Description

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle General Ledger accessible data as well as unauthorized update, insert or delete access to some of Oracle General Ledger accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle General Ledger. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-18T21:17:29.060Z",
  "pubdate": "2026-08-18T21:17:29.060Z",
  "executiveSummary": "A vulnerability has been identified within the Internal Operations component of the Oracle General Ledger product, part of the Oracle E-Business Suite, affecting supported versions 12.2.3 through 12.2.15. This security flaw is easily exploitable by a low-privileged attacker who possesses network access via the HTTP protocol, allowing them to compromise the target application without requiring user interaction.\nSuccessful exploitation of this vulnerability has severe security implications across the CIA triad. It grants the adversary unauthorized access to critical data or complete access to all data accessible within Oracle General Ledger. Furthermore, it enables unauthorized update, insert, and delete operations on a subset of the accessible data, alongside the capability to trigger a partial denial of service (partial DoS) condition against the application.\nGiven the CVSS 3.1 Base Score of 7.6 with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, organizations running the affected Oracle E-Business Suite versions face a high risk of data exposure, data integrity degradation, and service availability disruption. Remediation requires applying the appropriate vendor patches or implementing strict network segmentation and access controls to mitigate unauthorized internal operations.",
  "technicalDetails": "The vulnerability resides in the Internal Operations component of Oracle General Ledger, an enterprise financial management module within the Oracle E-Business Suite (versions 12.2.3-12.2.15). The root cause stems from insufficient access controls, authorization enforcement, or input validation within the affected component's transaction processing or request handling routines, allowing authenticated low-privileged users to bypass intended security boundaries over the network.\nExploitation is conducted remotely via the HTTP protocol. Because the attack vector is network-based (AV:N) and complexity is low (AC:L), an adversary with minimal pre-existing privileges (PR:L) can interact directly with the vulnerable endpoints without requiring user interaction (UI:N). The attacker initiates crafted HTTP requests targeted at the Internal Operations component of Oracle General Ledger, leveraging valid session credentials associated with a low-privileged role.\nDuring the attack flow, the vulnerable application fails to adequately validate whether the authenticated user possesses the necessary privileges to execute specific internal operations or access restricted financial datasets. Consequently, the application processes the malicious payload, granting the attacker unauthorized read access to highly sensitive or complete Oracle General Ledger data (C:H).\nIn addition to confidentiality breaches, the processing of manipulated requests permits the adversary to perform unauthorized insert, update, or delete operations against certain accessible data tables (I:L), potentially compromising financial data integrity. Furthermore, resource exhaustion or improper exception handling triggered by specific payloads can degrade system performance or crash application services, resulting in a partial denial of service (A:L). The scope remains unchanged (S:U), as the impact is confined to the vulnerable Oracle General Ledger authorization domain."
}