Description

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:50.983Z",
  "pubdate": "2026-08-18T21:17:50.983Z",
  "executiveSummary": "A security vulnerability has been identified within the Product Diagnostic Tools component of Oracle Order Management, a core module of Oracle E-Business Suite. This flaw allows a low-privileged remote attacker with network access via HTTP to compromise the affected application completely. Successful exploitation of this vulnerability results in the full takeover of Oracle Order Management, yielding high impacts across confidentiality, integrity, and availability. The vulnerability is categorized as difficult to exploit, requiring high attack complexity, but demands no user interaction. The affected software versions span from 12.2.3 to 12.2.15. The risk implications are severe due to the potential for complete administrative control and unauthorized data manipulation within the enterprise resource planning environment. Remediation requires applying the official vendor-supplied patches and adhering to strict access control principles to limit unauthorized network interactions with diagnostic endpoints.",
  "technicalDetails": "The vulnerability resides within the Product Diagnostic Tools component of Oracle Order Management in Oracle E-Business Suite versions 12.2.3 through 12.2.15. The root cause stems from improper input validation or insecure handling of diagnostic requests processed via the HTTP protocol. Because diagnostic tools often possess elevated internal privileges to inspect system states, configuration parameters, and application internals, flaws within these utilities can be leveraged to bypass security boundaries.\nExploitation of this vulnerability requires the attacker to possess low-privileged user credentials within the Oracle E-Business Suite environment, alongside network access to the application via HTTP. Although the CVSS 3.1 vector indicates a high attack complexity (AC:H), a determined adversary who successfully crafts a specialized payload can exploit the diagnostic processing logic. The attack flow commences with the attacker sending a maliciously crafted HTTP request directly to the vulnerable Product Diagnostic Tools component. Upon reception, the flawed component fails to properly sanitize or restrict the input parameters, allowing the execution of unintended logic or unauthorized command execution within the context of the application server.\nThe payload behavior facilitates unauthorized privilege escalation or arbitrary code execution, ultimately leading to a total system compromise of Oracle Order Management. Post-exploitation impact includes complete system takeover, granting the attacker unconstrained read, write, and execute capabilities over sensitive business data, database transactions, and underlying application logic. The lack of required user interaction (UI:N) and the remote network vector (AV:N) streamline the attack execution once the prerequisite low-level credentials are acquired."
}