Sales Foundation
Monthly
Full takeover of Oracle Sales Foundation (E-Business Suite 12.2.3-12.2.15) is achievable by a low-privileged network attacker via HTTP, targeting the Security API component. The vulnerability is rated CVSS 8.8 with high impact across confidentiality, integrity, and availability, indicating the attacker can gain complete control of the affected application. No public exploit or CISA KEV listing has been identified at time of analysis, though Oracle's classification as 'easily exploitable' elevates urgency for patching.
Unauthorized data access and modification in Oracle Sales Foundation (Oracle E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The vulnerability resides in the Security API component and is tagged as an authentication bypass, enabling an attacker to read, create, delete, or modify critical data across the entire Sales Foundation dataset. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog, though the low exploitation complexity makes this a realistic near-term threat for exposed deployments.
Full takeover of Oracle Sales Foundation (E-Business Suite 12.2.3-12.2.15) is achievable by a low-privileged network attacker via HTTP, targeting the Security API component. The vulnerability is rated CVSS 8.8 with high impact across confidentiality, integrity, and availability, indicating the attacker can gain complete control of the affected application. No public exploit or CISA KEV listing has been identified at time of analysis, though Oracle's classification as 'easily exploitable' elevates urgency for patching.
Unauthorized data access and modification in Oracle Sales Foundation (Oracle E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The vulnerability resides in the Security API component and is tagged as an authentication bypass, enabling an attacker to read, create, delete, or modify critical data across the entire Sales Foundation dataset. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog, though the low exploitation complexity makes this a realistic near-term threat for exposed deployments.