Description
Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle One-to-One Fulfillment executes to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8 High
EPSS: < 1% Very Low
KEV: No
Impact: Full system takeover of Oracle One-to-One Fulfillment
Action: Patch
AI Analysis

Impact

The vulnerability in Oracle One-to-One Fulfillment allows a low‑privileged attacker who can access the physical communication segment attached to the device's hardware to compromise the application. Successful exploitation can lead to a full takeover of Oracle One-to-One Fulfillment, affecting confidentiality, integrity, and availability. The issue roots from a weak privilege management flaw identified as CWE‑269.

Affected Systems

The product affected is Oracle One-to-One Fulfillment, part of Oracle E‑Business Suite. Versions from 12.2.3 through 12.2.15 inclusive are impacted.

Risk and Exploitability

The CVSS base score of 8.0 reflects severe impact. The EPSS score of less than 1% suggests exploitation is unlikely, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is the physical communication segment that requires local access and low privileges (inferred). If an attacker gains that access, the application could be taken over.

Generated by OpenCVE AI on September 20, 2026 at 10:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available patch or upgrade Oracle One-to-One Fulfillment to a version beyond 12.2.15 that incorporates the fix.
  • Enforce strict access controls on the physical communication segment, ensuring that only authorized, high‑privilege users can reach it.
  • Continuously monitor traffic on the physical communication segment for anomalous patterns and configure alerts for suspicious activity.

Generated by OpenCVE AI on September 20, 2026 at 10:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Title Local Physical Access Allows Full Compromise of Oracle One-to-One Fulfillment

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle One-to-One Fulfillment via Physical Communication Segment
Weaknesses CWE-272
CWE-287

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 17 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle One-to-One Fulfillment via Physical Communication Segment
Weaknesses CWE-272
CWE-287

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle One-to-One Fulfillment executes to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle one-to-one Fulfillment
CPEs cpe:2.3:a:oracle:one-to-one_fulfillment:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle one-to-one Fulfillment
References
Metrics cvssV3_1

{'score': 8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle One-to-one Fulfillment
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:10:43.038Z

Reserved: 2026-08-31T15:40:57.344Z

Link: CVE-2026-83170

cve-icon Vulnrichment

Updated: 2026-09-17T13:02:01.342Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:27.990

Modified: 2026-09-17T14:17:35.093

Link: CVE-2026-83170

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T10:30:17Z

Weaknesses
  • CWE-269

    Improper Privilege Management