Description

Vulnerability in the Oracle Financials for EMEA product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials for EMEA. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financials for EMEA accessible data as well as unauthorized update, insert or delete access to some of Oracle Financials for EMEA accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T21:17:39.463Z",
  "pubdate": "2026-08-18T21:17:39.463Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Internal Operations component of Oracle Financials for EMEA in Oracle E-Business Suite versions 12.2.3 through 12.2.15. This security flaw allows a low-privileged attacker with network access via HTTP to compromise the affected product, leading to severe unauthorized data exposure and modification capabilities.\nThe vulnerability carries a CVSS 3.1 Base Score of 7.1 with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, indicating network-based exploitability with low complexity, requiring low privileges and no user interaction. Successful exploitation results in high confidentiality impact, granting unauthorized access to critical data or complete access to all Oracle Financials for EMEA accessible data. Additionally, it provides low integrity impact through unauthorized update, insert, or delete access to a subset of accessible data, posing significant risk to enterprise financial data integrity and compliance.",
  "technicalDetails": "The vulnerability resides in the Internal Operations component of Oracle Financials for EMEA, affecting supported software versions 12.2.3 through 12.2.15. The flaw stems from insufficient access controls and authorization enforcement mechanisms within HTTP-accessible endpoints managed by the affected component.\nAttackers initiate exploitation by establishing network connectivity to the vulnerable Oracle E-Business Suite instance via the HTTP protocol. Because the attack vector is network-based (AV:N) and requires low attack complexity (AC:L), an adversary must first obtain low-privileged credentials (PR:L) within the application domain. No user interaction (UI:N) is required to successfully orchestrate the attack.\nUpon authentication with minimal privileges, the attacker crafts specialized HTTP requests targeting the vulnerable Internal Operations functionality. Due to inadequate server-side validation of user roles and privileges during request processing, the application fails to adequately restrict access to sensitive functional routines and data repositories.\nThis authorization bypass enables the threat actor to interact with backend data objects outside their assigned privilege scope. Post-exploitation impact encompasses high-severity confidentiality breaches, allowing the retrieval of critical financial records and complete data extraction of all information accessible to Oracle Financials for EMEA. Furthermore, the low integrity impact permits the adversary to perform unauthorized insert, update, and delete operations against specific accessible data structures, potentially leading to data corruption or fraudulent financial transactions without affecting system availability (A:N)."
}