Description
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Order Management accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N).
Published: 2026-10-20
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and confidentiality breach
Action: Apply patch
AI Analysis

Impact

The vulnerability resides in the Product Diagnostic Tools component of Oracle Order Management from Oracle E‑Business Suite. A low‑privileged attacker who can reach the system over HTTP is able to compromise the application. Successful exploitation allows the attacker to read sensitive data, and update, insert or delete records that are otherwise restricted, thereby exposing critical business information and enabling unauthorized manipulation of data.

Affected Systems

Oracle Order Management for Oracle E‑Business Suite versions 12.2.3 through 12.2.15 are affected. The issue specifically targets the Product Diagnostic Tools component within this product line.

Risk and Exploitability

The CVSS v3.1 base score of 5.9 indicates a moderate risk level with high confidentiality impact. The EPSS score is less than 1%, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is network access via HTTP, requiring only low privileges, and the attacker could gain access to and modify sensitive data accessible through the diagnostic interface.

Generated by OpenCVE AI on October 27, 2026 at 23:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest security patch released by Oracle as part of the CPU Oct 2026 advisory to update the Product Diagnostic Tools component
  • Disable or restrict external HTTP access to the Product Diagnostic Tools interfaces to limit exposure
  • Implement stricter access controls on diagnostic interfaces to ensure only authorized users can perform data operations

Generated by OpenCVE AI on October 27, 2026 at 23:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access and Modification via Oracle Order Management Diagnostic Tools

Tue, 27 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via Product Diagnostic Tools in Oracle Order Management
Weaknesses CWE-284
CWE-285

Tue, 27 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via Product Diagnostic Tools in Oracle Order Management
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Order Management accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N).
First Time appeared Oracle
Oracle order Management
CPEs cpe:2.3:a:oracle:order_management:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle order Management
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Oracle Order Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T12:07:25.117Z

Reserved: 2026-07-08T15:51:55.587Z

Link: CVE-2026-60746

cve-icon Vulnrichment

Updated: 2026-10-27T12:07:13.123Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:19:31.990

Modified: 2026-10-27T13:16:58.000

Link: CVE-2026-60746

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T23:45:11Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor