Process Manufacturing Product Development
Monthly
Takeover of Oracle Process Manufacturing (OPM) Product Development is possible in Oracle E-Business Suite 12.2.15 via its Quality Management Specs component, where a low-privileged attacker with HTTP network access can fully compromise the module. Oracle rates this 8.8 (High) with full confidentiality, integrity, and availability impact, and flags it as easily exploitable, meaning a valid but low-privilege application account is the only barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle E-Business Suite's Oracle Process Manufacturing Product Development component (versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the module. Rated CVSS 8.1 with high confidentiality and integrity impact but no availability impact, it is addressed in Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, though the 'easily exploitable' characterization by Oracle and low attack complexity raise concern for internet-exposed EBS instances.
Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Manager Specification). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Management Specs). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Takeover of Oracle Process Manufacturing (OPM) Product Development is possible in Oracle E-Business Suite 12.2.15 via its Quality Management Specs component, where a low-privileged attacker with HTTP network access can fully compromise the module. Oracle rates this 8.8 (High) with full confidentiality, integrity, and availability impact, and flags it as easily exploitable, meaning a valid but low-privilege application account is the only barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle E-Business Suite's Oracle Process Manufacturing Product Development component (versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the module. Rated CVSS 8.1 with high confidentiality and integrity impact but no availability impact, it is addressed in Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, though the 'easily exploitable' characterization by Oracle and low attack complexity raise concern for internet-exposed EBS instances.
Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Manager Specification). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Management Specs). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.