Description
Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Core Receiving). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Inventory Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Inventory Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Inventory Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Oracle Inventory Management Core Receiving component, identified as a missing access control weakness (CWE-284), allows an attacker with low privileges to use an HTTP interface to create, delete or modify critical data, or obtain complete access to all inventory information. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) shows that the vulnerability is exploitable over the network with minimal effort and produces full confidentiality and integrity compromise.

Affected Systems

Oracle Inventory Management for Oracle E‑Business Suite, Core Receiving component, versions 12.2.3 through 12.2.15, are affected.

Risk and Exploitability

The CVSS base score of 8.1 indicates high severity, yet the EPSS score of less than 1% signals a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalogue. Attackers only need network access via HTTP and low‑privilege credentials; no elevated privileges are required. While exploitation is unlikely at present, the potential for serious data integrity and confidentiality damage warrants prompt action.

Generated by OpenCVE AI on August 4, 2026 at 02:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for Inventory Management as released in the July 2026 security update
  • Restrict HTTP access to the Inventory Management servers to trusted IP ranges or VPN only
  • Verify and enforce proper role‑based permissions for the Core Receiving module to limit low‑privileged user actions
  • If a patch is not immediately available, consider temporarily disabling the Core Receiving HTTP endpoint or isolating the affected system from external networks
  • Monitor inventory logs for unusual or unauthorized modification activities

Generated by OpenCVE AI on August 4, 2026 at 02:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
Title Unauthorized data modification and full data exposure via Core Receiving HTTP interface in Oracle Inventory Management

Thu, 30 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Title Unauthorized data modification and full data exposure via Core Receiving HTTP interface in Oracle Inventory Management

Tue, 28 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Title Exploitable Data Modification in Oracle Inventory Management Core Receiving

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Exploitable Data Modification in Oracle Inventory Management Core Receiving
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Core Receiving). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Inventory Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Inventory Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Inventory Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle inventory Management
CPEs cpe:2.3:a:oracle:inventory_management:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle inventory Management
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Inventory Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T17:09:02.247Z

Reserved: 2026-07-08T15:51:55.601Z

Link: CVE-2026-60917

cve-icon Vulnrichment

Updated: 2026-07-24T17:08:56.489Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T02:30:02Z

Weaknesses