Description
Vulnerability in the Oracle Operations Intelligence product of Oracle E-Business Suite (component: Daily Business Intelligence). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Operations Intelligence. Successful attacks of this vulnerability can result in takeover of Oracle Operations Intelligence. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The reported weakness in Oracle Operations Intelligence's Daily Business Intelligence component allows an attacker with low privileges to gain control of the system. An attacker with network connectivity to HTTP endpoints can exploit the vulnerability and achieve a takeover of Oracle Operations Intelligence, impacting confidentiality, integrity, and availability.

Affected Systems

Affected by Oracle Corporation: Oracle Operations Intelligence. The versions impacted are 12.2.3 through 12.2.15. Any installation of these versions deployed behind an HTTP interface is vulnerable.

Risk and Exploitability

The vulnerability is rated CVSS 7.5 with high impact on confidentiality, integrity, and availability, but has a high attack complexity and requires only low privileges. The EPSS score is 0.00345 (less than 1%), and the vulnerability is not listed in CISA's KEV catalog. It can be exploited from any network point that can reach the HTTP interface, allowing a remote compromise with minimal effort and potentially full control of the Oracle Operations Intelligence environment.

Generated by OpenCVE AI on August 21, 2026 at 07:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle Operations Intelligence to a non-affected version (e.g., 12.2.16 or later) or apply the latest Oracle patch for this vulnerability.
  • Restrict HTTP access to the Oracle Operations Intelligence interface to trusted IP ranges and enforce firewall rules to limit exposure to the internet.
  • Apply least privilege principles to the user accounts and service accounts that interact with the Daily Business Intelligence component to reduce the blast radius of any successful exploit.
  • Enable and monitor detailed logging for the Daily Business Intelligence service to detect anomalous activity indicative of exploitation.

Generated by OpenCVE AI on August 21, 2026 at 07:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle e-business Suite
CPEs cpe:2.3:a:oracle:e-business_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:operations_intelligence:-:*:*:*:*:*:*:*
Vendors & Products Oracle e-business Suite

Mon, 24 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 08:15:00 +0000

Type Values Removed Values Added
Title Low Privilege HTTP Exploit Allows System Compromise in Oracle Operations Intelligence
Weaknesses CWE-284

Wed, 19 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Title Remote Compromise of Oracle Operations Intelligence via Low-Privilege HTTP Attack
Weaknesses CWE-284

Wed, 19 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
Title Remote Compromise of Oracle Operations Intelligence via Low-Privilege HTTP Attack
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Operations Intelligence product of Oracle E-Business Suite (component: Daily Business Intelligence). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Operations Intelligence. Successful attacks of this vulnerability can result in takeover of Oracle Operations Intelligence. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle operations Intelligence
CPEs cpe:2.3:a:oracle:operations_intelligence:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle operations Intelligence
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle E-business Suite Operations Intelligence
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-24T19:54:23.378Z

Reserved: 2026-08-04T22:06:34.595Z

Link: CVE-2026-70763

cve-icon Vulnrichment

Updated: 2026-08-24T19:50:17.682Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:28.943

Modified: 2026-08-28T18:26:56.750

Link: CVE-2026-70763

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T08:00:08Z

Weaknesses