E Business Suite Secure Enterprise Search
Monthly
Broad data compromise in Oracle E-Business Suite Secure Enterprise Search (Search Integration Engine) affects EBS versions 12.2.3 through 12.2.15, where a network attacker with only low-level authenticated access over HTTP can read, create, modify, or delete all data accessible to the Secure Enterprise Search component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N) rates it 8.1 High, reflecting low attack complexity and full confidentiality and integrity impact without availability loss. No public exploit identified at time of analysis, though the vendor's 'Authentication Bypass' tagging suggests weak access-control enforcement in the affected component.
Unauthorized data access in Oracle E-Business Suite Secure Enterprise Search versions 12.2.3 through 12.2.15 allows a low-privileged network attacker to read and modify data within the Search Integration Engine component via HTTP. Despite requiring a valid low-privilege account, the vulnerability is tagged as an Authentication Bypass, suggesting attackers can circumvent authorization controls within the search subsystem to access data beyond their permitted scope. No public exploit code or CISA KEV listing exists at time of analysis, and Oracle has addressed this in the July 2026 Critical Patch Update.
Vulnerability in the Oracle E-Business Suite Secure Enterprise Search product of Oracle E-Business Suite (component: Search Integration Engine). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unspecified vulnerability in the Oracle E-Business Suite Secure Enterprise Search component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Broad data compromise in Oracle E-Business Suite Secure Enterprise Search (Search Integration Engine) affects EBS versions 12.2.3 through 12.2.15, where a network attacker with only low-level authenticated access over HTTP can read, create, modify, or delete all data accessible to the Secure Enterprise Search component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N) rates it 8.1 High, reflecting low attack complexity and full confidentiality and integrity impact without availability loss. No public exploit identified at time of analysis, though the vendor's 'Authentication Bypass' tagging suggests weak access-control enforcement in the affected component.
Unauthorized data access in Oracle E-Business Suite Secure Enterprise Search versions 12.2.3 through 12.2.15 allows a low-privileged network attacker to read and modify data within the Search Integration Engine component via HTTP. Despite requiring a valid low-privilege account, the vulnerability is tagged as an Authentication Bypass, suggesting attackers can circumvent authorization controls within the search subsystem to access data beyond their permitted scope. No public exploit code or CISA KEV listing exists at time of analysis, and Oracle has addressed this in the July 2026 Critical Patch Update.
Vulnerability in the Oracle E-Business Suite Secure Enterprise Search product of Oracle E-Business Suite (component: Search Integration Engine). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unspecified vulnerability in the Oracle E-Business Suite Secure Enterprise Search component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.