Property Manager
Monthly
Full compromise of Oracle Property Manager (a module of Oracle E-Business Suite) is possible for a high-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation yields complete takeover of the Property Manager component with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though Oracle rates it easily exploitable once the required privileges are held.
Oracle Property Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes a low-severity information disclosure flaw in the Internal Operations component that allows a highly privileged local attacker to read an unauthorized subset of Property Manager data under difficult exploitation conditions. The CVSS 3.1 score of 1.9 reflects the combined constraints of local infrastructure access, high privilege prerequisites, and high attack complexity, resulting in only partial confidentiality impact with no integrity or availability exposure. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; this is addressed in Oracle's Critical Patch Update for July 2026.
Unauthorized data access in Oracle Property Manager (E-Business Suite component: Internal Operations) allows low-privileged authenticated network attackers to read and manipulate property management data via HTTP. Affected versions span 12.2.3 through 12.2.15. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low attack complexity and broad version range make patching a near-term priority for EBS deployments.
Unauthorized data access and modification in Oracle Property Manager (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a network-authenticated low-privileged attacker via HTTP when a victim user interacts with attacker-controlled content, triggering a scope change that may impact additional EBS components. The vulnerability permits unauthorized read access to a subset of Property Manager data and unauthorized insert, update, or delete operations on accessible data. No public exploit code or CISA KEV listing is identified at time of analysis, but the 'Authentication Bypass' tag signals a potential authorization control failure beyond the base CVSS score suggests.
Full compromise of Oracle Property Manager (a module of Oracle E-Business Suite) is possible for a high-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation yields complete takeover of the Property Manager component with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though Oracle rates it easily exploitable once the required privileges are held.
Oracle Property Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes a low-severity information disclosure flaw in the Internal Operations component that allows a highly privileged local attacker to read an unauthorized subset of Property Manager data under difficult exploitation conditions. The CVSS 3.1 score of 1.9 reflects the combined constraints of local infrastructure access, high privilege prerequisites, and high attack complexity, resulting in only partial confidentiality impact with no integrity or availability exposure. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; this is addressed in Oracle's Critical Patch Update for July 2026.
Unauthorized data access in Oracle Property Manager (E-Business Suite component: Internal Operations) allows low-privileged authenticated network attackers to read and manipulate property management data via HTTP. Affected versions span 12.2.3 through 12.2.15. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low attack complexity and broad version range make patching a near-term priority for EBS deployments.
Unauthorized data access and modification in Oracle Property Manager (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a network-authenticated low-privileged attacker via HTTP when a victim user interacts with attacker-controlled content, triggering a scope change that may impact additional EBS components. The vulnerability permits unauthorized read access to a subset of Property Manager data and unauthorized insert, update, or delete operations on accessible data. No public exploit code or CISA KEV listing is identified at time of analysis, but the 'Authentication Bypass' tag signals a potential authorization control failure beyond the base CVSS score suggests.