Description

Vulnerability in the Oracle Risk Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Risk Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Risk Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Risk Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T21:17:28.833Z",
  "pubdate": "2026-08-18T21:17:28.833Z",
  "executiveSummary": "A vulnerability has been identified within the Oracle Risk Management product of Oracle E-Business Suite, specifically affecting the Internal Operations component across supported versions 12.2.3 through 12.2.15.\nThis security flaw is classified as an access control and data integrity vulnerability that can be exploited remotely over a network via the HTTP protocol without requiring user interaction.\nAn attacker possessing low-level privileges and valid network access can leverage this vulnerability to execute unauthorized operations against the target system.\nSuccessful exploitation of this flaw grants the adversary unauthorized capabilities to create, delete, or modify critical data, as well as achieve unauthorized read access to critical data or complete access to all data accessible within Oracle Risk Management.\nThe severity of this issue is underscored by a CVSS 3.1 Base Score of 8.1, reflecting high impacts on both confidentiality and integrity.\nThe risk implications include significant data compromise, potential business logic disruption, and unauthorized manipulation of sensitive risk management records.\nMitigation requires applying official vendor patches provided by Oracle for the affected versions of the E-Business Suite environment.",
  "technicalDetails": "The vulnerability resides within the Internal Operations component of Oracle Risk Management in Oracle E-Business Suite versions 12.2.3 through 12.2.15.\nThe root cause stems from insufficient authorization checks and access control enforcement mechanisms within the application logic, allowing authenticated low-privileged users to interact with sensitive functions and data structures normally restricted to higher privilege tiers.\nThe attack vector is network-based, utilizing the HTTP protocol to communicate with the vulnerable Oracle E-Business Suite instance.\nExploitation requirements dictate that the attacker must have network connectivity to the application and possess low-privileged credentials within the system.\nNo user interaction is required for a successful attack, making it suitable for automated or direct manual exploitation once baseline access is secured.\nThe step-by-step attack flow begins with the low-privileged attacker establishing an HTTP session with the Oracle E-Business Suite application server.\nThe attacker then crafts and transmits malicious HTTP requests targeting the vulnerable Internal Operations component, bypassing inadequate server-side authorization validations.\nUpon receiving the request, the vulnerable component processes the payload without properly verifying whether the authenticated user possesses the requisite administrative or operational clearance.\nThis flaw allows the execution of unauthorized transactional or administrative functions, leading to the unauthorized disclosure, modification, creation, or deletion of critical data assets accessible to Oracle Risk Management.\nPost-exploitation impact is constrained to confidentiality and integrity domains, where the adversary can exfiltrate sensitive risk data or tamper with integrity-critical records, while availability remains unaffected as denoted by the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)."
}