Description

Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Warehouse Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Warehouse Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Warehouse Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Warehouse Management. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-18T21:17:29.777Z",
  "pubdate": "2026-08-18T21:17:29.777Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Internal Operations component of Oracle Warehouse Management, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. This security flaw enables a network-based attacker with low privileges to compromise the target system via the HTTP protocol.\nSuccessful exploitation of this vulnerability has severe security implications, granting the adversary unauthorized capabilities to create, delete, or modify critical data, as well as achieve complete unauthorized access to all accessible Oracle Warehouse Management data. Additionally, an attacker can trigger a partial denial of service condition affecting the availability of the product.\nThe vulnerability carries a CVSS 3.1 Base Score of 8.3, reflecting high impacts on confidentiality and integrity alongside a low impact on availability. Exploitation requires no user interaction and leverages standard network accessibility, though it does presuppose that the attacker possesses low-level authentication credentials within the environment.",
  "technicalDetails": "The vulnerability resides in the Internal Operations component of Oracle Warehouse Management within Oracle E-Business Suite versions 12.2.3 to 12.2.15. The flaw is exposed over the network via the HTTP protocol, allowing remote interaction with vulnerable application endpoints.\nFrom an attacker capability perspective, the exploitation process requires low privileges and network access, meaning an authenticated user with minimal access rights can initiate the attack sequence. No user interaction is required for successful exploitation.\nThe step-by-step attack flow involves the adversary transmitting crafted HTTP requests to the vulnerable Internal Operations component. Due to insufficient input validation, authorization checks, or access control enforcement within the application logic, the targeted interface improperly handles the incoming requests.\nThis processing anomaly allows the low-privileged attacker to bypass intended security boundaries. Consequently, the payload behavior facilitates unauthorized operations against the backend data structures.\nThe post-exploitation impact spans multiple security triads: confidentiality is compromised through unauthorized read access to critical and sensitive data; integrity is violated via unauthorized creation, deletion, and modification of critical data assets; and availability is impacted by inducing a partial denial of service condition, disrupting normal operational workflows of Oracle Warehouse Management."
}