Description
Vulnerability in the Oracle Performance Management product of Oracle E-Business Suite (component: Appraisals). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Performance Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Performance Management accessible data as well as unauthorized read access to a subset of Oracle Performance Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-07-21
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Performance Management in Oracle E‑Business Suite reveals an easily exploitable flaw that permits a low‑privileged attacker to alter, delete, or insert data, and read sensitive data, impacting confidentiality and integrity. The vulnerability is a misuse of authorization (CWE-284) within the Appraisals component and is triggered through HTTP requests. Successful exploitation grants unauthorized access to data without affecting availability.

Affected Systems

Vulnerable editions span Oracle Performance Management versions 12.2.3 through 12.2.15. These impact the Oracle E‑Business Suite installation and are accessible via the application’s HTTP interface.

Risk and Exploitability

The moderate CVSS Base Score of 5.4 highlights limited confidentiality and integrity damage, while the low EPSS (<1%) indicates a small current exploitation probability. The vulnerability is not listed in CISA KEV, suggesting no widespread exploitation reported at this time. The CVSS vector identifies a Network attack with low difficulty and low attacker privileges, implying that remote attackers could exploit the flaw with minimal skill.

Generated by OpenCVE AI on August 4, 2026 at 01:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle Performance Management patch as detailed in the Oracle CPU July 2026 advisory
  • Restrict HTTP access to the Performance Management application to trusted network segments and enforce dedicated user accounts with minimal privileges
  • Enable and monitor audit logging for data changes and anomalous HTTP requests, and investigate any suspicious activity

Generated by OpenCVE AI on August 4, 2026 at 01:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Read via Low-Privilege HTTP Attack on Oracle Performance Management

Thu, 30 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP-Based Data Manipulation in Oracle Performance Management

Mon, 27 Jul 2026 11:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP-Based Data Manipulation in Oracle Performance Management

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Performance Management product of Oracle E-Business Suite (component: Appraisals). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Performance Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Performance Management accessible data as well as unauthorized read access to a subset of Oracle Performance Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle performance Management
CPEs cpe:2.3:a:oracle:performance_management:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle performance Management
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Performance Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T19:15:44.203Z

Reserved: 2026-07-08T15:51:55.612Z

Link: CVE-2026-61083

cve-icon Vulnrichment

Updated: 2026-07-23T19:15:39.259Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T02:00:12Z

Weaknesses