Description

Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Warehouse Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Warehouse Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Warehouse Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T21:17:30.320Z",
  "pubdate": "2026-08-18T21:17:30.320Z",
  "executiveSummary": "An unauthenticated or low-privileged remote vulnerability exists within the Internal Operations component of Oracle Warehouse Management, a core product of Oracle E-Business Suite versions 12.2.3 through 12.2.15. This security flaw enables a network-based attacker with low privileges to compromise the affected application over the HTTP protocol. Successful exploitation requires no user interaction and can result in significant integrity and availability impacts to the system. Specifically, an adversary can achieve unauthorized creation, deletion, or modification of critical data, alongside accessible data within Oracle Warehouse Management. Furthermore, the attack vector allows threat actors to induce a partial denial of service condition against the target application. Given the CVSS 3.1 base score of 7.1, organizations running vulnerable iterations face considerable risk regarding data corruption and operational disruption. The vulnerability highlights systemic exposure within enterprise supply chain platforms, necessitating immediate vendor-supplied remediation or administrative hardening to thwart unauthorized state changes and service degradation.",
  "technicalDetails": "The vulnerability resides within the Internal Operations component of Oracle Warehouse Management, affecting supported software versions 12.2.3 through 12.2.15. The flaw is exposed via network access utilizing the HTTP protocol, allowing remote interaction without requiring complex pre-conditions or user-assisted execution steps. The attacker model assumes an authenticated user operating with low privileges within the application context. The root cause stems from insufficient access controls and inadequate input validation or state verification mechanisms within the Internal Operations logic, enabling unauthorized manipulation of business logic transactions.\nThe step-by-step attack flow begins with the low-privileged attacker establishing an HTTP connection to the vulnerable Oracle Warehouse Management endpoint. Because the target component fails to adequately enforce authorization boundaries and privilege checks for specific internal operations, the attacker can craft malicious HTTP requests containing payloads designed to invoke sensitive functions. Upon receipt, the application processes these requests without verifying whether the requesting user possesses the necessary administrative or operational authorization to execute the data modification or service-disrupting routines.\nDuring payload execution, the application processes the unauthorized instructions, leading to direct post-exploitation impacts. These include unauthorized data manipulation such as the creation, deletion, or modification of critical operational data residing within Oracle Warehouse Management databases or data structures. Additionally, resource-intensive or malformed requests can overwhelm the internal processing pipeline of the component, resulting in a partial denial of service condition that degrades application availability for legitimate users. The vulnerability leverages the standard HTTP service architecture of Oracle E-Business Suite, bypassing intended privilege restrictions due to flawed authorization enforcement within the Internal Operations module."
}