Description

Vulnerability in the Oracle Financials for Asia/Pacific product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials for Asia/Pacific. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financials for Asia/Pacific accessible data as well as unauthorized read access to a subset of Oracle Financials for Asia/Pacific accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T21:17:39.197Z",
  "pubdate": "2026-08-18T21:17:39.197Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Oracle Financials for Asia/Pacific product of Oracle E-Business Suite, specifically within the Internal Operations component. This security flaw enables a low-privileged network attacker with HTTP access to compromise the integrity and confidentiality of the targeted application data. The vulnerability impacts supported versions ranging from 12.2.3 to 12.2.15.\nSuccessful exploitation of this flaw does not require user interaction, lowering the barrier for threat actors. An authenticated attacker can leverage network access to execute unauthorized actions against critical business data. The primary impacts include unauthorized read access to a subset of accessible data, alongside full unauthorized creation, deletion, and modification capabilities affecting critical data within Oracle Financials for Asia/Pacific. The CVSS 3.1 base score is calculated at 7.1, reflecting significant risks to data integrity and moderate risks to confidentiality.",
  "technicalDetails": "The vulnerability resides in the Internal Operations component of Oracle Financials for Asia/Pacific within Oracle E-Business Suite. The affected software versions comprise 12.2.3 through 12.2.15. The root cause stems from insufficient access controls or authorization checks within the application logic, permitting low-privileged users to perform operations outside their intended security boundary.\nThe attack vector is network-based utilizing the HTTP protocol, meaning the application must be reachable over the network. The exploitation complexity is rated as low (AC:L), requiring minimal effort or specialized conditions from the attacker. Furthermore, the attack requires low privileges (PR:L), meaning the adversary must possess a valid, authenticated user account within the system, but does not need administrative or high-level operational privileges. No user interaction (UI:N) is required, meaning the attack can be executed entirely programmatically without social engineering or user assistance.\nThe step-by-step attack flow begins with the low-privileged attacker establishing an HTTP connection to the exposed Oracle E-Business Suite instance. The attacker crafts targeted HTTP requests directed at the vulnerable endpoints within the Internal Operations component of Oracle Financials for Asia/Pacific. Because the backend code fails to properly validate whether the authenticated low-privileged user possesses sufficient authorization for the requested transactions, the application processes the malicious payload.\nUpon successful processing, the payload alters or exposes data depending on the attacker's intent. The post-exploitation impact includes unauthorized read access to a subset of sensitive information, as well as unauthorized creation, deletion, and modification access to critical records and all data accessible within Oracle Financials for Asia/Pacific. The scope (S:U) remains unchanged, meaning the vulnerability is strictly confined to the Oracle Financials for Asia/Pacific security context."
}