Description

Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Warehouse Management. While the vulnerability is in Oracle Warehouse Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Warehouse Management accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-18T21:17:29.893Z",
  "pubdate": "2026-08-18T21:17:29.893Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Internal Operations component of the Oracle Warehouse Management product, part of the Oracle E-Business Suite. This security flaw allows a low-privileged attacker with network access via HTTPS to compromise the affected system, leading to significant security impacts across additional products due to a scope change. Successful exploitation results in unauthorized access to critical data or complete data compromise regarding all information accessible within Oracle Warehouse Management, strictly impacting confidentiality. The vulnerability carries a CVSS 3.1 Base Score of 7.7, reflecting a high severity rating primarily driven by network vector exposure, low attack complexity, and minimal required privileges.",
  "technicalDetails": "The vulnerability resides in the Internal Operations component of Oracle Warehouse Management across supported versions 12.2.3 through 12.2.15. The flaw is exposed over the network via the HTTPS protocol, permitting remote exploitation by authenticated adversaries possessing low-level privileges. No user interaction is required to successfully execute an attack.\nThe attack vector involves network-based interaction where an attacker leverages legitimate, low-privileged credentials to interact with the vulnerable Oracle Warehouse Management application interface. Due to inadequate input validation, authorization enforcement, or boundary checks within the Internal Operations component, the attacker is able to craft specific HTTPS requests that bypass logical security controls. This grants unauthorized read access to sensitive database records and application-tier resources.\nA notable characteristic of this vulnerability is the scope change (S:C), indicating that the compromise extends beyond the immediate boundary of Oracle Warehouse Management, potentially exposing integrated products or underlying architectural layers to unauthorized data access. The post-exploitation impact is strictly confined to confidentiality (C:H), resulting in the complete exposure of all data accessible to the Oracle Warehouse Management product, which may include proprietary enterprise logistics data, credentials, or internal operational metrics."
}