Warehouse Management
Monthly
Oracle Warehouse Management versions 12.2.3 through 12.2.15 within Oracle E-Business Suite allows low-privileged network-authenticated attackers to corrupt, delete, or create critical warehouse data and partially disrupt service availability over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms easy exploitability requiring only a low-privilege account and HTTP connectivity - no user interaction or elevated rights are needed. No public exploit code or CISA KEV listing has been identified at time of analysis; the August 2026 Oracle Critical Patch Update references a fix.
Unauthenticated remote data exposure in Oracle Warehouse Management (versions 12.2.3 through 12.2.15) allows any network-accessible attacker to read critical warehouse management data via HTTP without credentials. Tagged as an authentication bypass in the Internal Operations component, this vulnerability provides complete read access to all data within the WMS module's scope. No public exploit code or CISA KEV listing has been identified at time of analysis, though the trivial attack complexity (AC:L, PR:N) elevates practical risk relative to the absence of observed exploitation.
Unauthorized data disclosure in Oracle Warehouse Management (Oracle E-Business Suite component: Internal Operations) allows a low-privileged authenticated attacker with HTTPS network access to bypass authorization controls and obtain critical or complete WMS data across versions 12.2.3 through 12.2.15. The CVSS scope change (S:C) is confirmed by Oracle's advisory, meaning successful exploitation can propagate to additional Oracle EBS products deployed in the same instance - amplifying the data exposure beyond WMS itself. No public exploit code and no CISA KEV listing are identified at time of analysis; the 'Authentication Bypass' tag combined with a PR:L vector indicates this is an authorization bypass for credentialed users rather than a fully unauthenticated flaw.
Oracle Warehouse Management versions 12.2.3 through 12.2.15 - a component of Oracle E-Business Suite - exposes a high-severity vulnerability in its Internal Operations component allowing low-privileged, network-authenticated attackers to compromise confidentiality, integrity, and availability via HTTP. Successful exploitation enables unauthorized read and write access to critical warehouse management data, including creation, deletion, and modification of records, alongside a partial denial of service. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Privilege-escalation-to-takeover in Oracle Warehouse Management (Internal Operations component of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with network access over HTTP to fully compromise the module. Because CVSS scope is unchanged but all three impacts (C/I/A) are High, a successful attack results in complete takeover of Oracle Warehouse Management. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is addressed in the Oracle Critical Patch Update of July 2026.
Oracle Warehouse Management versions 12.2.3 through 12.2.15 within Oracle E-Business Suite allows low-privileged network-authenticated attackers to corrupt, delete, or create critical warehouse data and partially disrupt service availability over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms easy exploitability requiring only a low-privilege account and HTTP connectivity - no user interaction or elevated rights are needed. No public exploit code or CISA KEV listing has been identified at time of analysis; the August 2026 Oracle Critical Patch Update references a fix.
Unauthenticated remote data exposure in Oracle Warehouse Management (versions 12.2.3 through 12.2.15) allows any network-accessible attacker to read critical warehouse management data via HTTP without credentials. Tagged as an authentication bypass in the Internal Operations component, this vulnerability provides complete read access to all data within the WMS module's scope. No public exploit code or CISA KEV listing has been identified at time of analysis, though the trivial attack complexity (AC:L, PR:N) elevates practical risk relative to the absence of observed exploitation.
Unauthorized data disclosure in Oracle Warehouse Management (Oracle E-Business Suite component: Internal Operations) allows a low-privileged authenticated attacker with HTTPS network access to bypass authorization controls and obtain critical or complete WMS data across versions 12.2.3 through 12.2.15. The CVSS scope change (S:C) is confirmed by Oracle's advisory, meaning successful exploitation can propagate to additional Oracle EBS products deployed in the same instance - amplifying the data exposure beyond WMS itself. No public exploit code and no CISA KEV listing are identified at time of analysis; the 'Authentication Bypass' tag combined with a PR:L vector indicates this is an authorization bypass for credentialed users rather than a fully unauthenticated flaw.
Oracle Warehouse Management versions 12.2.3 through 12.2.15 - a component of Oracle E-Business Suite - exposes a high-severity vulnerability in its Internal Operations component allowing low-privileged, network-authenticated attackers to compromise confidentiality, integrity, and availability via HTTP. Successful exploitation enables unauthorized read and write access to critical warehouse management data, including creation, deletion, and modification of records, alongside a partial denial of service. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Privilege-escalation-to-takeover in Oracle Warehouse Management (Internal Operations component of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with network access over HTTP to fully compromise the module. Because CVSS scope is unchanged but all three impacts (C/I/A) are High, a successful attack results in complete takeover of Oracle Warehouse Management. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is addressed in the Oracle Critical Patch Update of July 2026.