Service Delivery Platform Number Portability
Monthly
Oracle SDP Number Portability versions 12.2.3 through 12.2.15, a telecommunications management component of Oracle E-Business Suite, exposes a local privilege-abuse flaw in its Internal Operations component that enables high-privileged insiders or post-breach actors to compromise the affected system. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, read access to a subset of accessible data, and the ability to cause a partial denial of service - with a scope change (S:C) extending potential impact to additional Oracle products co-hosted in the same E-Business Suite environment. No public exploit code exists and this CVE does not appear in the CISA KEV catalog at time of analysis; the CVSS 3.1 base score of 7.3 reflects the scope change rather than inherent exploitability from the perimeter.
Unauthenticated remote data exposure in Oracle SDP Number Portability (E-Business Suite versions 12.2.3 through 12.2.15) allows a network attacker over HTTP to access critical or all data managed by the component without any credentials. The vulnerability is tagged as an Authentication Bypass in the Internal Operations component, consistent with the PR:N/AC:L CVSS vector indicating trivial exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity significantly lowers the bar for opportunistic abuse.
Full compromise of Oracle SDP Number Portability (a Service Delivery Platform component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker who already holds a logon on the host where the product runs; because the CVSS scope is changed, a successful attack can pivot to significantly impact other products beyond the vulnerable component. The flaw yields high confidentiality, integrity and availability impact and results in product takeover. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized read and write access to Oracle SDP Number Portability (Oracle E-Business Suite, Internal Operations component) is achievable by a low-privileged, network-based attacker over HTTP in versions 12.2.3 through 12.2.15. Oracle rates this 8.1 (High) with high confidentiality and integrity impact, allowing an authenticated user to create, delete, or modify all data accessible to the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network reach make it a notable patching priority in the July 2026 Critical Patch Update.
Oracle SDP Number Portability versions 12.2.3 through 12.2.15, a telecommunications management component of Oracle E-Business Suite, exposes a local privilege-abuse flaw in its Internal Operations component that enables high-privileged insiders or post-breach actors to compromise the affected system. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, read access to a subset of accessible data, and the ability to cause a partial denial of service - with a scope change (S:C) extending potential impact to additional Oracle products co-hosted in the same E-Business Suite environment. No public exploit code exists and this CVE does not appear in the CISA KEV catalog at time of analysis; the CVSS 3.1 base score of 7.3 reflects the scope change rather than inherent exploitability from the perimeter.
Unauthenticated remote data exposure in Oracle SDP Number Portability (E-Business Suite versions 12.2.3 through 12.2.15) allows a network attacker over HTTP to access critical or all data managed by the component without any credentials. The vulnerability is tagged as an Authentication Bypass in the Internal Operations component, consistent with the PR:N/AC:L CVSS vector indicating trivial exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity significantly lowers the bar for opportunistic abuse.
Full compromise of Oracle SDP Number Portability (a Service Delivery Platform component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker who already holds a logon on the host where the product runs; because the CVSS scope is changed, a successful attack can pivot to significantly impact other products beyond the vulnerable component. The flaw yields high confidentiality, integrity and availability impact and results in product takeover. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized read and write access to Oracle SDP Number Portability (Oracle E-Business Suite, Internal Operations component) is achievable by a low-privileged, network-based attacker over HTTP in versions 12.2.3 through 12.2.15. Oracle rates this 8.1 (High) with high confidentiality and integrity impact, allowing an authenticated user to create, delete, or modify all data accessible to the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network reach make it a notable patching priority in the July 2026 Critical Patch Update.