Description
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality. Successful attacks of this vulnerability can result in takeover of Oracle Quality. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a privilege escalation flaw that allows a low‑privileged attacker with network access via HTTP to the Internal Operations endpoint to compromise Oracle Quality. Successful exploitation can lead to a full takeover of the application, affecting confidentiality, integrity, and availability.

Affected Systems

Oracle Quality inside Oracle E‑Business Suite, versions 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS rating of 7.5 reflects high severity, but an EPSS score of less than 1 % indicates a low probability of widespread exploitation. The flaw can be triggered by a low‑privileged attacker who gains HTTP access to the Internal Operations endpoint of Oracle Quality, making it difficult to exploit in practice. The exploit does not elevate a critical concern for organizations running the affected versions. The vulnerability is not listed in CISA KEV.

Generated by OpenCVE AI on September 18, 2026 at 21:18 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply2026-83114, which addresses the privilege escalation flaw (CWE-269), to the affected Oracle Quality installation.
  • Configure network access control to restrict HTTP traffic to Oracle Quality to trusted hosts or subnets, limiting exposure to potential malicious requests.
  • If the internal operations feature is unnecessary, disable or remove it to reduce the attack surface.
  • Continuously monitor Oracle Quality logs for unusual HTTP requests that may indicate an attempted exploitation, and enforce strict access control measures to mitigate CWE-269.

Generated by OpenCVE AI on September 18, 2026 at 21:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution in Oracle Quality via HTTP

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 04:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution in Oracle Quality via HTTP

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality. Successful attacks of this vulnerability can result in takeover of Oracle Quality. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle quality
CPEs cpe:2.3:a:oracle:quality:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle quality
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Quality
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:10:45.390Z

Reserved: 2026-08-31T15:40:57.340Z

Link: CVE-2026-83114

cve-icon Vulnrichment

Updated: 2026-09-17T13:02:29.018Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:21.703

Modified: 2026-09-17T14:17:33.760

Link: CVE-2026-83114

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T21:30:14Z

Weaknesses
  • CWE-269

    Improper Privilege Management