Enterprise Asset Management
Monthly
Unauthorized data access in Oracle Enterprise Asset Management (E-Business Suite, Linear Asset Management component), versions 12.2.3 through 12.2.15, is achievable by a low-privileged authenticated network attacker over HTTP when a victim interacts with attacker-controlled content, resulting in complete confidentiality exposure and limited integrity compromise with a confirmed scope change to additional products. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) combined with an Authentication Bypass tag from the reporter suggests a client-side attack pathway - likely cross-site scripting or a similar injection technique - where a victim must interact with attacker-influenced material to trigger the exploit. No public exploit code has been identified and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Takeover of Oracle Enterprise Asset Management (the eAM module of Oracle E-Business Suite, Internal Operations component) is possible by a low-privileged, authenticated network attacker sending crafted HTTP requests. Oracle rates this CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.3 through 12.2.15, and describes exploitation as easy. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Oracle Enterprise Asset Management (EAM), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes an authentication bypass condition in the Internal Operations component that allows a low-privileged, network-authenticated attacker to read and tamper with a subset of EAM data. Despite the medium CVSS score of 4.2, the 'Authentication Bypass' tag signals that a legitimately low-privileged account can cross authorization boundaries within the application. No public exploit code exists and this vulnerability is not listed in CISA KEV, making it a moderate but non-urgent priority for most organizations.
High-privileged network exploitation of Oracle Enterprise Asset Management's Internal Operations component allows unauthorized read and write access to critical EAM data across versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass by Oracle, the flaw requires an attacker who already holds high-level privileges to navigate high-complexity conditions over HTTP - suggesting an internal authorization bypass rather than a complete pre-auth bypass. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit or CISA KEV listing exists at time of analysis.
Cross-site scripting or authorization bypass in Oracle Enterprise Asset Management (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker to read a subset of accessible data and perform unauthorized write operations, with confirmed scope change that may impact additional E-Business Suite products. The attack is network-delivered via HTTP and requires a victim user to interact, consistent with a stored or reflected XSS-class injection despite the tag indicating authentication bypass. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the medium-severity tier warranting patch prioritization for internet-facing or multi-tenant E-Business Suite deployments.
Oracle Enterprise Asset Management (EAM) versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains an authorization control weakness in its Work Definition Issues component that permits low-privileged authenticated network attackers to partially compromise data integrity and confidentiality over HTTPS. Successful exploitation enables unauthorized read access to a subset of EAM-accessible data as well as unauthorized update, insert, or delete operations against EAM records. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the 'Authentication Bypass' intelligence tag suggests the flaw involves insufficient privilege enforcement within the Work Definition Issues component rather than a full pre-authentication bypass.
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Work Definition Issues). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Setup). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
INFOR EAM V11.0 Build 201410 has XSS via comment fields. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
INFOR EAM V11.0 Build 201410 has SQL injection via search fields, related to the filtervalue parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthorized data access in Oracle Enterprise Asset Management (E-Business Suite, Linear Asset Management component), versions 12.2.3 through 12.2.15, is achievable by a low-privileged authenticated network attacker over HTTP when a victim interacts with attacker-controlled content, resulting in complete confidentiality exposure and limited integrity compromise with a confirmed scope change to additional products. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) combined with an Authentication Bypass tag from the reporter suggests a client-side attack pathway - likely cross-site scripting or a similar injection technique - where a victim must interact with attacker-influenced material to trigger the exploit. No public exploit code has been identified and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Takeover of Oracle Enterprise Asset Management (the eAM module of Oracle E-Business Suite, Internal Operations component) is possible by a low-privileged, authenticated network attacker sending crafted HTTP requests. Oracle rates this CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.3 through 12.2.15, and describes exploitation as easy. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Oracle Enterprise Asset Management (EAM), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes an authentication bypass condition in the Internal Operations component that allows a low-privileged, network-authenticated attacker to read and tamper with a subset of EAM data. Despite the medium CVSS score of 4.2, the 'Authentication Bypass' tag signals that a legitimately low-privileged account can cross authorization boundaries within the application. No public exploit code exists and this vulnerability is not listed in CISA KEV, making it a moderate but non-urgent priority for most organizations.
High-privileged network exploitation of Oracle Enterprise Asset Management's Internal Operations component allows unauthorized read and write access to critical EAM data across versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass by Oracle, the flaw requires an attacker who already holds high-level privileges to navigate high-complexity conditions over HTTP - suggesting an internal authorization bypass rather than a complete pre-auth bypass. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit or CISA KEV listing exists at time of analysis.
Cross-site scripting or authorization bypass in Oracle Enterprise Asset Management (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker to read a subset of accessible data and perform unauthorized write operations, with confirmed scope change that may impact additional E-Business Suite products. The attack is network-delivered via HTTP and requires a victim user to interact, consistent with a stored or reflected XSS-class injection despite the tag indicating authentication bypass. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the medium-severity tier warranting patch prioritization for internet-facing or multi-tenant E-Business Suite deployments.
Oracle Enterprise Asset Management (EAM) versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains an authorization control weakness in its Work Definition Issues component that permits low-privileged authenticated network attackers to partially compromise data integrity and confidentiality over HTTPS. Successful exploitation enables unauthorized read access to a subset of EAM-accessible data as well as unauthorized update, insert, or delete operations against EAM records. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the 'Authentication Bypass' intelligence tag suggests the flaw involves insufficient privilege enforcement within the Work Definition Issues component rather than a full pre-authentication bypass.
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Work Definition Issues). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Setup). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
INFOR EAM V11.0 Build 201410 has XSS via comment fields. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
INFOR EAM V11.0 Build 201410 has SQL injection via search fields, related to the filtervalue parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.