Sales
Monthly
Full compromise of Oracle Sales (E-Business Suite component: Internal Operations) is achievable by a low-privileged network attacker via HTTP across versions 12.2.3 through 12.2.15, with successful exploitation resulting in complete takeover - high confidentiality, integrity, and availability impact. The attack is constrained by high complexity (AC:H), meaning reliable exploitation requires meeting specific, non-trivial conditions rather than simple request crafting. Disclosed through Oracle's August 2026 Critical Security Patch Update, no public exploit or active exploitation has been identified at time of analysis.
Oracle Sales within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes an authorization flaw in its Internal Operations component that enables low-privileged authenticated network attackers to access all Oracle Sales data they should not be authorized to view, and perform limited unauthorized data manipulation via HTTP. The CVSS 3.1 score of 7.1 reflects a high confidentiality impact - complete access to all Oracle Sales accessible data - combined with a low integrity impact allowing unauthorized insert, update, or delete operations. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV, but the ease of exploitation (AC:L, no UI required) combined with the data sensitivity of a CRM/sales platform makes this a meaningful organizational risk.
Oracle Sales versions 12.2.3 through 12.2.15 within Oracle E-Business Suite allows low-privileged, network-authenticated attackers to gain full read and write access to critical data via the Internal Operations component over HTTP. The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impacts with low attack complexity, making this easily exploitable by any user with a valid low-privilege account. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; Oracle's Critical Security Patch Update for August 2026 addresses this flaw.
Full compromise of Oracle Sales (E-Business Suite component: Internal Operations) is achievable by a low-privileged network attacker via HTTP across versions 12.2.3 through 12.2.15, with successful exploitation resulting in complete takeover - high confidentiality, integrity, and availability impact. The attack is constrained by high complexity (AC:H), meaning reliable exploitation requires meeting specific, non-trivial conditions rather than simple request crafting. Disclosed through Oracle's August 2026 Critical Security Patch Update, no public exploit or active exploitation has been identified at time of analysis.
Oracle Sales within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes an authorization flaw in its Internal Operations component that enables low-privileged authenticated network attackers to access all Oracle Sales data they should not be authorized to view, and perform limited unauthorized data manipulation via HTTP. The CVSS 3.1 score of 7.1 reflects a high confidentiality impact - complete access to all Oracle Sales accessible data - combined with a low integrity impact allowing unauthorized insert, update, or delete operations. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV, but the ease of exploitation (AC:L, no UI required) combined with the data sensitivity of a CRM/sales platform makes this a meaningful organizational risk.
Oracle Sales versions 12.2.3 through 12.2.15 within Oracle E-Business Suite allows low-privileged, network-authenticated attackers to gain full read and write access to critical data via the Internal Operations component over HTTP. The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impacts with low attack complexity, making this easily exploitable by any user with a valid low-privilege account. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; Oracle's Critical Security Patch Update for August 2026 addresses this flaw.