Description

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle General Ledger accessible data as well as unauthorized read access to a subset of Oracle General Ledger accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle General Ledger. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-18T21:17:34.523Z",
  "pubdate": "2026-08-18T21:17:34.523Z",
  "executiveSummary": "A vulnerability exists within the Oracle General Ledger product of Oracle E-Business Suite, specifically affecting the Internal Operations component across supported versions 12.2.3 through 12.2.15. This security flaw is classified as easily exploitable, allowing a low-privileged attacker with network access via HTTP to compromise the affected application.\nSuccessful exploitation of this vulnerability leads to significant security impacts across confidentiality, integrity, and availability. Specifically, an adversary can achieve unauthorized read access to a subset of data accessible within Oracle General Ledger, alongside unauthorized creation, deletion, or modification capabilities affecting critical data or all accessible data within the system. Furthermore, the vulnerability enables an attacker to induce a partial denial of service (partial DOS) against the Oracle General Ledger product.\nThe CVSS 3.1 base score for this vulnerability is 7.6, reflecting the severity of the potential impacts. The associated CVSS vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L), indicating network attack vector, low attack complexity, low privilege requirements, no user interaction, and an unchanged security scope. Risk implications include the potential compromise of financial and organizational data integrity, unauthorized information disclosure, and operational disruption due to partial service degradation.",
  "technicalDetails": "The vulnerability resides in the Internal Operations component of Oracle General Ledger within Oracle E-Business Suite versions 12.2.3 to 12.2.15. The architectural root cause involves inadequate authorization enforcement and input validation mechanisms within the application's network-facing endpoints, allowing authenticated low-privileged users to interact with sensitive internal operational functions.\nExploitation requires the attacker to possess low privileges within the Oracle E-Business Suite environment and network access to the application via the HTTP protocol. The attack vector is strictly network-based (AV:N), meaning no physical access or local host presence is required. The attack complexity is evaluated as low (AC:L), and the exploit does not depend on user interaction (UI:N), allowing automated or direct script-driven exploitation once initial low-level credentials are obtained.\nThe step-by-step attack flow begins with the adversary establishing an HTTP connection to the vulnerable Oracle General Ledger endpoints exposed over the network. Leveraging valid low-privileged credentials, the attacker crafts specialized HTTP requests targeting the vulnerable Internal Operations component. Because the application fails to adequately validate whether the authenticated user possesses the necessary authorization levels for the requested transactional or operational routines, the application processes the request.\nUpon successful processing of the malicious payload, the post-exploitation impact materializes across multiple vectors. In terms of integrity, the attacker can execute unauthorized creation, modification, or deletion commands against critical or comprehensive Oracle General Ledger datasets. For confidentiality, the attacker gains unauthorized read access to specific subsets of sensitive data. Finally, regarding availability, the malicious execution pattern can consume or disrupt operational resources, resulting in a partial denial of service (partial DOS) condition that degrades the functionality of the Oracle General Ledger environment."
}