Order Management
Monthly
Oracle Order Management's Product Diagnostic Tools component exposes a local privilege-dependent flaw affecting versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, allowing a high-privileged local attacker to achieve unauthorized read and write access to critical data with scope impact extending beyond the Order Management module itself. The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) confirms that exploitation is constrained to infrastructure-level access, requiring both physical or logical logon to the host system and an elevated account, but successful exploitation yields complete confidentiality and integrity compromise. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed.
Oracle Order Management's Product Diagnostic Tools component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 can be fully compromised by a low-privileged attacker over HTTP, resulting in complete system takeover with high confidentiality, integrity, and availability impact. The attack requires low privileges and high complexity to execute, reducing the immediacy of the threat but not its severity if conditions are met. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access in Oracle Order Management's Product Diagnostic Tools component allows low-privileged authenticated attackers over HTTP to compromise confidentiality of critical order data and perform limited data manipulation, with a confirmed scope change that can extend impact to adjacent Oracle E-Business Suite components. Affected deployments span a wide version range, 12.2.3 through 12.2.15, and are addressed in Oracle's Critical Patch Update for August 2026. No public exploit code has been identified at time of analysis, though the Authentication Bypass tag associated with this CVE signals a potentially exploitable access control weakness in the diagnostic sub-component.
Data compromise in Oracle Order Management (Product Diagnostic Tools component) of Oracle E-Business Suite versions 12.2.4 through 12.2.15 allows a low-privileged, network-adjacent attacker over HTTP to read, create, delete, or modify all Order Management-accessible data. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability effect, this flaw is described by Oracle as easily exploitable and is fixed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Order Management (part of Oracle E-Business Suite) is possible via the Product Diagnostic Tools component in supported releases 12.2.3 through 12.2.15, where an authenticated high-privileged user with HTTP network access can achieve a complete takeover of the module with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix is delivered in the Oracle Critical Patch Update of July 2026.
Full compromise of Oracle Order Management, a module of Oracle E-Business Suite (EBS), is possible via the Product Diagnostic Tools component, where a low-privileged attacker with HTTP network access can achieve complete takeover of the module. Oracle rates the flaw 8.8 (High) and describes it as 'easily exploitable,' with full confidentiality, integrity, and availability impact across EBS releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and low privilege bar make it a strong patch priority.
Unauthorized data disclosure in Oracle Order Management's Product Diagnostic Tools component (E-Business Suite 12.2.3-12.2.15) allows a low-privileged network attacker to read all data accessible to the application over HTTP with no user interaction required. The 'Authentication Bypass' tag suggests the diagnostic interface fails to enforce proper authorization boundaries, enabling a minimally privileged account to exceed its intended data access scope. No public exploit has been identified at time of analysis, but the low attack complexity and ERP-grade data sensitivity - order records, customer PII, financial data - elevate business impact well beyond the moderate CVSS 6.5 score.
Oracle Order Management's Product Diagnostic Tools component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised by a low-privileged authenticated attacker over HTTP, resulting in unauthorized read and write access to Order Management data. The scope change (S:C in CVSS) indicates successful exploitation can cascade to impact additional Oracle EBS modules beyond Order Management itself. Tagged as an Authentication Bypass, no public exploit has been identified at time of analysis, though the patch is included in Oracle's CPU July 2026 release.
Unauthorized critical data disclosure in Oracle Order Management (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 stems from a flaw in the Product Diagnostic Tools component, exploitable by a high-privileged attacker over HTTP with no user interaction. Successful exploitation triggers a scope change, meaning the compromise can extend to additional Oracle products accessible through the Order Management context, resulting in complete access to all confidential data within that reach. No public exploit has been identified at time of analysis, and a fix is available via Oracle's Critical Patch Update for July 2026.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Veribilim Software Veribase Order Management allows OS Command Injection.010.2. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Order Management component of Oracle E-Business Suite (subcomponent: Product Diagnostic Tools). Rated high severity (CVSS 7.0).
Oracle Order Management's Product Diagnostic Tools component exposes a local privilege-dependent flaw affecting versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, allowing a high-privileged local attacker to achieve unauthorized read and write access to critical data with scope impact extending beyond the Order Management module itself. The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) confirms that exploitation is constrained to infrastructure-level access, requiring both physical or logical logon to the host system and an elevated account, but successful exploitation yields complete confidentiality and integrity compromise. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed.
Oracle Order Management's Product Diagnostic Tools component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 can be fully compromised by a low-privileged attacker over HTTP, resulting in complete system takeover with high confidentiality, integrity, and availability impact. The attack requires low privileges and high complexity to execute, reducing the immediacy of the threat but not its severity if conditions are met. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access in Oracle Order Management's Product Diagnostic Tools component allows low-privileged authenticated attackers over HTTP to compromise confidentiality of critical order data and perform limited data manipulation, with a confirmed scope change that can extend impact to adjacent Oracle E-Business Suite components. Affected deployments span a wide version range, 12.2.3 through 12.2.15, and are addressed in Oracle's Critical Patch Update for August 2026. No public exploit code has been identified at time of analysis, though the Authentication Bypass tag associated with this CVE signals a potentially exploitable access control weakness in the diagnostic sub-component.
Data compromise in Oracle Order Management (Product Diagnostic Tools component) of Oracle E-Business Suite versions 12.2.4 through 12.2.15 allows a low-privileged, network-adjacent attacker over HTTP to read, create, delete, or modify all Order Management-accessible data. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability effect, this flaw is described by Oracle as easily exploitable and is fixed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Order Management (part of Oracle E-Business Suite) is possible via the Product Diagnostic Tools component in supported releases 12.2.3 through 12.2.15, where an authenticated high-privileged user with HTTP network access can achieve a complete takeover of the module with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix is delivered in the Oracle Critical Patch Update of July 2026.
Full compromise of Oracle Order Management, a module of Oracle E-Business Suite (EBS), is possible via the Product Diagnostic Tools component, where a low-privileged attacker with HTTP network access can achieve complete takeover of the module. Oracle rates the flaw 8.8 (High) and describes it as 'easily exploitable,' with full confidentiality, integrity, and availability impact across EBS releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and low privilege bar make it a strong patch priority.
Unauthorized data disclosure in Oracle Order Management's Product Diagnostic Tools component (E-Business Suite 12.2.3-12.2.15) allows a low-privileged network attacker to read all data accessible to the application over HTTP with no user interaction required. The 'Authentication Bypass' tag suggests the diagnostic interface fails to enforce proper authorization boundaries, enabling a minimally privileged account to exceed its intended data access scope. No public exploit has been identified at time of analysis, but the low attack complexity and ERP-grade data sensitivity - order records, customer PII, financial data - elevate business impact well beyond the moderate CVSS 6.5 score.
Oracle Order Management's Product Diagnostic Tools component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised by a low-privileged authenticated attacker over HTTP, resulting in unauthorized read and write access to Order Management data. The scope change (S:C in CVSS) indicates successful exploitation can cascade to impact additional Oracle EBS modules beyond Order Management itself. Tagged as an Authentication Bypass, no public exploit has been identified at time of analysis, though the patch is included in Oracle's CPU July 2026 release.
Unauthorized critical data disclosure in Oracle Order Management (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 stems from a flaw in the Product Diagnostic Tools component, exploitable by a high-privileged attacker over HTTP with no user interaction. Successful exploitation triggers a scope change, meaning the compromise can extend to additional Oracle products accessible through the Order Management context, resulting in complete access to all confidential data within that reach. No public exploit has been identified at time of analysis, and a fix is available via Oracle's Critical Patch Update for July 2026.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Veribilim Software Veribase Order Management allows OS Command Injection.010.2. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Order Management component of Oracle E-Business Suite (subcomponent: Product Diagnostic Tools). Rated high severity (CVSS 7.0).