Description

Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Contracts. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Service Contracts accessible data as well as unauthorized access to critical data or complete access to all Oracle Service Contracts accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-18T21:17:31.660Z",
  "pubdate": "2026-08-18T21:17:31.660Z",
  "executiveSummary": "A vulnerability exists within the Internal Operations component of the Oracle Service Contracts product of Oracle E-Business Suite, specifically affecting supported versions 12.2.3 through 12.2.15. This security flaw allows an unauthenticated attacker with network access via HTTP to compromise the affected product. Successful exploitation of this vulnerability results in unauthorized creation, deletion, or modification access to critical data, as well as unauthorized or complete read access to all Oracle Service Contracts accessible data.\nThe vulnerability is characterized by a CVSS 3.1 Base Score of 7.4, with a vector of (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). The impact is strictly confined to confidentiality and integrity domains, leaving availability unaffected. The attack vector is network-based, requiring no user interaction and no prior authentication; however, exploitation is hindered by a high attack complexity requirement. This indicates that specific conditions, race conditions, or sophisticated configuration states must be met by the threat actor to successfully execute an attack against the target system.",
  "technicalDetails": "The security flaw resides in the Internal Operations component of Oracle Service Contracts within Oracle E-Business Suite versions 12.2.3 to 12.2.15. The root cause stems from insufficient access controls, improper input validation, or inadequate session and request validation logic within the HTTP request processing pipeline of the affected component, allowing unauthorized interactions with sensitive backend logic.\nExploitation of this vulnerability requires network access, leveraging the HTTP protocol exposed by the application layer. The attacker operates without any prior authentication or privileges (PR:N, UI:N), targeting the application over the network (AV:N). Despite the lack of authentication requirements, the vulnerability features a high attack complexity (AC:H), implying that successful exploitation demands precise timing, specialized conditions, or circumvention of implicit controls within the Oracle E-Business Suite architecture.\nThe attack flow commences when the unauthenticated attacker crafts specialized HTTP requests directed at the vulnerable endpoints within the Internal Operations component. Due to the high attack complexity, the attacker may need to chain requests or exploit underlying architectural nuances to bypass input filters or state validations. Once the request is successfully processed by the vulnerable component, the application fails to adequately verify whether the source is authorized to perform state-changing operations or query sensitive database repositories.\nPost-exploitation impact includes severe breaches of data confidentiality and integrity. The attacker gains the capability to execute unauthorized read operations, granting complete access to all data accessible via Oracle Service Contracts. Furthermore, the attacker can perform unauthorized creation, deletion, or modification of critical data records, leading to potential data corruption, business logic tampering, or unauthorized insertion of fraudulent contract data within the E-Business Suite environment. The scope remains unchanged (S:U), meaning the vulnerability impacts solely the resources managed by the vulnerable security authority without escalating privileges to underlying operating system components."
}