Service Fulfillment Manager
Monthly
Unauthorized data access and partial integrity compromise in Oracle Service Fulfillment Manager (E-Business Suite Fulfillment Engine component) affects all releases from 12.2.3 through 12.2.15. A low-privileged network attacker can, after inducing a victim user to interact with a crafted payload delivered over HTTP, achieve complete confidentiality loss of all data accessible to the application and limited unauthorized write access - with confirmed scope change affecting additional EBS products. No public exploit code has been identified at time of analysis, and Oracle has addressed this vulnerability in the August 2026 Critical Patch Update. The Authentication Bypass tag warrants verification, as the provided CVSS vector assigns PR:L rather than PR:N, suggesting privilege escalation within the session rather than a full authentication bypass.
Full compromise of Oracle Service Fulfillment Manager (a Fulfillment Engine component of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible where an authenticated, low-privileged attacker with network HTTP access can escalate to complete takeover of the module. Although rated CVSS 3.1 7.5 with confidentiality, integrity and availability impact, the attack complexity is high, meaning exploitation is non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle labels it easily exploitable. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and Oracle's 'easily exploitable' wording make it a strong patch priority for EBS operators.
Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite) allows a high-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application, with a scope change that may significantly impact additional Oracle products. Affected releases span 12.2.3 through 12.2.15, and Oracle rates it CVSS 8.7 (confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is addressed in the Oracle July 2026 Critical Patch Update.
Vulnerability in the Oracle Service Fulfillment Manager component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Service Fulfillment Manager component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unauthorized data access and partial integrity compromise in Oracle Service Fulfillment Manager (E-Business Suite Fulfillment Engine component) affects all releases from 12.2.3 through 12.2.15. A low-privileged network attacker can, after inducing a victim user to interact with a crafted payload delivered over HTTP, achieve complete confidentiality loss of all data accessible to the application and limited unauthorized write access - with confirmed scope change affecting additional EBS products. No public exploit code has been identified at time of analysis, and Oracle has addressed this vulnerability in the August 2026 Critical Patch Update. The Authentication Bypass tag warrants verification, as the provided CVSS vector assigns PR:L rather than PR:N, suggesting privilege escalation within the session rather than a full authentication bypass.
Full compromise of Oracle Service Fulfillment Manager (a Fulfillment Engine component of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible where an authenticated, low-privileged attacker with network HTTP access can escalate to complete takeover of the module. Although rated CVSS 3.1 7.5 with confidentiality, integrity and availability impact, the attack complexity is high, meaning exploitation is non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle labels it easily exploitable. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and Oracle's 'easily exploitable' wording make it a strong patch priority for EBS operators.
Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite) allows a high-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application, with a scope change that may significantly impact additional Oracle products. Affected releases span 12.2.3 through 12.2.15, and Oracle rates it CVSS 8.7 (confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is addressed in the Oracle July 2026 Critical Patch Update.
Vulnerability in the Oracle Service Fulfillment Manager component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Service Fulfillment Manager component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.