Loans
Monthly
Oracle Loans 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes its Internal Operations component to network-based exploitation by low-privileged authenticated attackers over HTTP. Successful exploitation grants unauthorized ability to create, delete, or modify critical data across all Oracle Loans accessible records, and can induce a partial denial of service against the application. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and broad affected version range (12.2.3-12.2.15) make this a notable priority for Oracle EBS deployments.
Oracle Loans within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes all loan records to network-authenticated low-privileged users through an authorization control failure in the Internal Operations component. A low-privileged attacker with HTTP network access can read the complete Oracle Loans dataset and perform unauthorized inserts or updates on a subset of that data, without requiring elevated credentials or any victim interaction. No public exploit code has been identified at time of analysis, and Oracle has addressed this vulnerability in the August 2026 Critical Patch Update.
Data compromise in Oracle Loans (Internal Operations component of Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged attacker with network HTTP access to read, create, delete, or modify all Loans-accessible data. The flaw yields high confidentiality and integrity impact without affecting availability, and carries a CVSS 3.1 base score of 8.1. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Loan Details, Loan Accounting Events). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Oracle Loans 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes its Internal Operations component to network-based exploitation by low-privileged authenticated attackers over HTTP. Successful exploitation grants unauthorized ability to create, delete, or modify critical data across all Oracle Loans accessible records, and can induce a partial denial of service against the application. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and broad affected version range (12.2.3-12.2.15) make this a notable priority for Oracle EBS deployments.
Oracle Loans within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes all loan records to network-authenticated low-privileged users through an authorization control failure in the Internal Operations component. A low-privileged attacker with HTTP network access can read the complete Oracle Loans dataset and perform unauthorized inserts or updates on a subset of that data, without requiring elevated credentials or any victim interaction. No public exploit code has been identified at time of analysis, and Oracle has addressed this vulnerability in the August 2026 Critical Patch Update.
Data compromise in Oracle Loans (Internal Operations component of Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged attacker with network HTTP access to read, create, delete, or modify all Loans-accessible data. The flaw yields high confidentiality and integrity impact without affecting availability, and carries a CVSS 3.1 base score of 8.1. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Loan Details, Loan Accounting Events). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.