Work In Process
Monthly
Full system takeover of Oracle Work in Process (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The Internal Operations component contains an easily exploitable flaw that yields complete compromise of confidentiality, integrity, and availability - consistent with an application-level takeover. No public exploit or active exploitation has been identified at time of analysis; a vendor patch was released as part of the Oracle Critical Patch Update (CPU) August 2026.
Oracle Work in Process (WIP) versions 12.2.3 through 12.2.15, a manufacturing module within Oracle E-Business Suite, exposes its Internal Operations component over HTTP to low-privileged authenticated attackers who can trigger a complete service hang or crash alongside unauthorized data modification. The attack requires no user interaction and is characterized as easily exploitable by Oracle's own advisory language, giving it outsized operational impact for manufacturing environments dependent on WIP for production scheduling. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Work in Process (WIP), a manufacturing execution module in Oracle E-Business Suite, is achievable by a low-privileged local attacker exploiting a flaw in the Internal Operations component across versions 12.2.3 through 12.2.15. The CVSS vector (AV:L/AC:H/PR:L) constrains exploitation to authenticated infrastructure-level access with high attack complexity, significantly limiting opportunistic or remote attack paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, successful exploitation yields complete compromise of confidentiality, integrity, and availability of the WIP instance.
Unauthorized data compromise in Oracle Work in Process (a manufacturing module of Oracle E-Business Suite) 12.2.14 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Work in Process application. Oracle rates it 8.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Compromise of Oracle Work in Process, a manufacturing module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15, Internal Operations component), allows a low-privileged authenticated attacker with HTTP network access to read all data accessible to Work in Process and to alter some of it, with a scope change that can significantly impact additional Oracle products. Exploitation is rated easy by Oracle but requires human interaction from a victim other than the attacker (UI:R), pointing to a social-engineering or cross-user trigger. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Remote takeover of the Oracle Work in Process (WIP) module of Oracle E-Business Suite (component: Internal Operations) allows an unauthenticated attacker with only HTTP network access to fully compromise the application. Oracle rates this 9.8 with full confidentiality, integrity and availability impact and describes it as 'easily exploitable,' meaning no authentication, no user interaction and low attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network attack profile makes it a top-priority patch in the July 2026 Critical Patch Update.
Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.5 through 12.2.15 exposes an authorization flaw in its Internal Operations component, enabling a low-privileged authenticated attacker to perform unauthorized read, insert, update, and delete operations against accessible Work in Process data over HTTP. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to affect additional EBS modules beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the mandatory victim interaction requirement (UI:R) reduces opportunistic exploitation risk.
Oracle Work in Process within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes low-privileged local attackers to unauthorized partial data disclosure and partial denial-of-service conditions via the Internal Operations component. Exploitation demands an existing OS-level logon to the host infrastructure and high attack complexity, making reliable exploitation difficult and opportunistic mass exploitation implausible. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, consistent with the vendor-assigned CVSS 3.1 score of 3.6 (Low).
Limited local data disclosure in Oracle Work in Process (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows a high-privileged attacker with local infrastructure access to read a subset of accessible data under difficult exploitation conditions. The CVSS 3.1 base score of 1.9 reflects an extremely constrained attack surface - local vector, high complexity, and high privilege requirements combine to make this one of the lowest-severity issues addressed in the Oracle CPU July 2026 advisory. No public exploit identified at time of analysis, and no active exploitation has been reported.
Unauthorized read access to critical data in Oracle Work in Process (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-connected attacker exploiting an authentication bypass in the Internal Operations component via HTTP. The flaw is rated difficult to exploit (AC:H) and carries no integrity or availability impact, but successful exploitation grants complete access to all data accessible within the Work in Process module. No public exploit code or CISA KEV listing is associated with this vulnerability at time of analysis.
Vulnerability in the Oracle Work in Process component of Oracle E-Business Suite (subcomponent: Messages). Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Work in Process component of Oracle E-Business Suite (subcomponent: Assemble/Configure to Order). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Full system takeover of Oracle Work in Process (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The Internal Operations component contains an easily exploitable flaw that yields complete compromise of confidentiality, integrity, and availability - consistent with an application-level takeover. No public exploit or active exploitation has been identified at time of analysis; a vendor patch was released as part of the Oracle Critical Patch Update (CPU) August 2026.
Oracle Work in Process (WIP) versions 12.2.3 through 12.2.15, a manufacturing module within Oracle E-Business Suite, exposes its Internal Operations component over HTTP to low-privileged authenticated attackers who can trigger a complete service hang or crash alongside unauthorized data modification. The attack requires no user interaction and is characterized as easily exploitable by Oracle's own advisory language, giving it outsized operational impact for manufacturing environments dependent on WIP for production scheduling. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Work in Process (WIP), a manufacturing execution module in Oracle E-Business Suite, is achievable by a low-privileged local attacker exploiting a flaw in the Internal Operations component across versions 12.2.3 through 12.2.15. The CVSS vector (AV:L/AC:H/PR:L) constrains exploitation to authenticated infrastructure-level access with high attack complexity, significantly limiting opportunistic or remote attack paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, successful exploitation yields complete compromise of confidentiality, integrity, and availability of the WIP instance.
Unauthorized data compromise in Oracle Work in Process (a manufacturing module of Oracle E-Business Suite) 12.2.14 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Work in Process application. Oracle rates it 8.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Compromise of Oracle Work in Process, a manufacturing module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15, Internal Operations component), allows a low-privileged authenticated attacker with HTTP network access to read all data accessible to Work in Process and to alter some of it, with a scope change that can significantly impact additional Oracle products. Exploitation is rated easy by Oracle but requires human interaction from a victim other than the attacker (UI:R), pointing to a social-engineering or cross-user trigger. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Remote takeover of the Oracle Work in Process (WIP) module of Oracle E-Business Suite (component: Internal Operations) allows an unauthenticated attacker with only HTTP network access to fully compromise the application. Oracle rates this 9.8 with full confidentiality, integrity and availability impact and describes it as 'easily exploitable,' meaning no authentication, no user interaction and low attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network attack profile makes it a top-priority patch in the July 2026 Critical Patch Update.
Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.5 through 12.2.15 exposes an authorization flaw in its Internal Operations component, enabling a low-privileged authenticated attacker to perform unauthorized read, insert, update, and delete operations against accessible Work in Process data over HTTP. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to affect additional EBS modules beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the mandatory victim interaction requirement (UI:R) reduces opportunistic exploitation risk.
Oracle Work in Process within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes low-privileged local attackers to unauthorized partial data disclosure and partial denial-of-service conditions via the Internal Operations component. Exploitation demands an existing OS-level logon to the host infrastructure and high attack complexity, making reliable exploitation difficult and opportunistic mass exploitation implausible. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, consistent with the vendor-assigned CVSS 3.1 score of 3.6 (Low).
Limited local data disclosure in Oracle Work in Process (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows a high-privileged attacker with local infrastructure access to read a subset of accessible data under difficult exploitation conditions. The CVSS 3.1 base score of 1.9 reflects an extremely constrained attack surface - local vector, high complexity, and high privilege requirements combine to make this one of the lowest-severity issues addressed in the Oracle CPU July 2026 advisory. No public exploit identified at time of analysis, and no active exploitation has been reported.
Unauthorized read access to critical data in Oracle Work in Process (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-connected attacker exploiting an authentication bypass in the Internal Operations component via HTTP. The flaw is rated difficult to exploit (AC:H) and carries no integrity or availability impact, but successful exploitation grants complete access to all data accessible within the Work in Process module. No public exploit code or CISA KEV listing is associated with this vulnerability at time of analysis.
Vulnerability in the Oracle Work in Process component of Oracle E-Business Suite (subcomponent: Messages). Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Work in Process component of Oracle E-Business Suite (subcomponent: Assemble/Configure to Order). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.