Description

Vulnerability in the Oracle Service Fulfillment Manager product of Oracle E-Business Suite (component: Fulfillment Engine). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Fulfillment Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Service Fulfillment Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Service Fulfillment Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Service Fulfillment Manager accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-18T21:17:32.100Z",
  "pubdate": "2026-08-18T21:17:32.100Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Oracle Service Fulfillment Manager product of Oracle E-Business Suite, specifically affecting the Fulfillment Engine component across supported versions 12.2.3 through 12.2.15. This security flaw enables a low-privileged threat actor with network access via HTTP to compromise the targeted system, contingent upon social engineering or human interaction from a user other than the attacker. Due to a scope change, successful exploitation has severe security implications that extend beyond the primary component, potentially impacting additional integrated products within the environment.\nFrom an impact perspective, successful exploitation leads to severe breaches of data confidentiality and integrity. The vulnerability allows unauthorized access to critical data or complete access to all data accessible by Oracle Service Fulfillment Manager, alongside unauthorized update, insert, or delete capabilities for a subset of accessible data. The CVSS 3.1 base score of 7.6 reflects these high confidentiality and moderate integrity impacts, combined with network attack vectors and low privilege requirements. Organizations running affected Oracle E-Business Suite versions face substantial risk if defensive mitigations are not promptly applied.",
  "technicalDetails": "The vulnerability resides in the Fulfillment Engine component of Oracle Service Fulfillment Manager, an integral part of the Oracle E-Business Suite architecture spanning versions 12.2.3 to 12.2.15. The flaw is exposed via the HTTP protocol, allowing remote network accessibility for adversaries who possess low-privileged credentials within the application ecosystem. Although network exposure and low privilege requirements lower the barrier to entry, the attack vector mandates explicit human interaction—such as inducing a victimized user to interact with a maliciously crafted HTTP request or link—to successfully orchestrate the exploit payload.\nThe attack flow commences when the low-privileged attacker delivers a crafted request or payload over HTTP targeting the vulnerable Fulfillment Engine endpoints. Because the attack requires human interaction from a distinct user, the threat actor typically employs social engineering tactics to entice the victim into executing an action that triggers the processing of the malicious input. Upon interaction, the application improperly validates or sanitizes the input, leading to a scope change (S:C) where the security context expands to compromise additional downstream or interrelated products beyond the immediate Oracle Service Fulfillment Manager boundary.\nPost-exploitation impacts are characterized by a significant degradation of data assurance. The attacker achieves unauthorized read access to critical data structures and potentially complete access to all data repositories reachable by Oracle Service Fulfillment Manager. Furthermore, the vulnerability grants unauthorized modification rights, permitting the attacker to perform insert, update, or delete operations on a targeted subset of accessible data. The combination of network accessibility, low privilege constraints, and cross-scope impact vector makes this vulnerability a critical concern for database and enterprise application administrators."
}