Description

Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Loans. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Loans accessible data as well as unauthorized update, insert or delete access to some of Oracle Loans accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T21:17:40.153Z",
  "pubdate": "2026-08-18T21:17:40.153Z",
  "executiveSummary": "An authorization vulnerability exists within the Internal Operations component of the Oracle Loans product in Oracle E-Business Suite versions 12.2.3 through 12.2.15. This security flaw allows a low-privileged authenticated attacker with network access via HTTP to compromise the affected product. Successful exploitation can lead to unauthorized read access to critical data or complete access to all data accessible via Oracle Loans, as well as unauthorized update, insert, or delete capabilities against a subset of accessible data. The vulnerability presents significant risk regarding data confidentiality and integrity within enterprise financial operations. Exploitation requires low privileges but no user interaction, making it accessible to malicious actors who have obtained standard internal user credentials. Remediation requires applying the appropriate vendor-supplied patches for the Oracle E-Business Suite environment.",
  "technicalDetails": "The vulnerability resides in the Internal Operations component of Oracle Loans within Oracle E-Business Suite versions 12.2.3 through 12.2.15. The root cause stems from insufficient authorization checks and access control enforcement within the application logic governing sensitive loan data transactions and data retrieval routines. Attackers leverage the HTTP protocol over the network to interact with vulnerable endpoints exposed by the application server. Because the attack vector is network-based (AV:N), an adversary does not require physical access or local terminal interaction. The complexity of exploitation is low (AC:L), requiring minimal technical effort once access is established, and no user interaction (UI:N) is mandated to successfully trigger the flaw. Although the attacker must possess low privileges (PR:L)—implying valid user credentials within the system—the authorization bypass permits them to exceed their assigned operational boundaries. The attack flow begins with the authenticated low-privileged user crafting and transmitting malicious HTTP requests directed at unprotected or improperly restricted Oracle Loans functions. Due to the lack of adequate server-side validation regarding the user's role and data access permissions, the application processes the request and executes unauthorized database operations. The payload behavior results in the extraction of highly confidential financial and operational records, alongside unauthorized data manipulation including insertion, modification, or deletion of specific transaction sets. The post-exploitation impact directly undermines confidentiality (C:H) by exposing critical data repositories, and partially compromises integrity (I:L) by allowing unauthorized state modifications to specific Oracle Loans data structures, while availability remains unaffected (A:N)."
}