Description

Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Systems. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Process Manufacturing Systems accessible data as well as unauthorized access to critical data or complete access to all Oracle Process Manufacturing Systems accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T21:17:38.237Z",
  "pubdate": "2026-08-18T21:17:38.237Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Internal Operations component of Oracle Process Manufacturing Systems, affecting Oracle E-Business Suite versions 12.2.3 through 12.2.15. This security flaw permits a low-privileged attacker with network access via HTTP to compromise the affected product without requiring user interaction.\nSuccessful exploitation of this vulnerability leads to severe confidentiality and integrity impacts, granting unauthorized read, creation, deletion, and modification access to critical data or complete datasets accessible within Oracle Process Manufacturing Systems. The high CVSS 3.1 Base Score of 8.1 underscores the significant risk to enterprise data integrity and privacy, making prompt remediation vital to prevent unauthorized manipulation or exposure of sensitive manufacturing operational records.",
  "technicalDetails": "The vulnerability resides in the Internal Operations component of Oracle Process Manufacturing Systems within Oracle E-Business Suite versions 12.2.3 through 12.2.15. The underlying architectural flaw permits insufficient access control enforcement during request processing over the HTTP protocol.\nAttackers targeting this vulnerability must possess network connectivity to the target application and authenticate with low privileges. The attack vector is network-based (AV:N), with low attack complexity (AC:L), and requires no user interaction (UI:N). The scope remains unchanged (S:U).\nDuring the attack flow, a malicious actor leverages their low-privileged network access to craft specialized HTTP requests directed at the vulnerable Internal Operations component. Due to inadequate authorization validation within the affected functions, the application fails to properly restrict operations based on the user's assigned role or privilege level.\nConsequently, the system executes unauthorized commands or queries submitted within the payload. This post-exploitation state enables the attacker to achieve unauthorized access to critical data (C:H) as well as perform unauthorized creation, deletion, or modification of critical data or all accessible data within the Oracle Process Manufacturing Systems environment (I:H). Availability impact is none (A:N)."
}