Oracle
Monthly
Full compromise of Oracle SDP Number Portability (a Service Delivery Platform component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker who already holds a logon on the host where the product runs; because the CVSS scope is changed, a successful attack can pivot to significantly impact other products beyond the vulnerable component. The flaw yields high confidentiality, integrity and availability impact and results in product takeover. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized read and write access to Oracle SDP Number Portability (Oracle E-Business Suite, Internal Operations component) is achievable by a low-privileged, network-based attacker over HTTP in versions 12.2.3 through 12.2.15. Oracle rates this 8.1 (High) with high confidentiality and integrity impact, allowing an authenticated user to create, delete, or modify all data accessible to the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network reach make it a notable patching priority in the July 2026 Critical Patch Update.
Data compromise in Oracle Telecommunications Billing Integrator (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read and modify all data accessible to the application. Rated CVSS 3.1 8.1 for high confidentiality and integrity impact with no availability effect, and disclosed in Oracle's July 2026 Critical Patch Update. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Transportation Execution (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged attacker with only network HTTP access to the application. Any authenticated user account can be leveraged to fully compromise confidentiality, integrity, and availability of the module, per the CVSS 3.1 8.8 vector. No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Time and Labor module. Scored CVSS 3.1 8.1 (C:H/I:H, no availability impact), it is easily exploitable per Oracle but requires an existing low-privilege account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; fixes ship in the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read and modify all data accessible to the application. The flaw is rated CVSS 8.1 and tagged as an authentication bypass, meaning a limited account can escalate to full read/write over critical Learning Management data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the application after luring a victim into interacting. Rated CVSS 3.1 7.3 (High) with full confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the required user interaction moderates raw exploitability.
Full compromise of Oracle Service Fulfillment Manager (a Fulfillment Engine component of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible where an authenticated, low-privileged attacker with network HTTP access can escalate to complete takeover of the module. Although rated CVSS 3.1 7.5 with confidentiality, integrity and availability impact, the attack complexity is high, meaning exploitation is non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle labels it easily exploitable. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and Oracle's 'easily exploitable' wording make it a strong patch priority for EBS operators.
Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite) allows a high-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application, with a scope change that may significantly impact additional Oracle products. Affected releases span 12.2.3 through 12.2.15, and Oracle rates it CVSS 8.7 (confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is addressed in the Oracle July 2026 Critical Patch Update.
Full account takeover of Oracle Labor Distribution (part of Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to affected servers running versions 12.2.3 through 12.2.15. The flaw compromises confidentiality, integrity, and availability of the module and, per Oracle, results in complete takeover of Labor Distribution. No public exploit identified at time of analysis, though the CVSS 8.8 rating and network-reachable, low-complexity nature make it a high-priority patch in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) is possible over HTTP by a low-privileged authenticated attacker, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, a successful attack results in complete takeover of the product with full confidentiality, integrity, and availability impact. The CVSS 3.1 score is 7.5 and Oracle rates the flaw difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise (takeover) of the Oracle Public Sector Financials module in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. The flaw carries a CVSS 3.1 base score of 7.5 and impacts confidentiality, integrity, and availability, but is rated hard to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Full compromise of the Oracle Public Sector Payroll module (Internal Operations component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible for a high-privileged attacker with network HTTP access, yielding complete takeover of the payroll application per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 7.2 with high confidentiality, integrity, and availability impact, but exploitation requires existing high-level privileges (PR:H). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Full compromise of the Oracle Public Sector Payroll module within Oracle E-Business Suite (Internal Operations component) is possible for an already-privileged attacker who can reach the application over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw affects supported EBS releases 12.2.4 through 12.2.15 and, though rated CVSS 7.2, requires high existing privileges (PR:H), which narrows the realistic attacker set to trusted or authenticated users. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in the Public Sector Payroll module (Internal Operations component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with network HTTP access fully compromise the payroll application. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and calls it 'easily exploitable,' meaning a single low-tier authenticated account is enough to seize the module. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and network reach make it a prompt-patch item from the July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle E-Business Suite's Oracle Capacity module (Internal Operations component), versions 12.2.3 through 12.2.15, allows a low-privileged attacker with HTTP network access to read all Oracle Capacity-accessible data and, due to a scope change, impact additional connected products. The flaw is easily exploitable and requires only a low-privilege account, no user interaction. It is addressed in Oracle's July 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Account/component takeover in the Oracle Customer Care module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the Customer Care component. The flaw carries a CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, and low attack complexity. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Full compromise of the Oracle Shipping Execution module of Oracle E-Business Suite (Internal Operations component) is possible for a high-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Affecting supported EBS releases 12.2.12 through 12.2.15, successful exploitation results in complete takeover of the Shipping Execution product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, so real-world urgency is tempered by the requirement for pre-existing high privileges.
Data compromise in Oracle E-Business Suite Inventory Management (Core Receiving component, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete or modify all data accessible to the Inventory Management module over HTTP. The flaw is rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, and is trivially exploitable (AC:L) once the attacker holds any valid low-privilege EBS session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the 'Authentication Bypass' tag suggests the flaw may let a low-privilege account reach functionality or data it should not.
Full compromise of Oracle Property Manager (a module of Oracle E-Business Suite) is possible for a high-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation yields complete takeover of the Property Manager component with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though Oracle rates it easily exploitable once the required privileges are held.
Unauthorized data access in Oracle Installed Base (a module of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker read all data accessible to the Installed Base application and modify some of it via HTTP. Oracle rates it CVSS 7.1, driven by high confidentiality impact and partial integrity impact with no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is disclosed as part of the Oracle July 2026 Critical Patch Update.
Data compromise in Oracle E-Business Suite's Installed Base module (Create Item Instance component) lets a low-privileged, network-authenticated attacker read, create, delete, or modify all Installed Base data across releases 12.2.3 through 12.2.15. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting full read/write compromise of the module's data without affecting uptime. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a high-priority patch item for EBS operators.
Privilege-based takeover of Oracle Project Intelligence (a module of Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the component, resulting in high confidentiality, integrity, and availability impact. Oracle rates it CVSS 3.1 8.8 and delivered the fix in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though EBS components are historically attractive post-authentication targets.
Full compromise of Oracle HCM Configuration Workbench (Rapid Implementation component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a high-privileged, network-authenticated attacker to take over the module over HTTP with high confidentiality, integrity, and availability impact. Oracle addressed the flaw in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Despite the vendor 'Information Disclosure' tag, the CVSS vector reflects a full C/I/A takeover rather than mere data exposure.
Privilege-escalation-to-takeover in Oracle Warehouse Management (Internal Operations component of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with network access over HTTP to fully compromise the module. Because CVSS scope is unchanged but all three impacts (C/I/A) are High, a successful attack results in complete takeover of Oracle Warehouse Management. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is addressed in the Oracle Critical Patch Update of July 2026.
Full compromise of Oracle Payroll (Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to the affected application, per Oracle's July 2026 Critical Patch Update. The flaw affects EBS releases 12.2.3 through 12.2.15 and, given the CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, allows takeover of Oracle Payroll. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor characterization warrant prompt patching.
Full compromise of Oracle Payroll (a module of Oracle E-Business Suite, Internal Operations component) is possible in supported releases 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access can achieve complete takeover of the Payroll application. Oracle rates the flaw CVSS 3.1 7.5 with high confidentiality, integrity and availability impact, but flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is elevated but not confirmed as active.
Full takeover of Oracle Payroll (component: Internal Operations) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged, authenticated attacker over HTTP, yielding complete compromise of confidentiality, integrity, and availability (CVSS 8.8). The flaw is described by Oracle as easily exploitable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It was disclosed and fixed in the Oracle Critical Patch Update of July 2026.
Compromise of Oracle Work in Process, a manufacturing module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15, Internal Operations component), allows a low-privileged authenticated attacker with HTTP network access to read all data accessible to Work in Process and to alter some of it, with a scope change that can significantly impact additional Oracle products. Exploitation is rated easy by Oracle but requires human interaction from a victim other than the attacker (UI:R), pointing to a social-engineering or cross-user trigger. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Remote takeover of the Oracle Work in Process (WIP) module of Oracle E-Business Suite (component: Internal Operations) allows an unauthenticated attacker with only HTTP network access to fully compromise the application. Oracle rates this 9.8 with full confidentiality, integrity and availability impact and describes it as 'easily exploitable,' meaning no authentication, no user interaction and low attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network attack profile makes it a top-priority patch in the July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Trade Management (Oracle E-Business Suite, Claim LOV component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with network HTTP access read, create, delete, or modify all data accessible to the application. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting high confidentiality and integrity loss without affecting uptime. No public exploit identified at time of analysis, and the flaw is fixed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Trade Management (Claim LOV component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged, network-adjacent attacker read, create, delete, or modify all data accessible to the module over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact) and was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Order Management, a module of Oracle E-Business Suite (EBS), is possible via the Product Diagnostic Tools component, where a low-privileged attacker with HTTP network access can achieve complete takeover of the module. Oracle rates the flaw 8.8 (High) and describes it as 'easily exploitable,' with full confidentiality, integrity, and availability impact across EBS releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and low privilege bar make it a strong patch priority.
Data compromise in Oracle Risk Management (part of Oracle E-Business Suite 12.2.3 through 12.2.15, Internal Operations component) allows a low-privileged remote attacker with HTTP access to read, create, modify, or delete all data accessible to the application. The flaw carries a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact) and is rated by Oracle as easily exploitable, though authentication with at least low privileges is required. There is no public exploit identified at time of analysis and no CISA KEV listing.
Unauthorized data access and partial data manipulation in Oracle Advanced Pricing (the Pricing Installation component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker with network access over HTTP to read all data accessible to the module and to insert, update, or delete some of it. The flaw is rated CVSS 3.1 7.1 (High) with high confidentiality impact and low integrity impact; Oracle disclosed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though EBS pricing modules are attractive targets in enterprise ERP environments.
Unauthorized critical-data access in Oracle Advanced Pricing (Pricing Installation component) of Oracle E-Business Suite versions 12.2.14 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read all data accessible to the module and to make limited unauthorized inserts, updates, or deletes. Because the flaw carries a scope change, successful exploitation may significantly impact additional integrated E-Business Suite products beyond Pricing itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.1; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Advanced Pricing (Pricing Installation component of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates it CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Advanced Pricing (Pricing Installation component of Oracle E-Business Suite) is achievable by a low-privileged, network-adjacent attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation yields complete takeover of the Advanced Pricing module with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Full compromise of Oracle Quoting (a module of Oracle E-Business Suite) is possible for an authenticated, low-privileged attacker reaching the application over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the Quoting component with high impact to confidentiality, integrity, and availability, though Oracle rates the attack complexity as high (difficult to exploit). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthorized data compromise in Oracle Contracts Integration (Internal Operations component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. The flaw carries a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of the Oracle Quality module within Oracle E-Business Suite (Internal Operations component, versions 12.2.3 through 12.2.15) is possible for a low-privileged, authenticated attacker reaching the application over HTTP. Successful attacks lead to complete takeover of Oracle Quality with high confidentiality, integrity, and availability impact, though Oracle rates the attack complexity as high. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privileged compromise of Oracle Quality, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), allows a high-privileged attacker with HTTP network access to read all Oracle Quality-accessible data, partially modify data, and cause partial denial of service. Because the flaw carries a scope change (S:C), successful attacks can significantly impact additional products beyond Oracle Quality itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 3.1 base score of 8.2 reflects meaningful confidentiality and cross-component risk.
Data compromise in Oracle Lease and Finance Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all application-accessible data over HTTP. The CVSS 3.1 base score is 8.1 (C:H/I:H), reflecting full confidentiality and integrity impact with no availability effect. This CVE was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Project Contracts (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), it is described by Oracle as easily exploitable and requires only authenticated network access. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Full server takeover in Oracle Mobile Application Server (the MWA component of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a high-privileged, network-based attacker to fully compromise the server over HTTP, impacting confidentiality, integrity and availability (CVSS 3.1 base 7.2). Because the attacker must already hold high privileges (PR:H), this is a privilege-escalation-to-takeover issue rather than a pre-auth breach, and there is no public exploit identified at time of analysis nor CISA KEV listing.
Elevated data compromise in Oracle E-Business Suite's Customer Support module (Update Service Request component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read and modify all Customer Support-accessible data. The flaw carries high confidentiality and integrity impact (CVSS 8.1) but no availability impact, and Oracle rates it easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; remediation is delivered via Oracle's July 2026 Critical Patch Update.
SQL-layer compromise in Oracle Demand Signal Repository (part of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High), the flaw yields full confidentiality and integrity impact but no availability impact. No public exploit is identified at time of analysis and it is not in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Data tampering in Oracle Price Protection (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged remote attacker with an authenticated HTTP session to create, delete, or modify critical application data and read a subset of Price Protection data. The CVSS 3.1 base score is 7.1, driven primarily by high integrity impact (I:H) with limited confidentiality exposure (C:L) and no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-scoped compromise of Oracle Price Protection (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with local logon to the hosting infrastructure to read, create, delete, or modify all data accessible to the product. Oracle rates it CVSS 3.1 8.4 with a scope change, meaning a successful attack can significantly impact products beyond Price Protection itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle-reported EBS flaws are historically high-value targets.
Full compromise of the Oracle HCM Common Architecture module (Internal Operations component) within Oracle E-Business Suite is possible, allowing an attacker who already holds high-level application privileges to take over the module over the network via HTTP. The flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 score of 7.2 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' for an authenticated actor.
Elevated information disclosure and data tampering in Oracle Solaris 11.4 allows a low-privileged, network-authenticated attacker to abuse the Remote Administration Daemon (RAD) utility component to gain complete read access to all Solaris-accessible data and modify a subset of it, with a scope change that can significantly impact other products on the host. Oracle rates it CVSS 3.1 7.1 with high attack complexity, and it is addressed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not in CISA KEV, so exploitation is not confirmed in the wild.
Local privilege escalation and full compromise in Oracle Solaris 11.4 (Utility component) allows a low-privileged local user with logon access to the host to take over the operating system, impacting confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.0 and flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Advanced Outbound Telephony (a component of Oracle E-Business Suite) is possible when a low-privileged user with HTTP network access exploits an easily-exploitable flaw in the Internal Operations component, per the July 2026 Oracle Critical Patch Update. Successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact across all supported releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Interaction Blending, a telephony/campaign-routing module within Oracle E-Business Suite (Internal Operations component), is possible by a high-privileged attacker sending crafted HTTP requests over the network. Oracle rates successful exploitation as a complete takeover of the component with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the fix ships in Oracle's July 2026 Critical Patch Update.
Cross-context integrity compromise in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote unauthenticated attacker to manipulate, create, or delete critical data after luring a victim into interacting with malicious content, with impact spilling into other Oracle EBS products due to a scope change. Addressed in Oracle's July 2026 Critical Patch Update, it carries a CVSS 3.1 base score of 7.4 with integrity-only impact and no public exploit identified at time of analysis. The requirement for victim interaction lowers the practical exploitation rate relative to a fully unauthenticated automated attack.
Sensitive data exposure in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to obtain unauthorized access to all iSupport-accessible data over HTTP. Because the flaw carries a scope change, successful exploitation may also significantly impact other products beyond iSupport itself, though only confidentiality is affected (no integrity or availability impact). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tags it as an authentication-bypass class issue.
Data compromise in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote unauthenticated attacker to reach the application over HTTP and gain read and write access to all iSupport-accessible data. The flaw carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact, and Oracle rates it difficult to exploit (AC:H). No public exploit has been identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was supplied.
Broken access control in the Shopping Cart component of Oracle iStore (part of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the iStore application over HTTP. Tagged as an authentication-bypass class issue, it carries a CVSS 3.1 base score of 8.1 driven by high confidentiality and integrity impact with no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle iStore (the Oracle E-Business Suite customer-facing web storefront) is possible via its Shopping Cart component in releases 12.2.3 through 12.2.15, where a high-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.2 and shipped a fix in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Supply Chain Trading Connector (Collaboration History component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows remote attackers to read all data accessible to the product over HTTP and make limited unauthorized modifications. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.2, the flaw is tagged as an authentication bypass and requires no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network exposure make it a strong patching priority for EBS operators.
Account/component takeover in Oracle Bills of Material (component: Internal Operations) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the module when a legitimate user is lured into interacting with attacker-supplied content. Per the CVSS vector (PR:L/UI:R), exploitation requires an existing low-level account plus victim interaction, but a successful attack yields high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). No public exploit identified at time of analysis; disclosed via Oracle's July 2026 Critical Patch Update.
Takeover of Oracle Cost Management, the costing module of Oracle E-Business Suite (component: Costing Transaction Errors), is achievable by a low-privileged attacker with HTTP network access. Successful exploitation yields full confidentiality, integrity, and availability compromise of the module across EBS releases 12.2.3 through 12.2.15. Rated CVSS 3.1 7.5 but explicitly difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not on the CISA KEV list.
Sensitive data exposure in Oracle Compensation Workbench (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read all data accessible to the component and perform limited unauthorized inserts, updates, or deletes over HTTP. Rated CVSS 7.1 (C:H/I:L/A:N), it was disclosed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not on CISA KEV, though EBS is a high-value target and Oracle CPU flaws have historically drawn attacker interest.
Unauthorized data access in Oracle E-Business Suite's Compensation Workbench component (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to read all data accessible to the module and to modify some of it. Oracle rates this CVSS 7.1 (C:H/I:L). No public exploit is identified at time of analysis and it is not listed in CISA KEV, though it was disclosed in Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle TeleSales (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all TeleSales-accessible data. The flaw is rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and is tagged as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Sales Offline (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible for an already high-privileged attacker who reaches the Internal Operations component over HTTP, and because the flaw carries a scope change (S:C) a successful attack can significantly impact additional products beyond Sales Offline itself. The issue is rated CVSS 3.1 8.0 but Oracle characterizes it as difficult to exploit (AC:H) and requiring elevated privileges (PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle Sales Offline, a module of Oracle E-Business Suite (Internal Operations component) versions 12.2.3 through 12.2.15, lets a low-privileged authenticated attacker with HTTP network access fully compromise the product. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable' and resulting in complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its inclusion in Oracle's July 2026 Critical Patch Update warrants prompt patching.
Broad data compromise in Oracle Sales Offline (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all data the application can access and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 8.3 (C:H/I:H/A:L) and describes it as easily exploitable, disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a strong patching priority.
Full compromise of Oracle Receivables (the accounts-receivable module of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible via the Internal Operations component, where an authenticated attacker holding high privileges can send crafted HTTP requests to take over the module. Oracle rates this CVSS 7.2 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' but exploitation is gated behind existing high-privilege access. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Receivables (Oracle E-Business Suite, Internal Operations component) is possible in versions 12.2.3 through 12.2.15, where a high-privileged attacker with network HTTP access can take over the module, impacting confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable, though it requires existing high privileges (PR:H). No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle iReceivables (a self-service receivables module of Oracle E-Business Suite, AR Web Utilities component) is possible by a remote unauthenticated attacker over HTTP, affecting EBS releases 12.2.3 through 12.2.15. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact, though the CVSS vector rates exploitation as high-complexity. Addressed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Trading Community (Oracle E-Business Suite, Party Search UI component) allows a low-privileged attacker with network HTTP access to read and modify all data accessible to the Trading Community module. Fixed in the Oracle Critical Patch Update of July 2026 (CPUJUL2026), the flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the vendor tag 'Authentication Bypass' suggests the Party Search UI may permit access beyond the attacker's intended authorization scope.
Account takeover in Oracle iReceivables (Oracle E-Business Suite, AR Web Utilities component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access fully compromise the module. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning a valid low-privilege EBS account is the only real barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-but-low privilege requirement make it a strong patching priority.
Complete takeover of Oracle Workflow (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is possible by a remote unauthenticated attacker who reaches the product over SMTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 8.1 with high confidentiality, integrity, and availability impact, but carries high attack complexity, meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Payments (Oracle E-Business Suite, File Transmission component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the Payments module over HTTP. Oracle rates it CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and it is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor 'Authentication Bypass' tag and low attack complexity make it an attractive target in EBS-exposed environments.
Unauthorized data access in Oracle Applications Framework (the OAF layer of Oracle E-Business Suite) lets a low-privileged, network-based attacker abuse the Search Bean [Incl. Advanced] component to read all OAF-accessible data and perform limited unauthorized updates, inserts, or deletes. Affected releases span EBS 12.2.3 through 12.2.15, and the flaw is rated CVSS 3.1 7.1 with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and it is addressed in Oracle's July 2026 Critical Patch Update.
Privilege escalation and cross-product compromise in Oracle Application Object Library (the core AOL/FND framework of Oracle E-Business Suite versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read and modify all AOL-accessible data and, because of a scope change, significantly impact other Oracle EBS products beyond AOL itself. Rated CVSS 3.1 9.6 (Critical) with confidentiality and integrity impact but no availability effect, it is remotely exploitable over HTTPS with low attack complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering in Oracle E-Business Suite's Financials Common Modules (Common Components) lets a low-privileged, network-authenticated attacker perform unauthorized creation, deletion, and modification of critical financial data across all module-accessible records, plus read access to a subset of that data. Affected releases span 12.2.3 through 12.2.15, remediated in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though the tag 'Authentication Bypass' warrants scrutiny given the authenticated CVSS profile.
Data compromise in Oracle Complex Maintenance, Repair and Overhaul (cMRO), a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged authenticated attacker with HTTP network access to read and modify critical application data. The flaw affects the Internal Operations component and yields high confidentiality and integrity impact (CVSS 8.1) with no availability effect. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Application Object Library (the core framework component of Oracle E-Business Suite) is possible in versions 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access can escalate to complete takeover of the component. Oracle rates this CVSS 3.1 7.5 with full confidentiality, integrity, and availability impact, though the attack is flagged as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the shared-infrastructure nature of AOL makes successful exploitation high-consequence.
Data compromise in Oracle Applications Framework (12.2.3 through 12.2.15), a core component of Oracle E-Business Suite, allows a low-privileged authenticated attacker with HTTP network access to read, create, modify, or delete all data accessible to the framework via the Graph/Charting component. The Oracle-assigned CVSS 3.1 base score is 8.1 (C:H/I:H) with no availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor-supplied 'Authentication Bypass' tag suggests low authentication barriers relative to the damage achievable.
Data compromise in Oracle Financials Common Modules (Common Components) within Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Oracle rates it CVSS 3.1 8.1 (high confidentiality and integrity impact, no availability impact) and tags it as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Applications Manager (a management console within Oracle E-Business Suite) is possible through the Command Line - RapidClone component in EBS versions 12.2.3 through 12.2.15. An attacker who already has logon access to the host infrastructure where the component runs can compromise it without any application-level authentication, gaining full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; it was disclosed by Oracle in the July 2026 Critical Patch Update.
Complete takeover of Oracle EDI Gateway (a component of Oracle E-Business Suite) is possible by an unauthenticated remote attacker over HTTP, affecting supported versions 12.2.3 through 12.2.15 per Oracle's July 2026 Critical Patch Update. Despite full confidentiality, integrity, and availability impact (CVSS 8.1), the CVSS vector rates attack complexity as high (AC:H), indicating exploitation is not trivial. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Assets (part of Oracle E-Business Suite, Internal Operations component) is achievable by a high-privileged, network-adjacent attacker over HTTP, per the Oracle July 2026 Critical Patch Update. With a CVSS 3.1 base score of 7.2 (C:H/I:H/A:H) and no user interaction required, successful exploitation results in complete takeover of Oracle Assets across supported releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-scope confidentiality compromise in Oracle Payroll (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read all Oracle Payroll-accessible data and, because of a scope change, impact additional connected products. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass class issue, it carries a CVSS 3.1 base score of 7.7 driven entirely by high confidentiality impact with a changed scope. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single-privilege requirement make it a credible internal-abuse risk.
Data compromise in Oracle Assets (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all Oracle Assets-accessible data. The CVSS 3.1 base score is 8.1 with high confidentiality and integrity impact but no availability impact, reflecting a data-integrity and disclosure risk rather than a service outage. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Compromise of Oracle Cost Management (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module, resulting in high confidentiality and integrity impact but no availability impact. The flaw is rated easily exploitable (CVSS 3.1 8.1, PR:L) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Cash Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, it was reported by Oracle and disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though low attack complexity and network reachability make it a notable patch priority for EBS operators.
Full compromise of Oracle SDP Number Portability (a Service Delivery Platform component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker who already holds a logon on the host where the product runs; because the CVSS scope is changed, a successful attack can pivot to significantly impact other products beyond the vulnerable component. The flaw yields high confidentiality, integrity and availability impact and results in product takeover. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized read and write access to Oracle SDP Number Portability (Oracle E-Business Suite, Internal Operations component) is achievable by a low-privileged, network-based attacker over HTTP in versions 12.2.3 through 12.2.15. Oracle rates this 8.1 (High) with high confidentiality and integrity impact, allowing an authenticated user to create, delete, or modify all data accessible to the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network reach make it a notable patching priority in the July 2026 Critical Patch Update.
Data compromise in Oracle Telecommunications Billing Integrator (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read and modify all data accessible to the application. Rated CVSS 3.1 8.1 for high confidentiality and integrity impact with no availability effect, and disclosed in Oracle's July 2026 Critical Patch Update. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Transportation Execution (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged attacker with only network HTTP access to the application. Any authenticated user account can be leveraged to fully compromise confidentiality, integrity, and availability of the module, per the CVSS 3.1 8.8 vector. No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Time and Labor module. Scored CVSS 3.1 8.1 (C:H/I:H, no availability impact), it is easily exploitable per Oracle but requires an existing low-privilege account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; fixes ship in the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read and modify all data accessible to the application. The flaw is rated CVSS 8.1 and tagged as an authentication bypass, meaning a limited account can escalate to full read/write over critical Learning Management data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the application after luring a victim into interacting. Rated CVSS 3.1 7.3 (High) with full confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the required user interaction moderates raw exploitability.
Full compromise of Oracle Service Fulfillment Manager (a Fulfillment Engine component of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible where an authenticated, low-privileged attacker with network HTTP access can escalate to complete takeover of the module. Although rated CVSS 3.1 7.5 with confidentiality, integrity and availability impact, the attack complexity is high, meaning exploitation is non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle labels it easily exploitable. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and Oracle's 'easily exploitable' wording make it a strong patch priority for EBS operators.
Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite) allows a high-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application, with a scope change that may significantly impact additional Oracle products. Affected releases span 12.2.3 through 12.2.15, and Oracle rates it CVSS 8.7 (confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is addressed in the Oracle July 2026 Critical Patch Update.
Full account takeover of Oracle Labor Distribution (part of Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to affected servers running versions 12.2.3 through 12.2.15. The flaw compromises confidentiality, integrity, and availability of the module and, per Oracle, results in complete takeover of Labor Distribution. No public exploit identified at time of analysis, though the CVSS 8.8 rating and network-reachable, low-complexity nature make it a high-priority patch in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component) is possible over HTTP by a low-privileged authenticated attacker, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, a successful attack results in complete takeover of the product with full confidentiality, integrity, and availability impact. The CVSS 3.1 score is 7.5 and Oracle rates the flaw difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise (takeover) of the Oracle Public Sector Financials module in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. The flaw carries a CVSS 3.1 base score of 7.5 and impacts confidentiality, integrity, and availability, but is rated hard to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Full compromise of the Oracle Public Sector Payroll module (Internal Operations component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible for a high-privileged attacker with network HTTP access, yielding complete takeover of the payroll application per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 7.2 with high confidentiality, integrity, and availability impact, but exploitation requires existing high-level privileges (PR:H). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Full compromise of the Oracle Public Sector Payroll module within Oracle E-Business Suite (Internal Operations component) is possible for an already-privileged attacker who can reach the application over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw affects supported EBS releases 12.2.4 through 12.2.15 and, though rated CVSS 7.2, requires high existing privileges (PR:H), which narrows the realistic attacker set to trusted or authenticated users. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in the Public Sector Payroll module (Internal Operations component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with network HTTP access fully compromise the payroll application. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and calls it 'easily exploitable,' meaning a single low-tier authenticated account is enough to seize the module. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and network reach make it a prompt-patch item from the July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle E-Business Suite's Oracle Capacity module (Internal Operations component), versions 12.2.3 through 12.2.15, allows a low-privileged attacker with HTTP network access to read all Oracle Capacity-accessible data and, due to a scope change, impact additional connected products. The flaw is easily exploitable and requires only a low-privilege account, no user interaction. It is addressed in Oracle's July 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Account/component takeover in the Oracle Customer Care module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the Customer Care component. The flaw carries a CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, and low attack complexity. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Full compromise of the Oracle Shipping Execution module of Oracle E-Business Suite (Internal Operations component) is possible for a high-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Affecting supported EBS releases 12.2.12 through 12.2.15, successful exploitation results in complete takeover of the Shipping Execution product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, so real-world urgency is tempered by the requirement for pre-existing high privileges.
Data compromise in Oracle E-Business Suite Inventory Management (Core Receiving component, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete or modify all data accessible to the Inventory Management module over HTTP. The flaw is rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, and is trivially exploitable (AC:L) once the attacker holds any valid low-privilege EBS session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the 'Authentication Bypass' tag suggests the flaw may let a low-privilege account reach functionality or data it should not.
Full compromise of Oracle Property Manager (a module of Oracle E-Business Suite) is possible for a high-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation yields complete takeover of the Property Manager component with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though Oracle rates it easily exploitable once the required privileges are held.
Unauthorized data access in Oracle Installed Base (a module of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker read all data accessible to the Installed Base application and modify some of it via HTTP. Oracle rates it CVSS 7.1, driven by high confidentiality impact and partial integrity impact with no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is disclosed as part of the Oracle July 2026 Critical Patch Update.
Data compromise in Oracle E-Business Suite's Installed Base module (Create Item Instance component) lets a low-privileged, network-authenticated attacker read, create, delete, or modify all Installed Base data across releases 12.2.3 through 12.2.15. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting full read/write compromise of the module's data without affecting uptime. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a high-priority patch item for EBS operators.
Privilege-based takeover of Oracle Project Intelligence (a module of Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the component, resulting in high confidentiality, integrity, and availability impact. Oracle rates it CVSS 3.1 8.8 and delivered the fix in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though EBS components are historically attractive post-authentication targets.
Full compromise of Oracle HCM Configuration Workbench (Rapid Implementation component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a high-privileged, network-authenticated attacker to take over the module over HTTP with high confidentiality, integrity, and availability impact. Oracle addressed the flaw in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Despite the vendor 'Information Disclosure' tag, the CVSS vector reflects a full C/I/A takeover rather than mere data exposure.
Privilege-escalation-to-takeover in Oracle Warehouse Management (Internal Operations component of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with network access over HTTP to fully compromise the module. Because CVSS scope is unchanged but all three impacts (C/I/A) are High, a successful attack results in complete takeover of Oracle Warehouse Management. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is addressed in the Oracle Critical Patch Update of July 2026.
Full compromise of Oracle Payroll (Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to the affected application, per Oracle's July 2026 Critical Patch Update. The flaw affects EBS releases 12.2.3 through 12.2.15 and, given the CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, allows takeover of Oracle Payroll. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor characterization warrant prompt patching.
Full compromise of Oracle Payroll (a module of Oracle E-Business Suite, Internal Operations component) is possible in supported releases 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access can achieve complete takeover of the Payroll application. Oracle rates the flaw CVSS 3.1 7.5 with high confidentiality, integrity and availability impact, but flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is elevated but not confirmed as active.
Full takeover of Oracle Payroll (component: Internal Operations) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged, authenticated attacker over HTTP, yielding complete compromise of confidentiality, integrity, and availability (CVSS 8.8). The flaw is described by Oracle as easily exploitable, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It was disclosed and fixed in the Oracle Critical Patch Update of July 2026.
Compromise of Oracle Work in Process, a manufacturing module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15, Internal Operations component), allows a low-privileged authenticated attacker with HTTP network access to read all data accessible to Work in Process and to alter some of it, with a scope change that can significantly impact additional Oracle products. Exploitation is rated easy by Oracle but requires human interaction from a victim other than the attacker (UI:R), pointing to a social-engineering or cross-user trigger. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Remote takeover of the Oracle Work in Process (WIP) module of Oracle E-Business Suite (component: Internal Operations) allows an unauthenticated attacker with only HTTP network access to fully compromise the application. Oracle rates this 9.8 with full confidentiality, integrity and availability impact and describes it as 'easily exploitable,' meaning no authentication, no user interaction and low attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network attack profile makes it a top-priority patch in the July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Trade Management (Oracle E-Business Suite, Claim LOV component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with network HTTP access read, create, delete, or modify all data accessible to the application. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting high confidentiality and integrity loss without affecting uptime. No public exploit identified at time of analysis, and the flaw is fixed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Trade Management (Claim LOV component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged, network-adjacent attacker read, create, delete, or modify all data accessible to the module over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact) and was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Order Management, a module of Oracle E-Business Suite (EBS), is possible via the Product Diagnostic Tools component, where a low-privileged attacker with HTTP network access can achieve complete takeover of the module. Oracle rates the flaw 8.8 (High) and describes it as 'easily exploitable,' with full confidentiality, integrity, and availability impact across EBS releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and low privilege bar make it a strong patch priority.
Data compromise in Oracle Risk Management (part of Oracle E-Business Suite 12.2.3 through 12.2.15, Internal Operations component) allows a low-privileged remote attacker with HTTP access to read, create, modify, or delete all data accessible to the application. The flaw carries a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact) and is rated by Oracle as easily exploitable, though authentication with at least low privileges is required. There is no public exploit identified at time of analysis and no CISA KEV listing.
Unauthorized data access and partial data manipulation in Oracle Advanced Pricing (the Pricing Installation component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker with network access over HTTP to read all data accessible to the module and to insert, update, or delete some of it. The flaw is rated CVSS 3.1 7.1 (High) with high confidentiality impact and low integrity impact; Oracle disclosed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though EBS pricing modules are attractive targets in enterprise ERP environments.
Unauthorized critical-data access in Oracle Advanced Pricing (Pricing Installation component) of Oracle E-Business Suite versions 12.2.14 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read all data accessible to the module and to make limited unauthorized inserts, updates, or deletes. Because the flaw carries a scope change, successful exploitation may significantly impact additional integrated E-Business Suite products beyond Pricing itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.1; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Advanced Pricing (Pricing Installation component of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates it CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Advanced Pricing (Pricing Installation component of Oracle E-Business Suite) is achievable by a low-privileged, network-adjacent attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation yields complete takeover of the Advanced Pricing module with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Full compromise of Oracle Quoting (a module of Oracle E-Business Suite) is possible for an authenticated, low-privileged attacker reaching the application over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the Quoting component with high impact to confidentiality, integrity, and availability, though Oracle rates the attack complexity as high (difficult to exploit). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthorized data compromise in Oracle Contracts Integration (Internal Operations component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. The flaw carries a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of the Oracle Quality module within Oracle E-Business Suite (Internal Operations component, versions 12.2.3 through 12.2.15) is possible for a low-privileged, authenticated attacker reaching the application over HTTP. Successful attacks lead to complete takeover of Oracle Quality with high confidentiality, integrity, and availability impact, though Oracle rates the attack complexity as high. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privileged compromise of Oracle Quality, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), allows a high-privileged attacker with HTTP network access to read all Oracle Quality-accessible data, partially modify data, and cause partial denial of service. Because the flaw carries a scope change (S:C), successful attacks can significantly impact additional products beyond Oracle Quality itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 3.1 base score of 8.2 reflects meaningful confidentiality and cross-component risk.
Data compromise in Oracle Lease and Finance Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all application-accessible data over HTTP. The CVSS 3.1 base score is 8.1 (C:H/I:H), reflecting full confidentiality and integrity impact with no availability effect. This CVE was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Project Contracts (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), it is described by Oracle as easily exploitable and requires only authenticated network access. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Full server takeover in Oracle Mobile Application Server (the MWA component of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a high-privileged, network-based attacker to fully compromise the server over HTTP, impacting confidentiality, integrity and availability (CVSS 3.1 base 7.2). Because the attacker must already hold high privileges (PR:H), this is a privilege-escalation-to-takeover issue rather than a pre-auth breach, and there is no public exploit identified at time of analysis nor CISA KEV listing.
Elevated data compromise in Oracle E-Business Suite's Customer Support module (Update Service Request component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read and modify all Customer Support-accessible data. The flaw carries high confidentiality and integrity impact (CVSS 8.1) but no availability impact, and Oracle rates it easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; remediation is delivered via Oracle's July 2026 Critical Patch Update.
SQL-layer compromise in Oracle Demand Signal Repository (part of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High), the flaw yields full confidentiality and integrity impact but no availability impact. No public exploit is identified at time of analysis and it is not in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Data tampering in Oracle Price Protection (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged remote attacker with an authenticated HTTP session to create, delete, or modify critical application data and read a subset of Price Protection data. The CVSS 3.1 base score is 7.1, driven primarily by high integrity impact (I:H) with limited confidentiality exposure (C:L) and no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-scoped compromise of Oracle Price Protection (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with local logon to the hosting infrastructure to read, create, delete, or modify all data accessible to the product. Oracle rates it CVSS 3.1 8.4 with a scope change, meaning a successful attack can significantly impact products beyond Price Protection itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle-reported EBS flaws are historically high-value targets.
Full compromise of the Oracle HCM Common Architecture module (Internal Operations component) within Oracle E-Business Suite is possible, allowing an attacker who already holds high-level application privileges to take over the module over the network via HTTP. The flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 score of 7.2 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' for an authenticated actor.
Elevated information disclosure and data tampering in Oracle Solaris 11.4 allows a low-privileged, network-authenticated attacker to abuse the Remote Administration Daemon (RAD) utility component to gain complete read access to all Solaris-accessible data and modify a subset of it, with a scope change that can significantly impact other products on the host. Oracle rates it CVSS 3.1 7.1 with high attack complexity, and it is addressed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not in CISA KEV, so exploitation is not confirmed in the wild.
Local privilege escalation and full compromise in Oracle Solaris 11.4 (Utility component) allows a low-privileged local user with logon access to the host to take over the operating system, impacting confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.0 and flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Advanced Outbound Telephony (a component of Oracle E-Business Suite) is possible when a low-privileged user with HTTP network access exploits an easily-exploitable flaw in the Internal Operations component, per the July 2026 Oracle Critical Patch Update. Successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact across all supported releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Interaction Blending, a telephony/campaign-routing module within Oracle E-Business Suite (Internal Operations component), is possible by a high-privileged attacker sending crafted HTTP requests over the network. Oracle rates successful exploitation as a complete takeover of the component with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the fix ships in Oracle's July 2026 Critical Patch Update.
Cross-context integrity compromise in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote unauthenticated attacker to manipulate, create, or delete critical data after luring a victim into interacting with malicious content, with impact spilling into other Oracle EBS products due to a scope change. Addressed in Oracle's July 2026 Critical Patch Update, it carries a CVSS 3.1 base score of 7.4 with integrity-only impact and no public exploit identified at time of analysis. The requirement for victim interaction lowers the practical exploitation rate relative to a fully unauthenticated automated attack.
Sensitive data exposure in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to obtain unauthorized access to all iSupport-accessible data over HTTP. Because the flaw carries a scope change, successful exploitation may also significantly impact other products beyond iSupport itself, though only confidentiality is affected (no integrity or availability impact). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tags it as an authentication-bypass class issue.
Data compromise in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote unauthenticated attacker to reach the application over HTTP and gain read and write access to all iSupport-accessible data. The flaw carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact, and Oracle rates it difficult to exploit (AC:H). No public exploit has been identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was supplied.
Broken access control in the Shopping Cart component of Oracle iStore (part of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the iStore application over HTTP. Tagged as an authentication-bypass class issue, it carries a CVSS 3.1 base score of 8.1 driven by high confidentiality and integrity impact with no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle iStore (the Oracle E-Business Suite customer-facing web storefront) is possible via its Shopping Cart component in releases 12.2.3 through 12.2.15, where a high-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.2 and shipped a fix in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Supply Chain Trading Connector (Collaboration History component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows remote attackers to read all data accessible to the product over HTTP and make limited unauthorized modifications. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.2, the flaw is tagged as an authentication bypass and requires no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network exposure make it a strong patching priority for EBS operators.
Account/component takeover in Oracle Bills of Material (component: Internal Operations) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the module when a legitimate user is lured into interacting with attacker-supplied content. Per the CVSS vector (PR:L/UI:R), exploitation requires an existing low-level account plus victim interaction, but a successful attack yields high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). No public exploit identified at time of analysis; disclosed via Oracle's July 2026 Critical Patch Update.
Takeover of Oracle Cost Management, the costing module of Oracle E-Business Suite (component: Costing Transaction Errors), is achievable by a low-privileged attacker with HTTP network access. Successful exploitation yields full confidentiality, integrity, and availability compromise of the module across EBS releases 12.2.3 through 12.2.15. Rated CVSS 3.1 7.5 but explicitly difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not on the CISA KEV list.
Sensitive data exposure in Oracle Compensation Workbench (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read all data accessible to the component and perform limited unauthorized inserts, updates, or deletes over HTTP. Rated CVSS 7.1 (C:H/I:L/A:N), it was disclosed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not on CISA KEV, though EBS is a high-value target and Oracle CPU flaws have historically drawn attacker interest.
Unauthorized data access in Oracle E-Business Suite's Compensation Workbench component (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to read all data accessible to the module and to modify some of it. Oracle rates this CVSS 7.1 (C:H/I:L). No public exploit is identified at time of analysis and it is not listed in CISA KEV, though it was disclosed in Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle TeleSales (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all TeleSales-accessible data. The flaw is rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and is tagged as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Sales Offline (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible for an already high-privileged attacker who reaches the Internal Operations component over HTTP, and because the flaw carries a scope change (S:C) a successful attack can significantly impact additional products beyond Sales Offline itself. The issue is rated CVSS 3.1 8.0 but Oracle characterizes it as difficult to exploit (AC:H) and requiring elevated privileges (PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle Sales Offline, a module of Oracle E-Business Suite (Internal Operations component) versions 12.2.3 through 12.2.15, lets a low-privileged authenticated attacker with HTTP network access fully compromise the product. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable' and resulting in complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its inclusion in Oracle's July 2026 Critical Patch Update warrants prompt patching.
Broad data compromise in Oracle Sales Offline (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all data the application can access and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 8.3 (C:H/I:H/A:L) and describes it as easily exploitable, disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a strong patching priority.
Full compromise of Oracle Receivables (the accounts-receivable module of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible via the Internal Operations component, where an authenticated attacker holding high privileges can send crafted HTTP requests to take over the module. Oracle rates this CVSS 7.2 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' but exploitation is gated behind existing high-privilege access. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Receivables (Oracle E-Business Suite, Internal Operations component) is possible in versions 12.2.3 through 12.2.15, where a high-privileged attacker with network HTTP access can take over the module, impacting confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable, though it requires existing high privileges (PR:H). No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle iReceivables (a self-service receivables module of Oracle E-Business Suite, AR Web Utilities component) is possible by a remote unauthenticated attacker over HTTP, affecting EBS releases 12.2.3 through 12.2.15. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact, though the CVSS vector rates exploitation as high-complexity. Addressed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Trading Community (Oracle E-Business Suite, Party Search UI component) allows a low-privileged attacker with network HTTP access to read and modify all data accessible to the Trading Community module. Fixed in the Oracle Critical Patch Update of July 2026 (CPUJUL2026), the flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the vendor tag 'Authentication Bypass' suggests the Party Search UI may permit access beyond the attacker's intended authorization scope.
Account takeover in Oracle iReceivables (Oracle E-Business Suite, AR Web Utilities component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access fully compromise the module. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning a valid low-privilege EBS account is the only real barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-but-low privilege requirement make it a strong patching priority.
Complete takeover of Oracle Workflow (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is possible by a remote unauthenticated attacker who reaches the product over SMTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 8.1 with high confidentiality, integrity, and availability impact, but carries high attack complexity, meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Payments (Oracle E-Business Suite, File Transmission component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the Payments module over HTTP. Oracle rates it CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and it is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor 'Authentication Bypass' tag and low attack complexity make it an attractive target in EBS-exposed environments.
Unauthorized data access in Oracle Applications Framework (the OAF layer of Oracle E-Business Suite) lets a low-privileged, network-based attacker abuse the Search Bean [Incl. Advanced] component to read all OAF-accessible data and perform limited unauthorized updates, inserts, or deletes. Affected releases span EBS 12.2.3 through 12.2.15, and the flaw is rated CVSS 3.1 7.1 with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and it is addressed in Oracle's July 2026 Critical Patch Update.
Privilege escalation and cross-product compromise in Oracle Application Object Library (the core AOL/FND framework of Oracle E-Business Suite versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read and modify all AOL-accessible data and, because of a scope change, significantly impact other Oracle EBS products beyond AOL itself. Rated CVSS 3.1 9.6 (Critical) with confidentiality and integrity impact but no availability effect, it is remotely exploitable over HTTPS with low attack complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering in Oracle E-Business Suite's Financials Common Modules (Common Components) lets a low-privileged, network-authenticated attacker perform unauthorized creation, deletion, and modification of critical financial data across all module-accessible records, plus read access to a subset of that data. Affected releases span 12.2.3 through 12.2.15, remediated in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though the tag 'Authentication Bypass' warrants scrutiny given the authenticated CVSS profile.
Data compromise in Oracle Complex Maintenance, Repair and Overhaul (cMRO), a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged authenticated attacker with HTTP network access to read and modify critical application data. The flaw affects the Internal Operations component and yields high confidentiality and integrity impact (CVSS 8.1) with no availability effect. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Application Object Library (the core framework component of Oracle E-Business Suite) is possible in versions 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access can escalate to complete takeover of the component. Oracle rates this CVSS 3.1 7.5 with full confidentiality, integrity, and availability impact, though the attack is flagged as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the shared-infrastructure nature of AOL makes successful exploitation high-consequence.
Data compromise in Oracle Applications Framework (12.2.3 through 12.2.15), a core component of Oracle E-Business Suite, allows a low-privileged authenticated attacker with HTTP network access to read, create, modify, or delete all data accessible to the framework via the Graph/Charting component. The Oracle-assigned CVSS 3.1 base score is 8.1 (C:H/I:H) with no availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor-supplied 'Authentication Bypass' tag suggests low authentication barriers relative to the damage achievable.
Data compromise in Oracle Financials Common Modules (Common Components) within Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Oracle rates it CVSS 3.1 8.1 (high confidentiality and integrity impact, no availability impact) and tags it as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Applications Manager (a management console within Oracle E-Business Suite) is possible through the Command Line - RapidClone component in EBS versions 12.2.3 through 12.2.15. An attacker who already has logon access to the host infrastructure where the component runs can compromise it without any application-level authentication, gaining full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; it was disclosed by Oracle in the July 2026 Critical Patch Update.
Complete takeover of Oracle EDI Gateway (a component of Oracle E-Business Suite) is possible by an unauthenticated remote attacker over HTTP, affecting supported versions 12.2.3 through 12.2.15 per Oracle's July 2026 Critical Patch Update. Despite full confidentiality, integrity, and availability impact (CVSS 8.1), the CVSS vector rates attack complexity as high (AC:H), indicating exploitation is not trivial. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Assets (part of Oracle E-Business Suite, Internal Operations component) is achievable by a high-privileged, network-adjacent attacker over HTTP, per the Oracle July 2026 Critical Patch Update. With a CVSS 3.1 base score of 7.2 (C:H/I:H/A:H) and no user interaction required, successful exploitation results in complete takeover of Oracle Assets across supported releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-scope confidentiality compromise in Oracle Payroll (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read all Oracle Payroll-accessible data and, because of a scope change, impact additional connected products. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass class issue, it carries a CVSS 3.1 base score of 7.7 driven entirely by high confidentiality impact with a changed scope. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single-privilege requirement make it a credible internal-abuse risk.
Data compromise in Oracle Assets (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all Oracle Assets-accessible data. The CVSS 3.1 base score is 8.1 with high confidentiality and integrity impact but no availability impact, reflecting a data-integrity and disclosure risk rather than a service outage. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Compromise of Oracle Cost Management (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module, resulting in high confidentiality and integrity impact but no availability impact. The flaw is rated easily exploitable (CVSS 3.1 8.1, PR:L) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Cash Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, it was reported by Oracle and disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though low attack complexity and network reachability make it a notable patch priority for EBS operators.