Flow Manufacturing
Monthly
Unauthorized data access in Oracle Flow Manufacturing 12.2.3 through 12.2.15 allows network-authenticated low-privileged users to fully compromise confidentiality of all accessible manufacturing data and perform limited unauthorized data modification via HTTP. Tagged as an authentication bypass by the reporting source, this suggests the vulnerability enables low-privileged users to circumvent authorization controls within Oracle E-Business Suite's Internal Operations component, exposing critical operational data beyond their intended access scope. No public exploit has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Security Patch Update.
Oracle Flow Manufacturing versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains a vulnerability in its Internal Operations component that allows a low-privileged, network-authenticated attacker to fully compromise the system via HTTP with no user interaction required. The vendor characterizes this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete loss of confidentiality, integrity, and availability - constituting a full product takeover rather than the narrower 'Information Disclosure' tag in the intelligence metadata would suggest. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Full compromise of Oracle Flow Manufacturing (Internal Operations component of Oracle E-Business Suite) is achievable by a low-privileged attacker over the network via HTTP, per Oracle's July 2026 Critical Patch Update. Any authenticated EBS user can leverage the flaw to take over the module, exposing and altering confidential manufacturing data (high confidentiality, integrity, and availability impact, CVSS 8.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle EBS is a recurring target for opportunistic and targeted attackers.
Data compromise in Oracle Flow Manufacturing (Oracle E-Business Suite 12.2.13-12.2.15, Internal Operations component) allows a low-privileged remote attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (high) with full confidentiality and integrity impact but no availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV; disclosure is via Oracle's July 2026 Critical Patch Update.
Unauthorized data access in Oracle Flow Manufacturing 12.2.3 through 12.2.15 allows network-authenticated low-privileged users to fully compromise confidentiality of all accessible manufacturing data and perform limited unauthorized data modification via HTTP. Tagged as an authentication bypass by the reporting source, this suggests the vulnerability enables low-privileged users to circumvent authorization controls within Oracle E-Business Suite's Internal Operations component, exposing critical operational data beyond their intended access scope. No public exploit has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Security Patch Update.
Oracle Flow Manufacturing versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains a vulnerability in its Internal Operations component that allows a low-privileged, network-authenticated attacker to fully compromise the system via HTTP with no user interaction required. The vendor characterizes this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete loss of confidentiality, integrity, and availability - constituting a full product takeover rather than the narrower 'Information Disclosure' tag in the intelligence metadata would suggest. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Full compromise of Oracle Flow Manufacturing (Internal Operations component of Oracle E-Business Suite) is achievable by a low-privileged attacker over the network via HTTP, per Oracle's July 2026 Critical Patch Update. Any authenticated EBS user can leverage the flaw to take over the module, exposing and altering confidential manufacturing data (high confidentiality, integrity, and availability impact, CVSS 8.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle EBS is a recurring target for opportunistic and targeted attackers.
Data compromise in Oracle Flow Manufacturing (Oracle E-Business Suite 12.2.13-12.2.15, Internal Operations component) allows a low-privileged remote attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (high) with full confidentiality and integrity impact but no availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV; disclosure is via Oracle's July 2026 Critical Patch Update.