Threat Intelligence Database

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. While the vulnerability is in Oracle Order Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

CVE-2026-70932 is a high-severity vulnerability in Oracle Order Management versions 12.2.3 through 12.2.15. It allows a high privileged attacker with logon access to the infrastructure where Oracle Order Management runs to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Order Management, potentially impacting additional Oracle products due to scope change. The vulnerability has a CVSS 3.1 base score of 7.2, reflecting high confidentiality and integrity impacts.

CVE-2026-62445 is a high-severity vulnerability in Oracle Order Management versions 12.2.4 through 12.2.15. It allows a low-privileged attacker with network access via HTTP to gain unauthorized creation, deletion, or modification access to critical data within Oracle Order Management. The vulnerability impacts confidentiality and integrity but does not affect availability. No explicit patch or remediation level is confirmed in the vendor advisory, which recommends applying Critical Patch Updates promptly.