General Ledger
Monthly
Unauthorized data manipulation in Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical financial records via HTTP, with secondary read and partial availability impacts. The vulnerability resides in the Internal Operations component and requires only a valid low-privilege account - no elevated rights or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high integrity impact make this a significant risk for any organization running Oracle EBS financials.
Oracle General Ledger versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, contains an authentication bypass weakness in the Internal Operations component that allows a highly privileged local attacker to gain unauthorized read and write access to critical financial ledger data, with a scope change that may cascade impact to additional Oracle EBS products. The attack requires local infrastructure logon and high attack complexity, substantially constraining the realistic attacker population to insiders or those who have already compromised the host environment. No public exploit code has been identified and Oracle has addressed this through the August 2026 Critical Patch Update.
Unauthorized data access and partial denial of service affect Oracle General Ledger versions 12.2.3 through 12.2.15, a core financial management component of Oracle E-Business Suite. A low-privileged, network-authenticated attacker can exploit the Internal Operations component via HTTP to gain complete read access to all Oracle General Ledger data, perform unauthorized insert/update/delete operations on a subset of that data, and cause a partial availability disruption. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Full takeover of Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-accessible attacker via HTTP, requiring no user interaction and minimal exploitation complexity. The vulnerability resides in the Internal Operations component and results in complete compromise of confidentiality, integrity, and availability of the General Ledger application. No public exploit code or active exploitation has been identified at the time of analysis, but the vendor's own 'easily exploitable' characterization combined with the broad affected version range makes this a high-priority patch for all Oracle EBS deployments.
Full takeover of Oracle General Ledger (versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker via HTTP, exploiting an undisclosed flaw in the Internal Operations component of Oracle E-Business Suite. The CVSS vector confirms complete confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with application-level takeover. Notably, the intelligence tags classify this as 'Information Disclosure,' which conflicts with the described takeover impact - this discrepancy warrants verification against the Oracle August 2026 CSPU advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Oracle General Ledger within E-Business Suite versions 12.2.3 through 12.2.15 exposes critical financial data to high-privileged network attackers through a flaw in the Internal Operations component accessible over HTTP. Successful exploitation grants complete read access to all General Ledger data and partial write capability, with a confirmed scope change meaning compromise can cascade to additional Oracle EBS products. Disclosed through Oracle's August 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.
Unauthorized data access and modification in Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a low-privileged network attacker targeting the Internal Operations component via HTTP. Successful exploitation grants complete read and write access to critical GL financial data plus partial availability disruption - a severe outcome for any organization relying on EBS for financial record integrity. The 'Authentication Bypass' tag suggests the vulnerability allows a low-privileged authenticated user to escalate effective access beyond their authorization level; no public exploit code or CISA KEV listing has been identified at time of analysis.
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Account Hierarchy Manager). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Account Hierarchy Manager). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Consolidation Hierarchy Viewer). Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Account Hierarchy Manager). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unspecified vulnerability in the Oracle General Ledger component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to Consolidation. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unauthorized data manipulation in Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical financial records via HTTP, with secondary read and partial availability impacts. The vulnerability resides in the Internal Operations component and requires only a valid low-privilege account - no elevated rights or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high integrity impact make this a significant risk for any organization running Oracle EBS financials.
Oracle General Ledger versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, contains an authentication bypass weakness in the Internal Operations component that allows a highly privileged local attacker to gain unauthorized read and write access to critical financial ledger data, with a scope change that may cascade impact to additional Oracle EBS products. The attack requires local infrastructure logon and high attack complexity, substantially constraining the realistic attacker population to insiders or those who have already compromised the host environment. No public exploit code has been identified and Oracle has addressed this through the August 2026 Critical Patch Update.
Unauthorized data access and partial denial of service affect Oracle General Ledger versions 12.2.3 through 12.2.15, a core financial management component of Oracle E-Business Suite. A low-privileged, network-authenticated attacker can exploit the Internal Operations component via HTTP to gain complete read access to all Oracle General Ledger data, perform unauthorized insert/update/delete operations on a subset of that data, and cause a partial availability disruption. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Full takeover of Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-accessible attacker via HTTP, requiring no user interaction and minimal exploitation complexity. The vulnerability resides in the Internal Operations component and results in complete compromise of confidentiality, integrity, and availability of the General Ledger application. No public exploit code or active exploitation has been identified at the time of analysis, but the vendor's own 'easily exploitable' characterization combined with the broad affected version range makes this a high-priority patch for all Oracle EBS deployments.
Full takeover of Oracle General Ledger (versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker via HTTP, exploiting an undisclosed flaw in the Internal Operations component of Oracle E-Business Suite. The CVSS vector confirms complete confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with application-level takeover. Notably, the intelligence tags classify this as 'Information Disclosure,' which conflicts with the described takeover impact - this discrepancy warrants verification against the Oracle August 2026 CSPU advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Oracle General Ledger within E-Business Suite versions 12.2.3 through 12.2.15 exposes critical financial data to high-privileged network attackers through a flaw in the Internal Operations component accessible over HTTP. Successful exploitation grants complete read access to all General Ledger data and partial write capability, with a confirmed scope change meaning compromise can cascade to additional Oracle EBS products. Disclosed through Oracle's August 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.
Unauthorized data access and modification in Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a low-privileged network attacker targeting the Internal Operations component via HTTP. Successful exploitation grants complete read and write access to critical GL financial data plus partial availability disruption - a severe outcome for any organization relying on EBS for financial record integrity. The 'Authentication Bypass' tag suggests the vulnerability allows a low-privileged authenticated user to escalate effective access beyond their authorization level; no public exploit code or CISA KEV listing has been identified at time of analysis.
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Account Hierarchy Manager). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Account Hierarchy Manager). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Consolidation Hierarchy Viewer). Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Account Hierarchy Manager). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unspecified vulnerability in the Oracle General Ledger component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to Consolidation. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.