Description
Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Workbench). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Configure to Order. While the vulnerability is in Oracle Configure to Order, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configure to Order accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Published: 2026-07-21
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Vulnerability in the Oracle Configure to Order product of Oracle E‑Business Suite (Supply to Order Workbench component) allows an attacker with low privileges who can reach the web interface over HTTP to gain unauthorized access to critical data or full access to all Configure to Order data. The flaw also changes the system scope, enabling the attacker to potentially impact additional Oracle E‑Business Suite components.

Affected Systems

Oracle Configure to Order within Oracle E‑Business Suite versions 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS v3.1 base score of 7.7 classifies the weakness as high–severity, while an EPSS score of less than 1 % indicates a very low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only network access over HTTP and low‑privilege credentials, and the scope change enables the attacker to obtain access to all Configure to Order data and potentially other Oracle E‑Business Suite components.

Generated by OpenCVE AI on August 2, 2026 at 19:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch released in the July 2026 security alert to upgrade Configure to Order to a fixed version such as 12.2.16 or later.
  • Restrict HTTP access to the Configure to Order interface by limiting traffic to trusted IP ranges or by using a firewall or reverse‑proxy rule.
  • If patching cannot be performed immediately, implement network segmentation or access controls to prevent low‑privilege users from reaching the Configure to Order web interface.

Generated by OpenCVE AI on August 2, 2026 at 19:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Title Oracle Configure to Order Vulnerability Allowing Unauthorized Data Access

Tue, 28 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Title HTTP Exploit Enables Unauthorized Data Access in Oracle Configure to Order
Weaknesses CWE-269

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title HTTP Exploit Enables Unauthorized Data Access in Oracle Configure to Order
Weaknesses CWE-200
CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Workbench). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Configure to Order. While the vulnerability is in Oracle Configure to Order, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configure to Order accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
First Time appeared Oracle
Oracle configure To Order
CPEs cpe:2.3:a:oracle:configure_to_order:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle configure To Order
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Oracle Configure To Order
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T19:32:55.386Z

Reserved: 2026-07-08T15:51:55.614Z

Link: CVE-2026-61125

cve-icon Vulnrichment

Updated: 2026-07-23T19:32:50.860Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T20:00:12Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor