Lease And Finance Management
Monthly
Full application takeover in Oracle Lease and Finance Management (versions 12.2.11 through 12.2.15), a module of Oracle E-Business Suite's Internal Operations component, lets a low-privileged attacker with HTTP network access compromise the confidentiality, integrity, and availability of the product. Oracle rates the flaw CVSS 3.1 7.5 but marks it 'difficult to exploit' (AC:H) and disclosed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, and it is not listed on the CISA KEV catalog.
Full compromise of Oracle Lease and Finance Management (versions 12.2.14 through 12.2.15), a module of Oracle E-Business Suite's Internal Operations component, is possible for a network-based attacker who already holds high application privileges. Oracle rates this CVSS 3.1 7.2 with high confidentiality, integrity, and availability impact, describing successful attacks as resulting in complete takeover of the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the modest EPSS-relevant profile is consistent with the high-privilege precondition limiting mass exploitation.
Data compromise in Oracle Lease and Finance Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all application-accessible data over HTTP. The CVSS 3.1 base score is 8.1 (C:H/I:H), reflecting full confidentiality and integrity impact with no availability effect. This CVE was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Oracle Lease and Finance Management within Oracle E-Business Suite (versions 12.2.3-12.2.15) exposes its Lease Authoring component to exploitation by low-privileged, network-accessible attackers over HTTP, resulting in partial confidentiality loss, unauthorized data manipulation, and a partial denial of service. The vulnerability is classified as easily exploitable with no user interaction required, making it accessible to any authenticated low-privilege user who can reach the application over the network. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Quotes). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Full application takeover in Oracle Lease and Finance Management (versions 12.2.11 through 12.2.15), a module of Oracle E-Business Suite's Internal Operations component, lets a low-privileged attacker with HTTP network access compromise the confidentiality, integrity, and availability of the product. Oracle rates the flaw CVSS 3.1 7.5 but marks it 'difficult to exploit' (AC:H) and disclosed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, and it is not listed on the CISA KEV catalog.
Full compromise of Oracle Lease and Finance Management (versions 12.2.14 through 12.2.15), a module of Oracle E-Business Suite's Internal Operations component, is possible for a network-based attacker who already holds high application privileges. Oracle rates this CVSS 3.1 7.2 with high confidentiality, integrity, and availability impact, describing successful attacks as resulting in complete takeover of the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the modest EPSS-relevant profile is consistent with the high-privilege precondition limiting mass exploitation.
Data compromise in Oracle Lease and Finance Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all application-accessible data over HTTP. The CVSS 3.1 base score is 8.1 (C:H/I:H), reflecting full confidentiality and integrity impact with no availability effect. This CVE was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Oracle Lease and Finance Management within Oracle E-Business Suite (versions 12.2.3-12.2.15) exposes its Lease Authoring component to exploitation by low-privileged, network-accessible attackers over HTTP, resulting in partial confidentiality loss, unauthorized data manipulation, and a partial denial of service. The vulnerability is classified as easily exploitable with no user interaction required, making it accessible to any authenticated low-privilege user who can reach the application over the network. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Quotes). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.