Product Workbench
Monthly
Unauthorized read and write access to critical data in Oracle Product Workbench (Internal Operations component of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to create, delete, or modify all data accessible to the application. The flaw is rated CVSS 8.1 with high confidentiality and integrity impact but no availability impact, was reported by Oracle's own security team in the July 2026 Critical Patch Update, and is tagged as an authentication-bypass-class issue. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Product Workbench (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged remote attacker with HTTP access read, create, modify, or delete all data accessible to the application. The CVSS 3.1 base score of 8.1 reflects full confidentiality and integrity loss with no availability impact. The flaw is tagged as an authentication-bypass-class issue and was disclosed by Oracle in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Oracle Product Workbench's WebUI component within E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated attackers reachable over HTTP to perform unauthorized data reads, inserts, updates, and deletions against accessible product data, and to cause partial denial of service. Oracle's CPU July 2026 advisory characterizes the vulnerability as 'easily exploitable,' indicating a low-complexity attack path once valid low-level credentials are obtained. No public exploit code or CISA KEV listing has been identified at time of analysis, placing current exploitation status as unconfirmed.
Unauthorized read and write access to critical data in Oracle Product Workbench (Internal Operations component of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to create, delete, or modify all data accessible to the application. The flaw is rated CVSS 8.1 with high confidentiality and integrity impact but no availability impact, was reported by Oracle's own security team in the July 2026 Critical Patch Update, and is tagged as an authentication-bypass-class issue. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Product Workbench (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged remote attacker with HTTP access read, create, modify, or delete all data accessible to the application. The CVSS 3.1 base score of 8.1 reflects full confidentiality and integrity loss with no availability impact. The flaw is tagged as an authentication-bypass-class issue and was disclosed by Oracle in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Oracle Product Workbench's WebUI component within E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated attackers reachable over HTTP to perform unauthorized data reads, inserts, updates, and deletions against accessible product data, and to cause partial denial of service. Oracle's CPU July 2026 advisory characterizes the vulnerability as 'easily exploitable,' indicating a low-complexity attack path once valid low-level credentials are obtained. No public exploit code or CISA KEV listing has been identified at time of analysis, placing current exploitation status as unconfirmed.