Production Scheduling
Monthly
Full takeover of Oracle Production Scheduling (part of Oracle E-Business Suite, Internal Operations component) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host, provided a legitimate user is tricked into interacting. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation compromises the confidentiality, integrity, and availability of the Production Scheduling engine. There is no public exploit identified at time of analysis, and the high attack complexity combined with adjacent-network and user-interaction requirements substantially constrains real-world exploitability.
Oracle Production Scheduling versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes a network-accessible HTTP endpoint in its Internal Operations component that can be abused by a low-privileged authenticated attacker to read all data accessible to the application. The impact is limited to confidentiality - no integrity or availability loss - but the scope covers 'complete access to all Oracle Production Scheduling accessible data,' which may include sensitive operational and supply-chain planning records. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Unauthorized data disclosure in Oracle Production Scheduling (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged network attacker to gain complete read access to all data within the application via a difficult-to-exploit flaw in the User Interface component. Tagged as an authentication bypass, the vulnerability suggests improper access control enforcement in the UI layer that permits privilege escalation beyond the attacker's normally granted permissions, enabling full confidentiality compromise of Production Scheduling data. No public exploit code or active exploitation has been identified; Oracle addressed this in the Critical Patch Update for July 2026.
Full takeover of Oracle Production Scheduling (part of Oracle E-Business Suite, Internal Operations component) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host, provided a legitimate user is tricked into interacting. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation compromises the confidentiality, integrity, and availability of the Production Scheduling engine. There is no public exploit identified at time of analysis, and the high attack complexity combined with adjacent-network and user-interaction requirements substantially constrains real-world exploitability.
Oracle Production Scheduling versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes a network-accessible HTTP endpoint in its Internal Operations component that can be abused by a low-privileged authenticated attacker to read all data accessible to the application. The impact is limited to confidentiality - no integrity or availability loss - but the scope covers 'complete access to all Oracle Production Scheduling accessible data,' which may include sensitive operational and supply-chain planning records. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Unauthorized data disclosure in Oracle Production Scheduling (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged network attacker to gain complete read access to all data within the application via a difficult-to-exploit flaw in the User Interface component. Tagged as an authentication bypass, the vulnerability suggests improper access control enforcement in the UI layer that permits privilege escalation beyond the attacker's normally granted permissions, enabling full confidentiality compromise of Production Scheduling data. No public exploit code or active exploitation has been identified; Oracle addressed this in the Critical Patch Update for July 2026.