Description
Vulnerability in the Oracle Materials Requirement Planning product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Materials Requirement Planning. Successful attacks of this vulnerability can result in takeover of Oracle Materials Requirement Planning. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Takeover of Oracle Materials Requirement Planning
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows a low‑privileged attacker with network access via HTTP to compromise the Oracle Materials Requirement Planning application, potentially leading to full takeover. The flaw is an authorization weakness that impacts confidentiality, integrity and availability, rated with a CVSS 3.1 Base Score of 7.5.

Affected Systems

Oracle Materials Requirement Planning, part of Oracle E‑Business Suite, is affected in versions 12.2.3 through 12.2.15, particularly within the Internal Operations module.

Risk and Exploitability

An attacker needs only HTTP access and a low‑privileged account. With a CVSS score of 7.5 and no EPSS data, the risk is considered significant. The vulnerability is not yet listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 21, 2026 at 05:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle security patch or upgrade to a fixed version of Oracle Materials Requirement Planning
  • Restrict HTTP access to the application by configuring firewall or ACL rules to allow only trusted IP addresses
  • Enforce strict authentication and authorization controls so that low‑privileged accounts cannot perform critical functions
  • Monitor logs and network traffic for indicators of attempted exploitation

Generated by OpenCVE AI on October 21, 2026 at 05:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
Title Remote Takeover via HTTP in Oracle Materials Requirement Planning
Weaknesses CWE-284
CWE-862

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Materials Requirement Planning product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Materials Requirement Planning. Successful attacks of this vulnerability can result in takeover of Oracle Materials Requirement Planning. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle materials Requirement Planning
CPEs cpe:2.3:a:oracle:materials_requirement_planning:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle materials Requirement Planning
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Materials Requirement Planning
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:21:29.092Z

Reserved: 2026-09-28T15:40:09.491Z

Link: CVE-2026-101546

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:04.200

Modified: 2026-10-20T22:18:04.200

Link: CVE-2026-101546

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T05:15:07Z

Weaknesses