Description
Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair and Overhaul. While the vulnerability is in Oracle Complex Maintenance, Repair and Overhaul, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Complex Maintenance, Repair and Overhaul accessible data as well as unauthorized update, insert or delete access to some of Oracle Complex Maintenance, Repair and Overhaul accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N).
Published: 2026-07-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability exists in the Oracle Complex Maintenance, Repair and Overhaul product, specifically within its Internal Operations component of Oracle E‑Business Suite. An unauthenticated attacker who can reach the application over HTTP can exploit a weakness that allows unauthorized reading of sensitive data as well as insertion, updating, or deletion of data available to the application. The flaw is an authorization failure (CWE‑284), resulting in high confidentiality impact and lower integrity impact, while availability is not directly affected.

Affected Systems

Oracle Complex Maintenance, Repair and Overhaul, a component of Oracle E‑Business Suite provided by Oracle Corporation, is affected for versions 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS 3.1 base score of 7.5 indicates a high severity with significant confidentiality loss. The EPSS score of <1% shows that active exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the product via unauthenticated HTTP requests over the network, which may also expand the attack’s scope to compromise additional Oracle products that share the same environment.

Generated by OpenCVE AI on August 4, 2026 at 01:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle CPU July 2026 patch for Complex Maintenance, Repair and Overhaul
  • Restrict HTTP access to the application by firewall rules or network segmentation until the patch is applied
  • Enable logging and monitoring of database operations to detect unauthorized insert, update or delete activities

Generated by OpenCVE AI on August 4, 2026 at 01:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 02:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Data Compromise in Oracle Complex Maintenance, Repair and Overhaul

Thu, 30 Jul 2026 11:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Data Compromise in Oracle Complex Maintenance, Repair and Overhaul

Tue, 28 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit in Oracle Complex Maintenance, Repair and Overhaul Allows Unauthorized Data Access
Weaknesses CWE-287

Fri, 24 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit in Oracle Complex Maintenance, Repair and Overhaul Allows Unauthorized Data Access
Weaknesses CWE-287

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair and Overhaul. While the vulnerability is in Oracle Complex Maintenance, Repair and Overhaul, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Complex Maintenance, Repair and Overhaul accessible data as well as unauthorized update, insert or delete access to some of Oracle Complex Maintenance, Repair and Overhaul accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N).
First Time appeared Oracle
Oracle complex Maintenance Repair And Overhaul
CPEs cpe:2.3:a:oracle:complex_maintenance__repair_and_overhaul:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle complex Maintenance Repair And Overhaul
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Oracle Complex Maintenance Repair And Overhaul
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T18:45:27.998Z

Reserved: 2026-07-08T15:51:55.615Z

Link: CVE-2026-61138

cve-icon Vulnrichment

Updated: 2026-07-23T18:45:24.304Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-07-21T22:18:45.187

Modified: 2026-07-23T19:16:57.797

Link: CVE-2026-61138

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T01:45:03Z

Weaknesses