Sales Offline
Monthly
Full compromise of Oracle Sales Offline (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible for an already high-privileged attacker who reaches the Internal Operations component over HTTP, and because the flaw carries a scope change (S:C) a successful attack can significantly impact additional products beyond Sales Offline itself. The issue is rated CVSS 3.1 8.0 but Oracle characterizes it as difficult to exploit (AC:H) and requiring elevated privileges (PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle Sales Offline, a module of Oracle E-Business Suite (Internal Operations component) versions 12.2.3 through 12.2.15, lets a low-privileged authenticated attacker with HTTP network access fully compromise the product. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable' and resulting in complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its inclusion in Oracle's July 2026 Critical Patch Update warrants prompt patching.
Broad data compromise in Oracle Sales Offline (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all data the application can access and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 8.3 (C:H/I:H/A:L) and describes it as easily exploitable, disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a strong patching priority.
Data compromise in Oracle Sales Offline (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis; not listed in CISA KEV.
Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Core Components). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Offline Template). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Template). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Template). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Full compromise of Oracle Sales Offline (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible for an already high-privileged attacker who reaches the Internal Operations component over HTTP, and because the flaw carries a scope change (S:C) a successful attack can significantly impact additional products beyond Sales Offline itself. The issue is rated CVSS 3.1 8.0 but Oracle characterizes it as difficult to exploit (AC:H) and requiring elevated privileges (PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle Sales Offline, a module of Oracle E-Business Suite (Internal Operations component) versions 12.2.3 through 12.2.15, lets a low-privileged authenticated attacker with HTTP network access fully compromise the product. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable' and resulting in complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its inclusion in Oracle's July 2026 Critical Patch Update warrants prompt patching.
Broad data compromise in Oracle Sales Offline (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all data the application can access and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 8.3 (C:H/I:H/A:L) and describes it as easily exploitable, disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a strong patching priority.
Data compromise in Oracle Sales Offline (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis; not listed in CISA KEV.
Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Core Components). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Offline Template). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Template). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Template). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.