Description
Vulnerability in the Oracle E-Business Suite Secure Enterprise Search product of Oracle E-Business Suite (component: Search Integration Engine). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Secure Enterprise Search. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Suite Secure Enterprise Search accessible data as well as unauthorized access to critical data or complete access to all Oracle E-Business Suite Secure Enterprise Search accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the Search Integration Engine component of Oracle E‑Business Suite Secure Enterprise Search. An attacker who only has low‑privileged network access over HTTP can exploit the flaw to create, delete, or modify critical data. The impact is severe loss of confidentiality and integrity because the attacker gains the ability to alter or access all data exposed by the Secure Enterprise Search feature.

Affected Systems

Oracle Corporation’s Oracle E‑Business Suite Secure Enterprise Search product, versions 12.2.3 through 12.2.15, contains the affected Search Integration Engine. Only these supported releases include the vulnerable component.

Risk and Exploitability

The CVSS v3.1 base score of 8.1 indicates a high‑severity flaw that is remotely exploitable over HTTP with low attack complexity and requires a low‑privileged attacker. The EPSS score of less than 1% reflects a low overall probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Nevertheless, its high confidentiality and integrity impact makes it a priority for affected systems.

Generated by OpenCVE AI on August 4, 2026 at 16:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official Oracle CPU July 2026 patch for E‑Business Suite Secure Enterprise Search on all affected installations.
  • If patching cannot occur immediately, restrict inbound HTTP traffic to the Secure Enterprise Search endpoint to trusted IP addresses or disable the search functionality until patched.
  • Re‑evaluate account and service privileges in Oracle E‑Business Suite to enforce the principle of least privilege for the Search Integration Engine and related services.

Generated by OpenCVE AI on August 4, 2026 at 16:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via HTTP in Oracle E‑Business Suite Secure Enterprise Search

Sun, 02 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via HTTP in Oracle E‑Business Suite Secure Enterprise Search

Tue, 28 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via Low-Privilege HTTP Attack on Oracle Secure Enterprise Search

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via Low-Privilege HTTP Attack on Oracle Secure Enterprise Search

Wed, 22 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle E-Business Suite Secure Enterprise Search product of Oracle E-Business Suite (component: Search Integration Engine). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Secure Enterprise Search. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Suite Secure Enterprise Search accessible data as well as unauthorized access to critical data or complete access to all Oracle E-Business Suite Secure Enterprise Search accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle e-business Suite Secure Enterprise Search
CPEs cpe:2.3:a:oracle:e-business_suite_secure_enterprise_search:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle e-business Suite Secure Enterprise Search
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle E-business Suite Secure Enterprise Search
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-22T18:31:36.733Z

Reserved: 2026-07-08T15:52:20.741Z

Link: CVE-2026-61218

cve-icon Vulnrichment

Updated: 2026-07-22T18:31:27.220Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T16:15:03Z

Weaknesses