Description
Vulnerability in the Oracle Process Manufacturing Logistics product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Logistics. Successful attacks of this vulnerability can result in takeover of Oracle Process Manufacturing Logistics. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows a high‑privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Logistics, potentially taking full control of the system. It is a privilege escalation flaw (CWE‑269) that can lead to complete loss of confidentiality, integrity, and availability. The CVSS 3.1 Base Score of 7.2 reflects significant impact on all three security objectives.

Affected Systems

Oracle Process Manufacturing Logistics, part of Oracle E‑Business Suite, Internal Operations component, is affected in version ranges 12.2.3 through 12.2.15.

Risk and Exploitability

The flaw is reachable over the network via HTTP with low attack complexity and requires the attacker to have high privileges on the system. The EPSS score is less than 1 % and the vulnerability is not listed in CISA KEV, indicating a low current exploitation probability. Nonetheless, because a successful exploitation would grant attackers full control, the risk remains significant, especially if elevated accounts can be abused.

Generated by OpenCVE AI on August 2, 2026 at 20:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch or upgrade beyond version 12.2.15 to eliminate the flaw.
  • Restrict HTTP access to the Process Manufacturing Logistics service to trusted internal networks or subnets to limit exposure to external adversaries.
  • Enforce least‑privilege policies for all accounts with elevated rights and perform regular reviews of permissions to prevent lateral movement and abuse of privileged accounts.

Generated by OpenCVE AI on August 2, 2026 at 20:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Title High Privilege HTTP Exploit Enables Complete Takeover of Oracle Process Manufacturing Logistics

Tue, 28 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title High Privileged Remote Exploit Compromising Oracle Process Manufacturing Logistics
Weaknesses CWE-284

Fri, 24 Jul 2026 19:15:00 +0000

Type Values Removed Values Added
Title High Privileged Remote Exploit Compromising Oracle Process Manufacturing Logistics
Weaknesses CWE-284

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Process Manufacturing Logistics product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Logistics. Successful attacks of this vulnerability can result in takeover of Oracle Process Manufacturing Logistics. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle process Manufacturing Logistics
CPEs cpe:2.3:a:oracle:process_manufacturing_logistics:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle process Manufacturing Logistics
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Process Manufacturing Logistics
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T14:57:29.712Z

Reserved: 2026-07-08T15:51:55.607Z

Link: CVE-2026-61006

cve-icon Vulnrichment

Updated: 2026-07-24T14:57:23.774Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T20:30:04Z

Weaknesses
  • CWE-269

    Improper Privilege Management