Product Workbench
Monthly
Authenticated takeover of Oracle Product Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker reaching the application over HTTP, with the vendor scoring it 8.5 for high confidentiality, integrity and availability impact plus a scope change that extends damage onto other EBS products. Exploitation is rated difficult (AC:H) because the attacker must satisfy specific conditions inside the Internal Operations component, and no public exploit code or CISA KEV entry has been identified at time of analysis. No EPSS score was supplied, so real-world exploitation likelihood is not independently quantified and the flaw should be treated as a patch-cycle priority rather than a confirmed emergency.
Oracle Product Workbench, a module within Oracle E-Business Suite, permits a low-privileged attacker who already holds a valid account and HTTP network access to read, create, delete, or modify critical business data across the module's Internal Operations component, affecting supported releases 12.2.3 through 12.2.15. With CVSS 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), exploitation requires only an authenticated session rather than user interaction or a race condition. No public exploit code, POC, or CISA KEV entry has been identified at time of analysis, and no EPSS score was supplied, so the current risk is driven by the low skill barrier and the sensitivity of ERP data rather than confirmed active exploitation.
Low-privileged users with network access to Oracle E-Business Suite's Product Workbench component (Internal Operations) can read, create, modify, and delete critical business data across the full 12.2.3–12.2.15 release range. Oracle rates this 8.1 with a network-accessible, low-complexity, no-user-interaction vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning a valid but unprivileged account is enough to reach full confidentiality and integrity impact on Product Workbench data, with no availability impact. No CISA KEV listing, no public exploit code, and no EPSS score were provided in the source data, so current exploitation activity is unconfirmed — though Oracle CPU-class issues in EBS are historically targeted by attackers who already hold a foothold account.
Unauthorized read and write access to critical data in Oracle Product Workbench (Internal Operations component of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to create, delete, or modify all data accessible to the application. The flaw is rated CVSS 8.1 with high confidentiality and integrity impact but no availability impact, was reported by Oracle's own security team in the July 2026 Critical Patch Update, and is tagged as an authentication-bypass-class issue. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Product Workbench (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged remote attacker with HTTP access read, create, modify, or delete all data accessible to the application. The CVSS 3.1 base score of 8.1 reflects full confidentiality and integrity loss with no availability impact. The flaw is tagged as an authentication-bypass-class issue and was disclosed by Oracle in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Authenticated attackers holding only low-privileged credentials in Oracle E-Business Suite can exploit a WebUI flaw in Oracle Product Workbench 12.2.3 through 12.2.15 to read and tamper with application data, provided they can convince another user to interact with a crafted request. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), with a scope change meaning downstream components of the E-Business Suite may also be affected. No public exploit code or active exploitation has been identified in the supplied intelligence, and no EPSS score was provided.
Oracle Product Workbench's WebUI component within E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated attackers reachable over HTTP to perform unauthorized data reads, inserts, updates, and deletions against accessible product data, and to cause partial denial of service. Oracle's CPU July 2026 advisory characterizes the vulnerability as 'easily exploitable,' indicating a low-complexity attack path once valid low-level credentials are obtained. No public exploit code or CISA KEV listing has been identified at time of analysis, placing current exploitation status as unconfirmed.
Authenticated takeover of Oracle Product Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker reaching the application over HTTP, with the vendor scoring it 8.5 for high confidentiality, integrity and availability impact plus a scope change that extends damage onto other EBS products. Exploitation is rated difficult (AC:H) because the attacker must satisfy specific conditions inside the Internal Operations component, and no public exploit code or CISA KEV entry has been identified at time of analysis. No EPSS score was supplied, so real-world exploitation likelihood is not independently quantified and the flaw should be treated as a patch-cycle priority rather than a confirmed emergency.
Oracle Product Workbench, a module within Oracle E-Business Suite, permits a low-privileged attacker who already holds a valid account and HTTP network access to read, create, delete, or modify critical business data across the module's Internal Operations component, affecting supported releases 12.2.3 through 12.2.15. With CVSS 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), exploitation requires only an authenticated session rather than user interaction or a race condition. No public exploit code, POC, or CISA KEV entry has been identified at time of analysis, and no EPSS score was supplied, so the current risk is driven by the low skill barrier and the sensitivity of ERP data rather than confirmed active exploitation.
Low-privileged users with network access to Oracle E-Business Suite's Product Workbench component (Internal Operations) can read, create, modify, and delete critical business data across the full 12.2.3–12.2.15 release range. Oracle rates this 8.1 with a network-accessible, low-complexity, no-user-interaction vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning a valid but unprivileged account is enough to reach full confidentiality and integrity impact on Product Workbench data, with no availability impact. No CISA KEV listing, no public exploit code, and no EPSS score were provided in the source data, so current exploitation activity is unconfirmed — though Oracle CPU-class issues in EBS are historically targeted by attackers who already hold a foothold account.
Unauthorized read and write access to critical data in Oracle Product Workbench (Internal Operations component of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to create, delete, or modify all data accessible to the application. The flaw is rated CVSS 8.1 with high confidentiality and integrity impact but no availability impact, was reported by Oracle's own security team in the July 2026 Critical Patch Update, and is tagged as an authentication-bypass-class issue. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Product Workbench (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged remote attacker with HTTP access read, create, modify, or delete all data accessible to the application. The CVSS 3.1 base score of 8.1 reflects full confidentiality and integrity loss with no availability impact. The flaw is tagged as an authentication-bypass-class issue and was disclosed by Oracle in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Authenticated attackers holding only low-privileged credentials in Oracle E-Business Suite can exploit a WebUI flaw in Oracle Product Workbench 12.2.3 through 12.2.15 to read and tamper with application data, provided they can convince another user to interact with a crafted request. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), with a scope change meaning downstream components of the E-Business Suite may also be affected. No public exploit code or active exploitation has been identified in the supplied intelligence, and no EPSS score was provided.
Oracle Product Workbench's WebUI component within E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated attackers reachable over HTTP to perform unauthorized data reads, inserts, updates, and deletions against accessible product data, and to cause partial denial of service. Oracle's CPU July 2026 advisory characterizes the vulnerability as 'easily exploitable,' indicating a low-complexity attack path once valid low-level credentials are obtained. No public exploit code or CISA KEV listing has been identified at time of analysis, placing current exploitation status as unconfirmed.