Description
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in the Oracle Bills of Material product within Oracle E‑Business Suite allows a low‑privileged attacker with network access via HTTP to fully compromise the application. Successful exploitation can result in a complete takeover of Oracle Bills of Material, granting the attacker full confidentiality, integrity, and availability impact.

Affected Systems

Affected systems are the Oracle Bills of Material component within Oracle E‑Business Suite, specifically the Setup Workbench product. Versions that are impacted range from 12.2.3 through 12.2.15, as listed by the vendor's advisory.

Risk and Exploitability

The CVSS v3.1 base score of 8.8 indicates high severity, and the EPSS score of < 1% suggests the likelihood of exploitation is currently low, though the vulnerability is not listed in CISA's KEV catalog. The attack vector is remote over HTTP, requiring only network connectivity and low privilege, making it an attractive target for adversaries on the same network or with port access, and an unpatched instance exposes the full application layer for takeover.

Generated by OpenCVE AI on September 17, 2026 at 23:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the most recent Oracle patch that addresses the Bills of Material security vulnerability.
  • Restrict HTTP access to the Bills of Material interface to trusted IP ranges or VPNs to limit exposure to low privileged attackers.
  • Enable logging and monitoring for anomalous authentication attempts or unauthorized HTTP traffic on the Bills of Material endpoints.

Generated by OpenCVE AI on September 17, 2026 at 23:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 00:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via HTTP in Oracle Bills of Material
Weaknesses CWE-284

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via HTTP in Oracle Bills of Material
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle bills Of Material
CPEs cpe:2.3:a:oracle:bills_of_material:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle bills Of Material
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Bills Of Material
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:00:21.816Z

Reserved: 2026-09-08T21:49:12.398Z

Link: CVE-2026-87150

cve-icon Vulnrichment

Updated: 2026-09-17T12:57:49.845Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:19:02.430

Modified: 2026-09-17T14:17:47.137

Link: CVE-2026-87150

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T23:45:17Z

Weaknesses
  • CWE-269

    Improper Privilege Management