Description
Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customers Online. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customers Online accessible data as well as unauthorized access to critical data or complete access to all Oracle Customers Online accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw in Oracle Customers Online, part of Oracle E‑Business Suite, allows a low‑privileged attacker with network access over HTTP to create, delete, or alter critical data, or to read all data accessible through the application. The vulnerability is classified as an improper access control (CWE‑284) and is rated CVSS 3.1 with a base score of 8.1, indicating substantial confidentiality and integrity impacts while availability remains unaffected.

Affected Systems

Affected versions are Oracle E‑Business Suite 12.2.3 through 12.2.15 within the Customers Online application’s Internal Operations component. The product is widely used by enterprises that rely on this suite for e‑commerce and online transactions.

Risk and Exploitability

The EPSS score of less than 1% suggests that the vulnerability is not yet widely leveraged in the wild, and it is not listed in CISA’s KEV catalog. Nevertheless, because the flaw is easily exploitable via a direct HTTP request to internal endpoints that lack proper authorization checks, the potential for unauthorized data manipulation remains high. The low complexity and low privileges required elevate the risk for organizations that expose Customers Online to the network.

Generated by OpenCVE AI on August 4, 2026 at 16:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle CPU July 2026 patch that addresses the vulnerability in Customers Online
  • Restrict HTTP access to the Customers Online application to trusted networks, VPNs, or internal firewalls
  • Enforce strict role‑based access controls and enable detailed audit logging for all data modification operations

Generated by OpenCVE AI on August 4, 2026 at 16:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
Title Unprivileged HTTP Access Enables Unauthorized Data Modification in Oracle Customers Online

Sun, 02 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Title Unprivileged HTTP Access Enables Unauthorized Data Modification in Oracle Customers Online

Thu, 30 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via HTTP in Oracle Customers Online

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via HTTP in Oracle Customers Online
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customers Online. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customers Online accessible data as well as unauthorized access to critical data or complete access to all Oracle Customers Online accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle customers Online
CPEs cpe:2.3:a:oracle:customers_online:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle customers Online
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Customers Online
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T14:55:38.181Z

Reserved: 2026-07-08T15:51:55.608Z

Link: CVE-2026-61019

cve-icon Vulnrichment

Updated: 2026-07-24T14:55:31.755Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T16:30:11Z

Weaknesses