Description
Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Online. Successful attacks of this vulnerability can result in takeover of Oracle Sales Online. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A low‑privileged attacker who can connect over HTTP can fully compromise the Oracle Sales Online application, gaining control of the system and its data. The flaw is an improper access control vulnerability (CWE-284) that permits unauthorized access to protected resources. The impact includes loss of confidentiality, integrity, and availability as the attacker can modify, delete, or read sensitive information and disrupt normal operation.

Affected Systems

Oracle Corporation’s Oracle Sales Online product of Oracle E‑Business Suite, versions 12.2.3 to 12.2.15, is affected.

Risk and Exploitability

The CVSS v3.1 base score is 8.8, reflecting high severity. The EPSS score is below 1%, indicating that exploitation is currently considered unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. Attack is likely over HTTP, requires only low privileged access, and the exploitation path is straightforward from the network.

Generated by OpenCVE AI on September 20, 2026 at 11:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch that addresses this vulnerability as detailed in the Oracle security advisory.
  • Restrict HTTP access to the Oracle Sales Online service to trusted IP ranges or network segments, blocking all other traffic.
  • Enable auditing and monitor application logs for any suspicious activity or unauthorized access attempts.

Generated by OpenCVE AI on September 20, 2026 at 11:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Title Oracle Sales Online Vulnerability Allows Full Remote Compromise via HTTP

Sun, 20 Sep 2026 10:00:00 +0000

Type Values Removed Values Added
Title Remote Compromise via HTTP in Oracle Sales Online
Weaknesses CWE-94

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 04:00:00 +0000

Type Values Removed Values Added
Title Remote Compromise via HTTP in Oracle Sales Online
Weaknesses CWE-284
CWE-94

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Online. Successful attacks of this vulnerability can result in takeover of Oracle Sales Online. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle sales Online
CPEs cpe:2.3:a:oracle:sales_online:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle sales Online
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Sales Online
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T15:18:56.892Z

Reserved: 2026-08-31T15:40:57.341Z

Link: CVE-2026-83124

cve-icon Vulnrichment

Updated: 2026-09-17T14:58:49.507Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:22.833

Modified: 2026-09-17T16:18:03.887

Link: CVE-2026-83124

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T11:30:17Z

Weaknesses