Description
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Asset Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Oracle Enterprise Asset Management allows an attacker who can reach the web interface and has low‑privileged access to obtain full control over the application. The weakness is an improper access control that permits privileged operations for low‑privileged users, leading to compromise of confidentiality, integrity, and availability of asset management data and services.

Affected Systems

Oracle Corporation’s Enterprise Asset Management component of the Oracle E‑Business Suite is affected. Versions 12.2.3 through 12.2.15 contain the vulnerability and any installation within this range is vulnerable.

Risk and Exploitability

The flaw carries a CVSS 3.1 base score of 8.8, indicating high severity, and a very low EPSS probability of under 1%. The vulnerability is not listed in CISA KEV, but its remote HTTP access vector and low privilege requirement mean that a broad range of network users could potentially exploit it, resulting in full application takeover.

Generated by OpenCVE AI on August 4, 2026 at 03:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle CPU patch for Enterprise Asset Management that addresses the authentication bypass flaw.
  • Restrict the HTTP/HTTPS service endpoints to trusted internal networks or enforce VPN access to limit exposure to the web interface.
  • Enforce least privilege by disabling unnecessary low‑privileged accounts that can access the service and consider implementing application‑level role separation.

Generated by OpenCVE AI on August 4, 2026 at 03:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Title Improper Access Control in Oracle Enterprise Asset Management Allows Full Application Compromise

Thu, 30 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Title Improper Access Control in Oracle Enterprise Asset Management Allows Full Application Compromise

Tue, 28 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Title Low‑privilege Remote HTTP Exploit Enables Full Compromise of Oracle Enterprise Asset Management

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Title Low‑privilege Remote HTTP Exploit Enables Full Compromise of Oracle Enterprise Asset Management
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Asset Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle enterprise Asset Management
CPEs cpe:2.3:a:oracle:enterprise_asset_management:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle enterprise Asset Management
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Enterprise Asset Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T15:25:18.149Z

Reserved: 2026-07-08T15:51:55.578Z

Link: CVE-2026-60692

cve-icon Vulnrichment

Updated: 2026-07-24T15:04:52.674Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:18:10.037

Modified: 2026-07-28T17:19:45.613

Link: CVE-2026-60692

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T03:15:03Z

Weaknesses