Description
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote takeover of Oracle Bills of Material via HTTP
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows a low‑privileged attacker who can reach the application via HTTP to compromise the Oracle Bills of Material component. Successful exploitation grants complete control, resulting in loss of confidentiality, integrity, and availability.

Affected Systems

Oracle Bills of Material, part of Oracle E‑Business Suite, affected versions 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS score indicates high severity; the EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is network via HTTP, requiring the attacker to have access to a low‑privileged account. Though the exploitation complexity is high, an attacker who can reach the service can achieve full application takeover.

Generated by OpenCVE AI on October 28, 2026 at 01:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor patch or update to the latest Oracle Bills of Material release indicated in the October 2026 security advisory to eliminate the flaw
  • Restrict access to the Bills of Material HTTP interface to trusted IP ranges or VPN endpoints to limit exposure to untrusted networks
  • Enable and monitor application audit logs for anomalous authentication or access events to detect potential exploitation attempts

Generated by OpenCVE AI on October 28, 2026 at 01:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit Enables Full Oracle Bills of Material Takeover

Tue, 27 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Title Remote HTTP Compromise of Oracle Bills of Material
Weaknesses CWE-284
CWE-285

Tue, 27 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 03:45:00 +0000

Type Values Removed Values Added
Title Remote HTTP Compromise of Oracle Bills of Material
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle bills Of Material
CPEs cpe:2.3:a:oracle:bills_of_material:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle bills Of Material
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Bills Of Material
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T11:48:03.707Z

Reserved: 2026-09-28T15:40:09.511Z

Link: CVE-2026-101847

cve-icon Vulnrichment

Updated: 2026-10-27T11:47:50.139Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:40.723

Modified: 2026-10-27T12:16:56.590

Link: CVE-2026-101847

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:30:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor