Description
Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outsourced Mfg for Discrete Industries. Successful attacks of this vulnerability can result in takeover of Oracle Outsourced Mfg for Discrete Industries. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-06-16
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Oracle Outsourced Mfg for Discrete Industries allows a low‑privileged attacker with network access via HTTP to compromise the system, potentially leading to a full takeover. The vulnerability results in complete loss of confidentiality, integrity and availability and is rated CVSS 3.1 base 8.8.

Affected Systems

Oracle E‑Business Suite product Oracle Outsourced Mfg for Discrete Industries, versions 12.2.3 through 12.2.15 are affected.

Risk and Exploitability

The vulnerability is remotely exploitable over the network using standard HTTP traffic. The EPSS score of less than 1% indicates a low but present exploitation probability, and the issue is not listed in CISA’s KEV catalog. Given the high CVSS score and the low‑privilege requirement, an attacker could quickly transition to full system compromise if no mitigations are in place.

Generated by OpenCVE AI on June 18, 2026 at 23:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available Oracle security patch for Oracle Outsourced Mfg for Discrete Industries.
  • Enforce least privilege and proper role‑based access controls to mitigate CWE‑269 (Improper Privilege Management).
  • Improve authentication mechanisms, including strong password policies and two‑factor authentication, to address CWE‑287 (Improper Authentication) and CWE‑306 (Missing Authentication for Critical Function).
  • Restrict network access to the Oracle Outsourced Mfg for Discrete Industries HTTP interfaces to trusted IP ranges using firewalls or ingress controls.

Generated by OpenCVE AI on June 18, 2026 at 23:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 19 Jun 2026 00:00:00 +0000

Type Values Removed Values Added
Title HTTP‑Based Low‑Privilege Remote Takeover of Oracle Outsourced Mfg for Discrete Industries

Thu, 18 Jun 2026 22:30:00 +0000

Type Values Removed Values Added
Title Remote System Takeover via Low-Privilege HTTP Exploit in Oracle Outsourced Mfg for Discrete Industries
Weaknesses CWE-284

Thu, 18 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
Title Remote System Takeover via Low-Privilege HTTP Exploit in Oracle Outsourced Mfg for Discrete Industries
Weaknesses CWE-269
CWE-284
CWE-287
CWE-306
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 16 Jun 2026 20:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outsourced Mfg for Discrete Industries. Successful attacks of this vulnerability can result in takeover of Oracle Outsourced Mfg for Discrete Industries. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle outsourced Mfg For Discrete Industries
CPEs cpe:2.3:a:oracle:outsourced_mfg_for_discrete_industries:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle outsourced Mfg For Discrete Industries
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Outsourced Mfg For Discrete Industries
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-06-17T15:51:06.965Z

Reserved: 2026-05-18T15:55:10.314Z

Link: CVE-2026-46972

cve-icon Vulnrichment

Updated: 2026-06-17T15:49:14.385Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-23T21:04:38Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function