Description
Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Warehouse Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Warehouse Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-08-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability enables an attacker who is not authenticated to connect over HTTP to the Internal Operations component of Oracle Warehouse Management. The flaw bypasses normal authentication checks, allowing unauthorized read of critical data. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates that the impact is limited to confidentiality while integrity and availability are not directly affected.

Affected Systems

Affected vendors and products include Oracle Corporation’s Oracle Warehouse Management, which is part of Oracle E‑Business Suite. The CVE specifically targets supported versions from 12.2.3 through 12.2.15. This affects all deployments of those versions unless patched or otherwise secured.

Risk and Exploitability

The CVSS base score of 7.5 classifies this as a high‑severity vulnerability with significant risks if left unpatched. EPSS score is < 1%, indicating a very low exploitation probability, but the lack of authentication requirements and simple network access via HTTP suggest that attackers could readily target it. The vulnerability is not currently listed in the CISA KEV catalog, but the undisclosed exploitation potential warrants a proactive response.

Generated by OpenCVE AI on August 21, 2026 at 08:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the Oracle security patch for Oracle Warehouse Management that addresses the authentication bypass for versions 12.2.3 through 12.2.15
  • Segment the network so that only trusted hosts can reach the Internal Operations component over HTTP, and block or monitor all other inbound traffic to that endpoint
  • Enforce strict authentication and audit logging on the Warehouse Management application to detect and prevent unauthorized data access

Generated by OpenCVE AI on August 21, 2026 at 08:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 08:45:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in Oracle Warehouse Management Allowing Unauthorized Data Access
Weaknesses CWE-284
CWE-862

Fri, 21 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access to Oracle Warehouse Management Data
Weaknesses CWE-287

Wed, 19 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access to Oracle Warehouse Management Data
Weaknesses CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Warehouse Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Warehouse Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle warehouse Management
CPEs cpe:2.3:a:oracle:warehouse_management:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle warehouse Management
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Warehouse Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-24T14:23:55.969Z

Reserved: 2026-08-04T22:06:34.596Z

Link: CVE-2026-70772

cve-icon Vulnrichment

Updated: 2026-08-24T13:30:28.937Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:30.017

Modified: 2026-08-28T18:27:08.013

Link: CVE-2026-70772

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T08:30:04Z

Weaknesses