (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read and tamper with all data the module can access over HTTP. Because it is rated easily exploitable with high confidentiality and integrity impact (CVSS 8.1), any authenticated EBS user could pivot to unauthorized creation, deletion, or modification of critical contract data. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is a real but not yet demonstrated concern.
Full compromise of Oracle Payables (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to take over the module via HTTP, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8). Any user holding a valid low-privilege EBS session can escalate to full control of the Payables application. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor language make it a strong patching priority.
Oracle EDI Gateway versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes an information disclosure vulnerability allowing low-privileged network-authenticated attackers to read a subset of EDI transaction data without proper authorization. Tagged as an authentication bypass, the flaw is exploitable over HTTP with low attack complexity and no user interaction required, suggesting an access-control deficiency that permits privilege escalation within the application layer rather than a full bypass of authentication. No public exploit code and no active exploitation have been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Oracle EDI Gateway versions 12.2.3 through 12.2.15 exposes an information disclosure vulnerability via HTTP that enables low-privileged authenticated network attackers to read a subset of EDI transaction data without proper authorization. The vulnerability is tagged 'Authentication Bypass' in threat intelligence sources, yet the CVSS vector assigns PR:L, suggesting the bypass operates within an authenticated session - likely circumventing object-level authorization controls rather than bypassing session authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world urgency moderate despite the vendor's characterization of the flaw as 'easily exploitable.'
Full compromise of Oracle EDI Gateway (a module of Oracle E-Business Suite) is possible where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the component, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, affecting EBS versions 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Limited unauthorized data read in Oracle EDI Gateway (E-Business Suite versions 12.2.3-12.2.15) requires a high-privileged attacker with local logon access to the underlying infrastructure, combined with difficult exploitation conditions, to access a subset of EDI data without authorization. The confidentiality impact is narrow and no integrity or availability impact is present. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the July 2026 Critical Patch Update.
Information disclosure and limited data tampering in Oracle E-Business Suite's Process Manufacturing Logistics module (Internal Operations component) lets a low-privileged, network-based attacker reach critical application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, a successful attack yields full read access to all Process Manufacturing Logistics data plus partial write (insert/update/delete) capability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.
Unauthorized data disclosure in Oracle U.S. Federal Financials (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read a subset of sensitive financial data via HTTP. Versions 12.2.3 through 12.2.15 are confirmed affected. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate-severity information disclosure with no integrity or availability impact.
Oracle Proposals (component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated remote attackers over HTTP, enabling unauthorized read access to a subset of data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the Proposals component. Oracle disclosed this vulnerability in its July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Partial data compromise and denial of service in Oracle Supply Chain Globalization (Oracle E-Business Suite) allows low-privileged authenticated attackers over HTTP to perform unauthorized read, write, and partial availability impacts against the Copy Inventory Organization component. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the E-Business Suite 12.2 release train. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of a credible but not actively weaponized medium-severity vulnerability.
Partial authorization bypass in Oracle Call Center Technology (E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read a subset of sensitive CCT data and perform unauthorized insert, update, or delete operations against that data over HTTP. The RDBMS and UI component fails to enforce access boundaries for authenticated sessions, exposing data integrity and partial confidentiality. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the Oracle Security Alert tag of 'Authentication Bypass' warrants prompt patching in internet-accessible deployments.
Unauthenticated remote exploitation of Oracle Teleservice (E-Business Suite versions 12.2.3 through 12.2.15) via HTTP allows attackers to read a subset of accessible service data and perform unauthorized insert, update, or delete operations against Teleservice records through the Service Diagnostics Scripts component. The vulnerability is tagged as an authentication bypass, indicating the diagnostic scripting interface fails to enforce access controls against unauthenticated callers. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though Oracle's own advisory classifies this as 'easily exploitable,' elevating operational priority for internet-facing EBS deployments.
Unauthorized data access and modification in Oracle Item Master (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by any low-privileged authenticated attacker over HTTP, with no user interaction required. The vulnerability resides in the iSet-up component and enables an attacker to read a subset of Item Master data and perform unauthorized inserts, updates, or deletes beyond their intended authorization scope. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; however, the 'Authentication Bypass' tag suggests an authorization boundary failure that could be straightforward to exploit once an attacker holds any valid account.
Oracle Labor Distribution (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 exposes an authorization bypass in its Internal Operations component, enabling a low-privileged authenticated attacker with network access to read a subset of labor distribution data and perform unauthorized insert, update, or delete operations. The vulnerability is classified as 'easily exploitable' by Oracle with a CVSS 3.1 score of 5.4 (Medium), reflecting low attack complexity and no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; remediation is available via Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Configure to Order (Supply to Order Workbench component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read all data accessible to the application and, because of a scope change, to impact additional Oracle products beyond Configure to Order. Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it was reported through Oracle's own security alert channel for the July 2026 Critical Patch Update.
Cross-site-scripting-style compromise in Oracle MES for Process Manufacturing (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a remote unauthenticated attacker steal or fully read Oracle MES-accessible data and make limited unauthorized changes by luring a legitimate user into interacting with a crafted HTTP request. The scope-changing nature (S:C) means a successful attack can significantly impact products beyond MES itself, typically the victim's authenticated session context. No public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 8.2.
Local privilege-based takeover of Oracle Project Foundation (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with logon access to the host infrastructure to fully compromise the component. Successful exploitation yields high confidentiality, integrity, and availability impact - effectively a complete takeover of Project Foundation. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Performance Management (E-Business Suite, Appraisals component, versions 12.2.3-12.2.15) exposes a network-accessible authorization bypass that allows low-privileged authenticated users to read and manipulate appraisal data beyond their intended access scope via HTTP. Tagged as an Authentication Bypass, the flaw enables partial confidentiality and integrity compromise against a widely-deployed enterprise ERP module. No public exploit code or CISA KEV listing has been identified at time of analysis; disclosure is tied to Oracle's CPU July 2026 advisory cycle.
Unauthorized data access in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker operating over HTTP to read a subset of HR data and perform unauthorized insert, update, or delete operations within the Regression Testing component. The vulnerability is rated CVSS 5.4 Medium with no availability impact, confined to confidentiality and integrity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the source intelligence warrants further investigation given its tension with the PR:L CVSS metric.
Partial denial of service in Oracle Inventory Optimization (E-Business Suite versions 12.2.3 through 12.2.15) can be triggered by a low-privileged attacker over HTTP, causing degraded availability of the User Interface component. The vulnerability carries a CVSS 3.1 base score of 3.1, reflecting high attack complexity and limited impact scope. No public exploit code or active exploitation has been identified at time of analysis, and Oracle addressed this in the July 2026 Critical Patch Update.
Oracle Production Scheduling (E-Business Suite component) exposes an integrity-only vulnerability exploitable exclusively by high-privileged local attackers on the hosting infrastructure, across versions 12.2.3 through 12.2.15. Successful exploitation permits unauthorized write operations - insert, update, or delete - against a subset of the scheduling module's data, with no confidentiality or availability impact. No public exploit code exists and the vulnerability is not listed in CISA KEV; the extremely low CVSS score of 1.9 reflects the steep exploitation barrier imposed by local access and high privilege prerequisites.
Oracle Production Scheduling (versions 12.2.3 through 12.2.15) contains a high-privilege network-exploitable flaw in its Internal Operations component that allows authorized but potentially abusive HTTP requests to bypass internal controls and achieve unauthorized creation, deletion, or modification of critical data, with a documented scope change that can cascade impact into adjacent Oracle E-Business Suite products. The vulnerability is tagged as an Authentication Bypass by both the Oracle reporter (secalert_us@oracle.com) and ENISA EUVD-2026-47260, introducing meaningful ambiguity against the CVSS PR:H designation. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the standard CPU patching priority tier despite the scope change.
Oracle Production Scheduling versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes its Internal Operations component to exploitation by high-privileged remote attackers over HTTP. Successful exploitation yields partial unauthorized read and write access to accessible data alongside a partial denial of service condition. No public exploit code or confirmed active exploitation has been identified at time of analysis; CVSS score of 4.7 (Medium) reflects the significant mitigation from the high-privilege prerequisite.
Oracle Production Scheduling versions 12.2.3 through 12.2.15 in Oracle E-Business Suite exposes a local exploitation path through its Internal Operations component, enabling a low-privileged attacker - given co-presence of a second interacting user - to achieve unauthorized creation, deletion, or modification of critical data with a scope change that can cascade impact to additional Oracle EBS products. Tagged as an authentication bypass by ENISA EUVD-2026-47258, the flaw is addressed in Oracle's Critical Patch Update for July 2026. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full compromise of the Oracle Financials for the Americas module within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) is possible via HTTP by an attacker who already holds high application privileges, leading to complete takeover of the module's confidentiality, integrity, and availability. Oracle rates it CVSS 7.2 and describes it as 'easily exploitable' once the privilege prerequisite is met. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the sole reference is the Oracle July 2026 Critical Patch Update advisory.
Data compromise in Oracle Financials Common Country (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1, the flaw affects EBS versions 12.2.3 through 12.2.15 and impacts confidentiality and integrity but not availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it appears in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle Process Manufacturing Logistics (a module of Oracle E-Business Suite) is possible for a high-privileged attacker who reaches the application over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 score of 8.0 elevated by a scope change (S:C), meaning successful attacks may significantly impact additional Oracle products beyond the vulnerable module. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, though exploitation is rated difficult (AC:H) and requires existing high privileges (PR:H).
Full compromise of Oracle Process Manufacturing Logistics (Internal Operations component of Oracle E-Business Suite) is possible for a high-privileged, authenticated attacker sending crafted HTTP requests, per Oracle's July 2026 Critical Patch Update. Successful attacks yield complete takeover of the module with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Process Manufacturing (OPM) Logistics, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged authenticated attacker with network access over HTTP to read, create, delete, or modify all data accessible to the OPM Logistics component. The flaw is rated CVSS 3.1 8.1 (high) with confidentiality and integrity impact but no availability impact, and was disclosed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Landed Cost Management (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module across supported releases 12.2.3 through 12.2.15. The flaw carries CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and is remediated in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized read and write access to Oracle US Federal Human Resources (the Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-based attacker over HTTP, with no user interaction. Successful exploitation lets the attacker view, create, delete, or modify all data accessible to the module, carrying a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact). Fixed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and no CISA KEV listing.
Data compromise in the Oracle Public Sector Human Resources module of Oracle E-Business Suite (Regression Testing component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify any data accessible to the application. The flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an internet-facing Oracle EBS component it is a plausible target once the July 2026 CPU details are studied.
Data compromise in Oracle Treasury (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all Treasury-accessible data over HTTP. Oracle rates it CVSS 3.1 8.1 (high confidentiality and integrity impact, no availability impact), and it is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access and modification in Oracle Flow Manufacturing (component: Internal Operations) allows a low-privileged, network-adjacent attacker to compromise confidentiality and integrity of Flow Manufacturing data, with a scope change that may impact additional Oracle E-Business Suite products. Affected versions span 12.2.3 through 12.2.15, a wide deployment window covering over a decade of releases. The attack requires human interaction from a victim beyond the attacker, suggesting a social-engineering or UI-based exploitation vector. No public exploit code or CISA KEV listing has been identified at time of analysis; this is a medium-severity finding addressed in Oracle's July 2026 Critical Patch Update.
Cross-product data exposure in Oracle Transportation Execution (E-Business Suite 12.2.3-12.2.15) allows an authenticated low-privileged attacker over HTTP to read and modify a subset of Transportation data while also impacting additional EBS products due to a scope change. The attack requires victim interaction, suggesting a client-side injection vector (consistent with the 'Authentication Bypass' tag and scope change in the CVSS vector), where attacker-controlled content is rendered by another user. Disclosed in Oracle's July 2026 Critical Patch Update with no confirmed public exploit or CISA KEV listing at time of analysis.
Full takeover of Oracle Transportation Execution (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged attacker with only network HTTP access to the application. Any authenticated user account can be leveraged to fully compromise confidentiality, integrity, and availability of the module, per the CVSS 3.1 8.8 vector. No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.
Oracle Labor Distribution, an Internal Operations component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a high-privileged local attacker to compromise data integrity by creating, deleting, or modifying critical application data. Despite carrying an 'Authentication Bypass' tag in available intelligence, the CVSS vector (AV:L/AC:H/PR:H) constrains exploitation to actors who already possess elevated logon access to the underlying infrastructure - suggesting an internal authorization bypass rather than a full authentication circumvention. No public exploit code exists and no active exploitation has been identified; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Partial data integrity compromise in Oracle Labor Distribution (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged attacker with network access via HTTP to perform unauthorized insert, update, or delete operations on some accessible data within the product's Internal Operations component. The 'Authentication Bypass' tag in the intelligence data is notable but conflicts with the PR:L CVSS metric, suggesting this is more accurately an internal authorization bypass within an authenticated session rather than a full bypass of the login mechanism. No public exploit code exists and the vulnerability is not listed in CISA KEV; with a CVSS 3.1 score of 3.1 (Low) and AC:H, this represents a low-priority finding for most environments.
Partial denial-of-service in Oracle Labor Distribution (E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated attackers over HTTP under high-complexity conditions. The vulnerability affects only the availability of the Internal Operations component and yields only a partial availability impact, placing it firmly in the low-severity tier. No public exploit code exists and no active exploitation has been identified at the time of analysis.
Full account takeover of Oracle Labor Distribution (part of Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to affected servers running versions 12.2.3 through 12.2.15. The flaw compromises confidentiality, integrity, and availability of the module and, per Oracle, results in complete takeover of Labor Distribution. No public exploit identified at time of analysis, though the CVSS 8.8 rating and network-reachable, low-complexity nature make it a high-priority patch in the Oracle July 2026 Critical Patch Update.
Full compromise of the Oracle Public Sector Payroll module (Internal Operations component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible for a high-privileged attacker with network HTTP access, yielding complete takeover of the payroll application per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 7.2 with high confidentiality, integrity, and availability impact, but exploitation requires existing high-level privileges (PR:H). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Full compromise of the Oracle Public Sector Payroll module within Oracle E-Business Suite (Internal Operations component) is possible for an already-privileged attacker who can reach the application over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw affects supported EBS releases 12.2.4 through 12.2.15 and, though rated CVSS 7.2, requires high existing privileges (PR:H), which narrows the realistic attacker set to trusted or authenticated users. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in the Public Sector Payroll module (Internal Operations component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with network HTTP access fully compromise the payroll application. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and calls it 'easily exploitable,' meaning a single low-tier authenticated account is enough to seize the module. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and network reach make it a prompt-patch item from the July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Contracts Integration (Internal Operations component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. The flaw carries a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Order Entry in E-Business Suite versions 12.2.3 through 12.2.15 exposes a low-severity local privilege vulnerability in its Internal Operations component, allowing a high-privileged local attacker to perform unauthorized data manipulation and cause partial service disruption. The attack requires physical or logical access to the infrastructure hosting the application and an already-elevated account, significantly constraining real-world exploitability. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at the time of analysis.
Full server takeover in Oracle Mobile Application Server (the MWA component of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a high-privileged, network-based attacker to fully compromise the server over HTTP, impacting confidentiality, integrity and availability (CVSS 3.1 base 7.2). Because the attacker must already hold high privileges (PR:H), this is a privilege-escalation-to-takeover issue rather than a pre-auth breach, and there is no public exploit identified at time of analysis nor CISA KEV listing.
Critical data exposure and tampering in Oracle Citizen Interaction Center (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a high-privileged, network-authenticated attacker to achieve full read and write access to all application data via HTTP. Despite the 'Authentication Bypass' tag, the CVSS PR:H metric indicates exploitation requires an already-authenticated high-privilege account, suggesting an internal authorization control bypass rather than an unauthenticated entry point. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed through Oracle's Critical Patch Update for July 2026.
SQL-layer compromise in Oracle Demand Signal Repository (part of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High), the flaw yields full confidentiality and integrity impact but no availability impact. No public exploit is identified at time of analysis and it is not in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Unauthorized data disclosure in Oracle Supply Chain Trading Connector (E-Business Suite versions 12.2.3 through 12.2.15) exposes all connector-accessible data to low-privileged authenticated network attackers via HTTP. The Collaboration History component fails to enforce proper authorization controls, enabling a valid but low-privileged account to read critical trading data beyond its intended scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and straightforward network vector make this a realistic insider or credential-compromise escalation path.
Oracle Supply Chain Trading Connector versions 12.2.3 through 12.2.15 expose the Collaboration History component to unauthorized data access and service degradation by any authenticated network user over HTTP. Low-privileged attackers can read a subset of accessible records and perform unauthorized inserts, updates, and deletes, as well as cause a partial denial of service. No public exploit code and no CISA KEV listing exist at time of analysis, but Oracle's own advisory classifies this as 'Easily exploitable,' indicating minimal preconditions beyond valid credentials.
Unauthenticated data compromise in Oracle Supply Chain Trading Connector (Collaboration History component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows remote attackers to read all data accessible to the product over HTTP and make limited unauthorized modifications. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.2, the flaw is tagged as an authentication bypass and requires no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network exposure make it a strong patching priority for EBS operators.
Integrity compromise in Oracle E-Business Intelligence (component: Definition) affects versions 12.2.3 through 12.2.15, disclosed as part of Oracle's Critical Patch Update July 2026. A network-accessible, high-privileged attacker who can also induce victim interaction may perform unauthorized insert, update, or delete operations on a subset of accessible E-Business Intelligence data. The CVSS base score of 2.0 reflects the highly constrained exploitation requirements: high attack complexity, high privilege level, and mandatory user interaction, all of which drastically limit real-world exploitation probability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site scripting or client-side injection in Oracle E-Business Intelligence 12.2.3 through 12.2.15 enables unauthenticated remote attackers to read a subset of accessible data and perform unauthorized data modifications when a victim user interacts with a crafted HTTP request. The scope change (S:C in CVSS) indicates successful exploitation extends impact beyond the vulnerable component - characteristic of a browser-context attack such as reflected XSS through the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the tagging as 'Authentication Bypass' alongside PR:N merits close attention in enterprise deployments.
Oracle E-Business Intelligence versions 12.2.3 through 12.2.15 contains a flaw in its Internal Operations component that, under high-complexity conditions, permits a network-accessible highly privileged attacker to gain unauthorized read and write access to critical business intelligence data. Despite high confidentiality and integrity impact metrics, the overall CVSS 3.1 score of 5.9 reflects the mitigating effects of AC:H and PR:H, meaning exploitation is neither trivial nor broadly accessible. Notably, the 'Authentication Bypass' tag attached to this vulnerability is in tension with the PR:H CVSS metric, suggesting the bypass may circumvent a secondary authorization layer rather than the initial authentication mechanism - no public exploit or CISA KEV listing has been identified at time of analysis.
Sensitive data exposure in Oracle Compensation Workbench (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read all data accessible to the component and perform limited unauthorized inserts, updates, or deletes over HTTP. Rated CVSS 7.1 (C:H/I:L/A:N), it was disclosed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not on CISA KEV, though EBS is a high-value target and Oracle CPU flaws have historically drawn attacker interest.
Unauthorized data access in Oracle E-Business Suite's Compensation Workbench component (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to read all data accessible to the module and to modify some of it. Oracle rates this CVSS 7.1 (C:H/I:L). No public exploit is identified at time of analysis and it is not listed in CISA KEV, though it was disclosed in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle E-Business Suite's Pasta component (Internal Operations) is achievable by a high-privileged attacker with local logon access to the host infrastructure running versions 12.2.3 through 12.2.15. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the Pasta service, consistent with the tags noting Information Disclosure as a primary impact vector alongside full control. Patched in Oracle Critical Patch Update July 2026; no public exploit identified at time of analysis and the component is not listed in CISA KEV.
Data tampering in Oracle E-Business Suite's Financials Common Modules (Common Components) lets a low-privileged, network-authenticated attacker perform unauthorized creation, deletion, and modification of critical financial data across all module-accessible records, plus read access to a subset of that data. Affected releases span 12.2.3 through 12.2.15, remediated in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though the tag 'Authentication Bypass' warrants scrutiny given the authenticated CVSS profile.
Data compromise in Oracle Complex Maintenance, Repair and Overhaul (cMRO), a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged authenticated attacker with HTTP network access to read and modify critical application data. The flaw affects the Internal Operations component and yields high confidentiality and integrity impact (CVSS 8.1) with no availability effect. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Financials Common Modules (Common Components) within Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Oracle rates it CVSS 3.1 8.1 (high confidentiality and integrity impact, no availability impact) and tags it as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle EDI Gateway (a component of Oracle E-Business Suite) is possible by an unauthenticated remote attacker over HTTP, affecting supported versions 12.2.3 through 12.2.15 per Oracle's July 2026 Critical Patch Update. Despite full confidentiality, integrity, and availability impact (CVSS 8.1), the CVSS vector rates attack complexity as high (AC:H), indicating exploitation is not trivial. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Assets (part of Oracle E-Business Suite, Internal Operations component) is achievable by a high-privileged, network-adjacent attacker over HTTP, per the Oracle July 2026 Critical Patch Update. With a CVSS 3.1 base score of 7.2 (C:H/I:H/A:H) and no user interaction required, successful exploitation results in complete takeover of Oracle Assets across supported releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Assets (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all Oracle Assets-accessible data. The CVSS 3.1 base score is 8.1 with high confidentiality and integrity impact but no availability impact, reflecting a data-integrity and disclosure risk rather than a service outage. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Cash Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, it was reported by Oracle and disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though low attack complexity and network reachability make it a notable patch priority for EBS operators.
Unauthorized data compromise in Oracle E-Business Intelligence (Definition component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the product. The CVSS 3.1 vector (8.1) reflects High confidentiality and integrity impact with no availability effect, meaning an authenticated user can escalate their reach to critical business intelligence data without needing elevated roles. No public exploit identified at time of analysis, and the flaw is addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle EDI Gateway (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all EDI Gateway-accessible data, including critical data. Rated CVSS 8.1, the flaw is disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass-class issue; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Process Manufacturing Financials (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated low-privileged network exploitation of Oracle Financials for Asia/Pacific (versions 12.2.3-12.2.15) enables unauthorized creation, deletion, or modification of critical financial data, with partial read access to additional records. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is reachable over HTTP without user interaction. No public exploit or active KEV listing has been identified at time of analysis, though Oracle classifies it as 'easily exploitable,' and the 'Authentication Bypass' tag suggests the low-privilege requirement may be bypassed or trivially satisfied under certain conditions.
Full system takeover of Oracle Call Center Technology - a component of Oracle E-Business Suite - is achievable by unauthenticated remote attackers via HTTP across versions 12.2.3 through 12.2.15, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The high attack complexity (AC:H) designation indicates that exploitation requires satisfying non-trivial preconditions beyond mere network reachability, but no authentication or user interaction is necessary, keeping the attack surface entirely external. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover is achievable in Oracle Call Center Technology (versions 12.2.3-12.2.15) by a low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The vendor describes this as 'easily exploitable' and confirms full Confidentiality, Integrity, and Availability compromise - consistent with a CVSS 8.8 High rating and system takeover outcome. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal privilege threshold lower the bar for exploitation significantly. Notably, the vulnerability tag 'Information Disclosure' understates the confirmed impact scope, which extends to full takeover.
Oracle Call Center Technology versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes a flaw in the Internal Operations component that allows a low-privileged authenticated network attacker to fully compromise the affected system via HTTP. The vendor-assigned CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability - consistent with the described 'takeover' outcome. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Unauthorized data access in Oracle Call Center Technology (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged remote attacker to gain complete read access to all data accessible by the application and limited write capability via HTTP, with a confirmed scope change enabling cascading impact on additional E-Business Suite components. The EUVD tags this as an Authentication Bypass, suggesting the Internal Operations component fails to enforce sufficient authorization boundaries for low-privilege accounts despite requiring initial authentication. No public exploit has been identified at time of analysis; this vulnerability was disclosed as part of Oracle's Critical Patch Update for August 2026.
Unauthorized data disclosure in Oracle Financials Common Modules (Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged authenticated attacker with HTTP network access to bypass access controls in the Common Components layer, gaining unauthorized read access to critical or complete financial data. The scope change (S:C) confirmed in the CVSS vector means successful exploitation can cascade into data exposure across additional Oracle EBS products beyond the directly vulnerable module. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this a straightforward exploitation path for any authenticated EBS user.
Full takeover of Oracle U.S. Federal Financials (versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker over HTTP, with successful exploitation resulting in complete compromise of confidentiality, integrity, and availability. The Internal Operations component within Oracle E-Business Suite exposes this attack surface to any authenticated network user, requiring no user interaction and no elevated permissions beyond a basic account. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and high impact make this a priority patching target for affected federal agencies.
Oracle Succession Planning within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a medium-severity, network-exploitable vulnerability in the Succession Plan component that allows low-privileged attackers to read, modify, or partially disrupt succession planning data via HTTP. The CVSS 3.1 vector confirms low attack complexity with no user interaction required, making exploitation straightforward for any authenticated EBS user. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Data tampering and partial denial-of-service in Oracle Production Scheduling (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker over HTTP create, delete, or modify critical data - with additional limited read access and a partial DoS. Oracle rates it CVSS 3.1 7.6, driven primarily by high integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-during-normal-cycle priority rather than an emergency.
Unauthorized access to critical data in Oracle Production Scheduling (versions 12.2.3 through 12.2.15) is achievable by unauthenticated remote attackers via a network-based authentication bypass in the Internal Operations component, though exploitation requires high attack complexity and human interaction from a third party. The confidentiality impact is complete - attackers can access all data accessible to Production Scheduling - while integrity and availability remain unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.
Privileged data compromise in Oracle Advanced Planning Command Center (Oracle E-Business Suite Internal Operations component, versions 12.2.3 through 12.2.15) lets an already high-privileged attacker with network HTTP access read all APCC-accessible data and perform limited unauthorized modifications. Because the flaw carries a scope change, successful attacks may significantly impact additional products beyond APCC itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.6; no public exploit identified at time of analysis.
Data compromise in Oracle Process Manufacturing Regulatory Management (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the component. Oracle rates it CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not in CISA KEV; an 'Authentication Bypass' tag is noted in intelligence sources but is not corroborated by the CVSS vector, which requires low privileges (PR:L).
Unauthorized critical-data access in Oracle E-Business Suite's Process Manufacturing Regulatory Management module (component: Internal Operations) allows a low-privileged, network-authenticated attacker to compromise the module over HTTP, with a scope change that may significantly impact additional Oracle products. Oracle rates it CVSS 3.1 8.5, reflecting high confidentiality impact plus limited integrity impact across a changed scope. There is no public exploit identified and it is not in CISA KEV, but Oracle self-reported it and shipped a fix in the July 2026 Critical Patch Update.
Full compromise (takeover) of Oracle Process Manufacturing Process Execution 12.2.15, a module of Oracle E-Business Suite (component: Internal Operations), is achievable by a low-privileged, authenticated attacker over HTTP. Successful exploitation yields high confidentiality, integrity, and availability impact against the module, though Oracle rates the attack complexity as high ('difficult to exploit'). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Takeover of Oracle Purchasing (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged, network-authenticated attacker in supported releases 12.2.11 through 12.2.15. Successful attacks yield full confidentiality, integrity, and availability compromise of the Purchasing application per Oracle's July 2026 Critical Patch Update. Exploitation is rated high-complexity (AC:H), and no public exploit identified at time of analysis; the issue was reported internally by Oracle's security alert team rather than a public researcher.
Confidential data exposure in Oracle Contracts Integration (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker with HTTP network access to bypass internal authorization controls in the Internal Operations component, gaining unauthorized access to critical or all accessible contract data. The CVSS confidentiality impact is rated High despite the moderate overall score of 5.3, reflecting complete in-scope data exposure when exploitation succeeds. No public exploit code or active exploitation has been identified at time of analysis; the high attack complexity (AC:H) constrains real-world opportunistic risk.
Partial authorization bypass in Oracle Contracts Integration (Oracle E-Business Suite 12.2.3-12.2.15) allows an authenticated low-privileged network attacker to perform unauthorized read, insert, update, or delete operations against a subset of contract data via HTTP under high-complexity conditions. Tagged as an Authentication Bypass, suggesting the flaw permits a low-privileged session to exceed its intended access boundary within the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity substantially limits opportunistic exploitation.
Unauthorized data manipulation in Oracle Contracts Integration (versions 12.2.3-12.2.15) allows a low-privileged authenticated attacker over HTTP to create, delete, or modify critical contract data without proper authorization. The 'Authentication Bypass' tag in source intelligence conflicts with the CVSS PR:L metric - this appears to be an authorization bypass within the Internal Operations component rather than a full authentication bypass, permitting privilege escalation beyond the attacker's intended access scope. Disclosed as part of Oracle's July 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Unauthorized data manipulation and read access in Oracle Contracts Integration (E-Business Suite 12.2.3-12.2.15) is achievable by unauthenticated network attackers over HTTP when a victim user interacts with a crafted request. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) combined with the reported 'Authentication Bypass' tag indicates a web-injection pattern - most likely reflected or stored Cross-Site Scripting - within the Internal Operations component, where a successful attack can pivot beyond the directly vulnerable module to affect adjacent Oracle EBS components due to scope change. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Oracle Contracts Integration within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a network-accessible HTTP endpoint susceptible to exploitation by unauthenticated remote attackers, contingent on high attack complexity and required victim interaction. Successful exploitation yields limited unauthorized read access to a subset of Contracts Integration data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the component. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the AC:H and UI:R constraints substantially lower real-world exploitation likelihood relative to the raw CVSS vector.
Oracle Contracts Integration (E-Business Suite Internal Operations component, versions 12.2.3-12.2.15) exposes a network-accessible authentication bypass that allows unauthenticated remote attackers to create, delete, or modify critical contract data via HTTP. The attack requires high complexity (AC:H), indicating specific timing, system state, or protocol conditions must be satisfied - ruling out trivial mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Authentication Bypass tag combined with PR:N and network exposure makes this a meaningful integrity risk for organizations running Oracle EBS in environments reachable from untrusted networks.
Cross-site scripting or client-side injection in Oracle Contracts Integration (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows unauthenticated remote attackers to compromise victim sessions via crafted HTTP requests requiring user interaction. The CVSS scope-change indicator (S:C) and UI:R flag confirm the attack pivots through a victim's browser to affect a secondary security context, resulting in unauthorized read access to a subset of data and unauthorized write/insert/delete to accessible Contracts Integration data. No public exploit code has been identified at time of analysis, and a patch is available through Oracle's Critical Patch Update for July 2026.
Data tampering and partial denial-of-service in Oracle Contracts Integration (a module of Oracle E-Business Suite, Internal Operations component) affects supported EBS releases 12.2.3 through 12.2.15. An unauthenticated remote attacker who can lure a legitimate user into interacting with a crafted HTTP request can create, delete, or modify all Contracts-Integration-accessible data and partially disrupt the service. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.1.
Data compromise in Oracle Contracts Integration (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read and tamper with all data the module can access over HTTP. Because it is rated easily exploitable with high confidentiality and integrity impact (CVSS 8.1), any authenticated EBS user could pivot to unauthorized creation, deletion, or modification of critical contract data. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is a real but not yet demonstrated concern.
Full compromise of Oracle Payables (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to take over the module via HTTP, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8). Any user holding a valid low-privilege EBS session can escalate to full control of the Payables application. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor language make it a strong patching priority.
Oracle EDI Gateway versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes an information disclosure vulnerability allowing low-privileged network-authenticated attackers to read a subset of EDI transaction data without proper authorization. Tagged as an authentication bypass, the flaw is exploitable over HTTP with low attack complexity and no user interaction required, suggesting an access-control deficiency that permits privilege escalation within the application layer rather than a full bypass of authentication. No public exploit code and no active exploitation have been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Oracle EDI Gateway versions 12.2.3 through 12.2.15 exposes an information disclosure vulnerability via HTTP that enables low-privileged authenticated network attackers to read a subset of EDI transaction data without proper authorization. The vulnerability is tagged 'Authentication Bypass' in threat intelligence sources, yet the CVSS vector assigns PR:L, suggesting the bypass operates within an authenticated session - likely circumventing object-level authorization controls rather than bypassing session authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world urgency moderate despite the vendor's characterization of the flaw as 'easily exploitable.'
Full compromise of Oracle EDI Gateway (a module of Oracle E-Business Suite) is possible where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the component, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, affecting EBS versions 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Limited unauthorized data read in Oracle EDI Gateway (E-Business Suite versions 12.2.3-12.2.15) requires a high-privileged attacker with local logon access to the underlying infrastructure, combined with difficult exploitation conditions, to access a subset of EDI data without authorization. The confidentiality impact is narrow and no integrity or availability impact is present. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the July 2026 Critical Patch Update.
Information disclosure and limited data tampering in Oracle E-Business Suite's Process Manufacturing Logistics module (Internal Operations component) lets a low-privileged, network-based attacker reach critical application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, a successful attack yields full read access to all Process Manufacturing Logistics data plus partial write (insert/update/delete) capability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.
Unauthorized data disclosure in Oracle U.S. Federal Financials (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read a subset of sensitive financial data via HTTP. Versions 12.2.3 through 12.2.15 are confirmed affected. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate-severity information disclosure with no integrity or availability impact.
Oracle Proposals (component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated remote attackers over HTTP, enabling unauthorized read access to a subset of data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the Proposals component. Oracle disclosed this vulnerability in its July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Partial data compromise and denial of service in Oracle Supply Chain Globalization (Oracle E-Business Suite) allows low-privileged authenticated attackers over HTTP to perform unauthorized read, write, and partial availability impacts against the Copy Inventory Organization component. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the E-Business Suite 12.2 release train. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of a credible but not actively weaponized medium-severity vulnerability.
Partial authorization bypass in Oracle Call Center Technology (E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read a subset of sensitive CCT data and perform unauthorized insert, update, or delete operations against that data over HTTP. The RDBMS and UI component fails to enforce access boundaries for authenticated sessions, exposing data integrity and partial confidentiality. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the Oracle Security Alert tag of 'Authentication Bypass' warrants prompt patching in internet-accessible deployments.
Unauthenticated remote exploitation of Oracle Teleservice (E-Business Suite versions 12.2.3 through 12.2.15) via HTTP allows attackers to read a subset of accessible service data and perform unauthorized insert, update, or delete operations against Teleservice records through the Service Diagnostics Scripts component. The vulnerability is tagged as an authentication bypass, indicating the diagnostic scripting interface fails to enforce access controls against unauthenticated callers. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though Oracle's own advisory classifies this as 'easily exploitable,' elevating operational priority for internet-facing EBS deployments.
Unauthorized data access and modification in Oracle Item Master (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by any low-privileged authenticated attacker over HTTP, with no user interaction required. The vulnerability resides in the iSet-up component and enables an attacker to read a subset of Item Master data and perform unauthorized inserts, updates, or deletes beyond their intended authorization scope. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; however, the 'Authentication Bypass' tag suggests an authorization boundary failure that could be straightforward to exploit once an attacker holds any valid account.
Oracle Labor Distribution (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 exposes an authorization bypass in its Internal Operations component, enabling a low-privileged authenticated attacker with network access to read a subset of labor distribution data and perform unauthorized insert, update, or delete operations. The vulnerability is classified as 'easily exploitable' by Oracle with a CVSS 3.1 score of 5.4 (Medium), reflecting low attack complexity and no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; remediation is available via Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Configure to Order (Supply to Order Workbench component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read all data accessible to the application and, because of a scope change, to impact additional Oracle products beyond Configure to Order. Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it was reported through Oracle's own security alert channel for the July 2026 Critical Patch Update.
Cross-site-scripting-style compromise in Oracle MES for Process Manufacturing (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a remote unauthenticated attacker steal or fully read Oracle MES-accessible data and make limited unauthorized changes by luring a legitimate user into interacting with a crafted HTTP request. The scope-changing nature (S:C) means a successful attack can significantly impact products beyond MES itself, typically the victim's authenticated session context. No public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 8.2.
Local privilege-based takeover of Oracle Project Foundation (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with logon access to the host infrastructure to fully compromise the component. Successful exploitation yields high confidentiality, integrity, and availability impact - effectively a complete takeover of Project Foundation. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Performance Management (E-Business Suite, Appraisals component, versions 12.2.3-12.2.15) exposes a network-accessible authorization bypass that allows low-privileged authenticated users to read and manipulate appraisal data beyond their intended access scope via HTTP. Tagged as an Authentication Bypass, the flaw enables partial confidentiality and integrity compromise against a widely-deployed enterprise ERP module. No public exploit code or CISA KEV listing has been identified at time of analysis; disclosure is tied to Oracle's CPU July 2026 advisory cycle.
Unauthorized data access in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker operating over HTTP to read a subset of HR data and perform unauthorized insert, update, or delete operations within the Regression Testing component. The vulnerability is rated CVSS 5.4 Medium with no availability impact, confined to confidentiality and integrity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the source intelligence warrants further investigation given its tension with the PR:L CVSS metric.
Partial denial of service in Oracle Inventory Optimization (E-Business Suite versions 12.2.3 through 12.2.15) can be triggered by a low-privileged attacker over HTTP, causing degraded availability of the User Interface component. The vulnerability carries a CVSS 3.1 base score of 3.1, reflecting high attack complexity and limited impact scope. No public exploit code or active exploitation has been identified at time of analysis, and Oracle addressed this in the July 2026 Critical Patch Update.
Oracle Production Scheduling (E-Business Suite component) exposes an integrity-only vulnerability exploitable exclusively by high-privileged local attackers on the hosting infrastructure, across versions 12.2.3 through 12.2.15. Successful exploitation permits unauthorized write operations - insert, update, or delete - against a subset of the scheduling module's data, with no confidentiality or availability impact. No public exploit code exists and the vulnerability is not listed in CISA KEV; the extremely low CVSS score of 1.9 reflects the steep exploitation barrier imposed by local access and high privilege prerequisites.
Oracle Production Scheduling (versions 12.2.3 through 12.2.15) contains a high-privilege network-exploitable flaw in its Internal Operations component that allows authorized but potentially abusive HTTP requests to bypass internal controls and achieve unauthorized creation, deletion, or modification of critical data, with a documented scope change that can cascade impact into adjacent Oracle E-Business Suite products. The vulnerability is tagged as an Authentication Bypass by both the Oracle reporter (secalert_us@oracle.com) and ENISA EUVD-2026-47260, introducing meaningful ambiguity against the CVSS PR:H designation. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the standard CPU patching priority tier despite the scope change.
Oracle Production Scheduling versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes its Internal Operations component to exploitation by high-privileged remote attackers over HTTP. Successful exploitation yields partial unauthorized read and write access to accessible data alongside a partial denial of service condition. No public exploit code or confirmed active exploitation has been identified at time of analysis; CVSS score of 4.7 (Medium) reflects the significant mitigation from the high-privilege prerequisite.
Oracle Production Scheduling versions 12.2.3 through 12.2.15 in Oracle E-Business Suite exposes a local exploitation path through its Internal Operations component, enabling a low-privileged attacker - given co-presence of a second interacting user - to achieve unauthorized creation, deletion, or modification of critical data with a scope change that can cascade impact to additional Oracle EBS products. Tagged as an authentication bypass by ENISA EUVD-2026-47258, the flaw is addressed in Oracle's Critical Patch Update for July 2026. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full compromise of the Oracle Financials for the Americas module within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) is possible via HTTP by an attacker who already holds high application privileges, leading to complete takeover of the module's confidentiality, integrity, and availability. Oracle rates it CVSS 7.2 and describes it as 'easily exploitable' once the privilege prerequisite is met. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the sole reference is the Oracle July 2026 Critical Patch Update advisory.
Data compromise in Oracle Financials Common Country (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1, the flaw affects EBS versions 12.2.3 through 12.2.15 and impacts confidentiality and integrity but not availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it appears in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle Process Manufacturing Logistics (a module of Oracle E-Business Suite) is possible for a high-privileged attacker who reaches the application over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 score of 8.0 elevated by a scope change (S:C), meaning successful attacks may significantly impact additional Oracle products beyond the vulnerable module. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, though exploitation is rated difficult (AC:H) and requires existing high privileges (PR:H).
Full compromise of Oracle Process Manufacturing Logistics (Internal Operations component of Oracle E-Business Suite) is possible for a high-privileged, authenticated attacker sending crafted HTTP requests, per Oracle's July 2026 Critical Patch Update. Successful attacks yield complete takeover of the module with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Process Manufacturing (OPM) Logistics, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged authenticated attacker with network access over HTTP to read, create, delete, or modify all data accessible to the OPM Logistics component. The flaw is rated CVSS 3.1 8.1 (high) with confidentiality and integrity impact but no availability impact, and was disclosed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Landed Cost Management (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module across supported releases 12.2.3 through 12.2.15. The flaw carries CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and is remediated in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized read and write access to Oracle US Federal Human Resources (the Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-based attacker over HTTP, with no user interaction. Successful exploitation lets the attacker view, create, delete, or modify all data accessible to the module, carrying a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact). Fixed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and no CISA KEV listing.
Data compromise in the Oracle Public Sector Human Resources module of Oracle E-Business Suite (Regression Testing component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify any data accessible to the application. The flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an internet-facing Oracle EBS component it is a plausible target once the July 2026 CPU details are studied.
Data compromise in Oracle Treasury (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all Treasury-accessible data over HTTP. Oracle rates it CVSS 3.1 8.1 (high confidentiality and integrity impact, no availability impact), and it is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access and modification in Oracle Flow Manufacturing (component: Internal Operations) allows a low-privileged, network-adjacent attacker to compromise confidentiality and integrity of Flow Manufacturing data, with a scope change that may impact additional Oracle E-Business Suite products. Affected versions span 12.2.3 through 12.2.15, a wide deployment window covering over a decade of releases. The attack requires human interaction from a victim beyond the attacker, suggesting a social-engineering or UI-based exploitation vector. No public exploit code or CISA KEV listing has been identified at time of analysis; this is a medium-severity finding addressed in Oracle's July 2026 Critical Patch Update.
Cross-product data exposure in Oracle Transportation Execution (E-Business Suite 12.2.3-12.2.15) allows an authenticated low-privileged attacker over HTTP to read and modify a subset of Transportation data while also impacting additional EBS products due to a scope change. The attack requires victim interaction, suggesting a client-side injection vector (consistent with the 'Authentication Bypass' tag and scope change in the CVSS vector), where attacker-controlled content is rendered by another user. Disclosed in Oracle's July 2026 Critical Patch Update with no confirmed public exploit or CISA KEV listing at time of analysis.
Full takeover of Oracle Transportation Execution (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged attacker with only network HTTP access to the application. Any authenticated user account can be leveraged to fully compromise confidentiality, integrity, and availability of the module, per the CVSS 3.1 8.8 vector. No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.
Oracle Labor Distribution, an Internal Operations component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a high-privileged local attacker to compromise data integrity by creating, deleting, or modifying critical application data. Despite carrying an 'Authentication Bypass' tag in available intelligence, the CVSS vector (AV:L/AC:H/PR:H) constrains exploitation to actors who already possess elevated logon access to the underlying infrastructure - suggesting an internal authorization bypass rather than a full authentication circumvention. No public exploit code exists and no active exploitation has been identified; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Partial data integrity compromise in Oracle Labor Distribution (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged attacker with network access via HTTP to perform unauthorized insert, update, or delete operations on some accessible data within the product's Internal Operations component. The 'Authentication Bypass' tag in the intelligence data is notable but conflicts with the PR:L CVSS metric, suggesting this is more accurately an internal authorization bypass within an authenticated session rather than a full bypass of the login mechanism. No public exploit code exists and the vulnerability is not listed in CISA KEV; with a CVSS 3.1 score of 3.1 (Low) and AC:H, this represents a low-priority finding for most environments.
Partial denial-of-service in Oracle Labor Distribution (E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated attackers over HTTP under high-complexity conditions. The vulnerability affects only the availability of the Internal Operations component and yields only a partial availability impact, placing it firmly in the low-severity tier. No public exploit code exists and no active exploitation has been identified at the time of analysis.
Full account takeover of Oracle Labor Distribution (part of Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to affected servers running versions 12.2.3 through 12.2.15. The flaw compromises confidentiality, integrity, and availability of the module and, per Oracle, results in complete takeover of Labor Distribution. No public exploit identified at time of analysis, though the CVSS 8.8 rating and network-reachable, low-complexity nature make it a high-priority patch in the Oracle July 2026 Critical Patch Update.
Full compromise of the Oracle Public Sector Payroll module (Internal Operations component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible for a high-privileged attacker with network HTTP access, yielding complete takeover of the payroll application per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 7.2 with high confidentiality, integrity, and availability impact, but exploitation requires existing high-level privileges (PR:H). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Full compromise of the Oracle Public Sector Payroll module within Oracle E-Business Suite (Internal Operations component) is possible for an already-privileged attacker who can reach the application over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw affects supported EBS releases 12.2.4 through 12.2.15 and, though rated CVSS 7.2, requires high existing privileges (PR:H), which narrows the realistic attacker set to trusted or authenticated users. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in the Public Sector Payroll module (Internal Operations component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with network HTTP access fully compromise the payroll application. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and calls it 'easily exploitable,' meaning a single low-tier authenticated account is enough to seize the module. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and network reach make it a prompt-patch item from the July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Contracts Integration (Internal Operations component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. The flaw carries a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Order Entry in E-Business Suite versions 12.2.3 through 12.2.15 exposes a low-severity local privilege vulnerability in its Internal Operations component, allowing a high-privileged local attacker to perform unauthorized data manipulation and cause partial service disruption. The attack requires physical or logical access to the infrastructure hosting the application and an already-elevated account, significantly constraining real-world exploitability. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at the time of analysis.
Full server takeover in Oracle Mobile Application Server (the MWA component of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a high-privileged, network-based attacker to fully compromise the server over HTTP, impacting confidentiality, integrity and availability (CVSS 3.1 base 7.2). Because the attacker must already hold high privileges (PR:H), this is a privilege-escalation-to-takeover issue rather than a pre-auth breach, and there is no public exploit identified at time of analysis nor CISA KEV listing.
Critical data exposure and tampering in Oracle Citizen Interaction Center (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a high-privileged, network-authenticated attacker to achieve full read and write access to all application data via HTTP. Despite the 'Authentication Bypass' tag, the CVSS PR:H metric indicates exploitation requires an already-authenticated high-privilege account, suggesting an internal authorization control bypass rather than an unauthenticated entry point. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed through Oracle's Critical Patch Update for July 2026.
SQL-layer compromise in Oracle Demand Signal Repository (part of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High), the flaw yields full confidentiality and integrity impact but no availability impact. No public exploit is identified at time of analysis and it is not in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Unauthorized data disclosure in Oracle Supply Chain Trading Connector (E-Business Suite versions 12.2.3 through 12.2.15) exposes all connector-accessible data to low-privileged authenticated network attackers via HTTP. The Collaboration History component fails to enforce proper authorization controls, enabling a valid but low-privileged account to read critical trading data beyond its intended scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and straightforward network vector make this a realistic insider or credential-compromise escalation path.
Oracle Supply Chain Trading Connector versions 12.2.3 through 12.2.15 expose the Collaboration History component to unauthorized data access and service degradation by any authenticated network user over HTTP. Low-privileged attackers can read a subset of accessible records and perform unauthorized inserts, updates, and deletes, as well as cause a partial denial of service. No public exploit code and no CISA KEV listing exist at time of analysis, but Oracle's own advisory classifies this as 'Easily exploitable,' indicating minimal preconditions beyond valid credentials.
Unauthenticated data compromise in Oracle Supply Chain Trading Connector (Collaboration History component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows remote attackers to read all data accessible to the product over HTTP and make limited unauthorized modifications. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.2, the flaw is tagged as an authentication bypass and requires no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network exposure make it a strong patching priority for EBS operators.
Integrity compromise in Oracle E-Business Intelligence (component: Definition) affects versions 12.2.3 through 12.2.15, disclosed as part of Oracle's Critical Patch Update July 2026. A network-accessible, high-privileged attacker who can also induce victim interaction may perform unauthorized insert, update, or delete operations on a subset of accessible E-Business Intelligence data. The CVSS base score of 2.0 reflects the highly constrained exploitation requirements: high attack complexity, high privilege level, and mandatory user interaction, all of which drastically limit real-world exploitation probability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site scripting or client-side injection in Oracle E-Business Intelligence 12.2.3 through 12.2.15 enables unauthenticated remote attackers to read a subset of accessible data and perform unauthorized data modifications when a victim user interacts with a crafted HTTP request. The scope change (S:C in CVSS) indicates successful exploitation extends impact beyond the vulnerable component - characteristic of a browser-context attack such as reflected XSS through the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the tagging as 'Authentication Bypass' alongside PR:N merits close attention in enterprise deployments.
Oracle E-Business Intelligence versions 12.2.3 through 12.2.15 contains a flaw in its Internal Operations component that, under high-complexity conditions, permits a network-accessible highly privileged attacker to gain unauthorized read and write access to critical business intelligence data. Despite high confidentiality and integrity impact metrics, the overall CVSS 3.1 score of 5.9 reflects the mitigating effects of AC:H and PR:H, meaning exploitation is neither trivial nor broadly accessible. Notably, the 'Authentication Bypass' tag attached to this vulnerability is in tension with the PR:H CVSS metric, suggesting the bypass may circumvent a secondary authorization layer rather than the initial authentication mechanism - no public exploit or CISA KEV listing has been identified at time of analysis.
Sensitive data exposure in Oracle Compensation Workbench (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read all data accessible to the component and perform limited unauthorized inserts, updates, or deletes over HTTP. Rated CVSS 7.1 (C:H/I:L/A:N), it was disclosed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not on CISA KEV, though EBS is a high-value target and Oracle CPU flaws have historically drawn attacker interest.
Unauthorized data access in Oracle E-Business Suite's Compensation Workbench component (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to read all data accessible to the module and to modify some of it. Oracle rates this CVSS 7.1 (C:H/I:L). No public exploit is identified at time of analysis and it is not listed in CISA KEV, though it was disclosed in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle E-Business Suite's Pasta component (Internal Operations) is achievable by a high-privileged attacker with local logon access to the host infrastructure running versions 12.2.3 through 12.2.15. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the Pasta service, consistent with the tags noting Information Disclosure as a primary impact vector alongside full control. Patched in Oracle Critical Patch Update July 2026; no public exploit identified at time of analysis and the component is not listed in CISA KEV.
Data tampering in Oracle E-Business Suite's Financials Common Modules (Common Components) lets a low-privileged, network-authenticated attacker perform unauthorized creation, deletion, and modification of critical financial data across all module-accessible records, plus read access to a subset of that data. Affected releases span 12.2.3 through 12.2.15, remediated in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though the tag 'Authentication Bypass' warrants scrutiny given the authenticated CVSS profile.
Data compromise in Oracle Complex Maintenance, Repair and Overhaul (cMRO), a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged authenticated attacker with HTTP network access to read and modify critical application data. The flaw affects the Internal Operations component and yields high confidentiality and integrity impact (CVSS 8.1) with no availability effect. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Financials Common Modules (Common Components) within Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Oracle rates it CVSS 3.1 8.1 (high confidentiality and integrity impact, no availability impact) and tags it as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle EDI Gateway (a component of Oracle E-Business Suite) is possible by an unauthenticated remote attacker over HTTP, affecting supported versions 12.2.3 through 12.2.15 per Oracle's July 2026 Critical Patch Update. Despite full confidentiality, integrity, and availability impact (CVSS 8.1), the CVSS vector rates attack complexity as high (AC:H), indicating exploitation is not trivial. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Assets (part of Oracle E-Business Suite, Internal Operations component) is achievable by a high-privileged, network-adjacent attacker over HTTP, per the Oracle July 2026 Critical Patch Update. With a CVSS 3.1 base score of 7.2 (C:H/I:H/A:H) and no user interaction required, successful exploitation results in complete takeover of Oracle Assets across supported releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Assets (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all Oracle Assets-accessible data. The CVSS 3.1 base score is 8.1 with high confidentiality and integrity impact but no availability impact, reflecting a data-integrity and disclosure risk rather than a service outage. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Cash Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, it was reported by Oracle and disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though low attack complexity and network reachability make it a notable patch priority for EBS operators.
Unauthorized data compromise in Oracle E-Business Intelligence (Definition component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the product. The CVSS 3.1 vector (8.1) reflects High confidentiality and integrity impact with no availability effect, meaning an authenticated user can escalate their reach to critical business intelligence data without needing elevated roles. No public exploit identified at time of analysis, and the flaw is addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle EDI Gateway (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all EDI Gateway-accessible data, including critical data. Rated CVSS 8.1, the flaw is disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass-class issue; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Process Manufacturing Financials (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.