Description

Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Loans. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Loans accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Loans. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T21:17:40.297Z",
  "pubdate": "2026-08-18T21:17:40.297Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Internal Operations component of the Oracle Loans product in Oracle E-Business Suite versions 12.2.3 through 12.2.15. This security flaw allows a remote, low-privileged attacker with network access via HTTP to compromise the affected application.\nSuccessful exploitation of this vulnerability results in unauthorized creation, deletion, or modification access to critical data and all data accessible within Oracle Loans, alongside an unauthorized ability to cause a partial denial of service (partial DOS) affecting the application's availability.\nThe vulnerability carries a CVSS 3.1 Base Score of 7.1, with impacts strictly confined to integrity and availability, yielding a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. The attack vector is network-based, requiring low privileges but no user interaction, making it a critical concern for organizations utilizing vulnerable iterations of Oracle E-Business Suite.",
  "technicalDetails": "The vulnerability resides in the Internal Operations component of Oracle Loans within Oracle E-Business Suite versions 12.2.3-12.2.15. The flaw permits unauthorized manipulation of data states and disruption of service due to insufficient authorization checks and access controls within the network-exposed request handling mechanisms.\nExploitation requires the attacker to possess network access to the target environment via the HTTP protocol, along with valid low-level user credentials to authenticate against the Oracle E-Business Suite instance. The attack complexity is rated as low (AC:L), and no user interaction (UI:N) is required to successfully execute the payload.\nThe attack flow proceeds as follows: First, the low-privileged attacker establishes an HTTP connection to the exposed Oracle Loans endpoints. Second, the attacker crafts and transmits malicious or unauthorized requests targeted at the Internal Operations component, bypassing inadequate server-side validation or privilege boundaries. Third, the processing of these crafted requests by the vulnerable component results in unauthorized data modifications, including the unauthorized creation, deletion, or alteration of critical application data. Finally, the payload execution places excessive resource demands or forces application logic errors, precipitating a partial denial of service condition that degrades the availability of Oracle Loans.\nThe post-exploitation impact compromises the integrity of all data accessible via Oracle Loans, while concurrently impairing system availability through partial denial of service conditions, without directly impacting confidentiality."
}