Description

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Framework. While the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Applications Framework. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-07-21T22:19:08.213Z",
  "pubdate": "2026-07-21T22:19:08.213Z",
  "executiveSummary": "This vulnerability exists within the Oracle Applications Framework component of Oracle E-Business Suite, specifically affecting the Web Utilities module. The flaw poses a critical security risk, with a CVSS 3.1 Base Score of 9.1.\nThe vulnerability allows an attacker with high-level administrative privileges and network access via HTTP to execute unauthorized operations, leading to a complete compromise of the Oracle Applications Framework.\nA notable aspect of this vulnerability is its scope-changing nature, meaning successful exploitation can facilitate unauthorized access or control over additional products integrated within the environment beyond the affected framework itself.\nThe vulnerability is classified as easily exploitable, requiring no user interaction. The impact is comprehensive, compromising the Confidentiality, Integrity, and Availability of the system. Organizations using affected versions 12.2.8 through 12.2.15 are at significant risk of total application takeover.",
  "technicalDetails": "The vulnerability resides within the Web Utilities component of the Oracle Applications Framework (OAF). The root cause involves an insecure handling of web requests that allows an authenticated attacker with high privileges to bypass intended security constraints. By leveraging HTTP-based network access, an adversary can manipulate the application's internal utilities to achieve arbitrary code execution or unauthorized system manipulation.\nThe exploitation process follows a structured attack flow. Initially, the attacker must establish a network connection to the affected Oracle E-Business Suite instance. Due to the requirement for high-level administrative privileges, the attacker must already possess valid, elevated credentials to interface with the vulnerable Web Utilities. Once authenticated, the attacker sends specially crafted HTTP requests targeting the vulnerable utility functions. Because the system fails to adequately sanitize or restrict these inputs, the application executes the malicious payload in a privileged context.\nThe impact of this vulnerability is categorized as having a scope change (S:C). This means the vulnerability allows an attacker to move beyond the boundaries of the Oracle Applications Framework to affect the broader Oracle E-Business Suite ecosystem. The successful injection or manipulation of requests allows for the full takeover of the OAF component, potentially granting the attacker complete control over the underlying data, configuration, and integrated modules. This provides the attacker with the ability to exfiltrate sensitive business data (Confidentiality), modify system records or configurations (Integrity), and disrupt business operations by shutting down services or deleting data (Availability).\nAffected versions are limited to the Oracle Applications Framework within Oracle E-Business Suite versions 12.2.8 through 12.2.15. The attack complexity is rated as Low, indicating that the vulnerability does not require sophisticated technical bypasses or specialized environment conditions. Given the requirement for high-privileged access, the primary attack vector is internal or via compromised administrative accounts, though the network-accessible nature of HTTP endpoints makes the system inherently vulnerable if these services are exposed to non-trusted network segments."
}