CVE-2026-47031 in Bills of Material
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Bill Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle E-Business Suite's Bills of Material component, specifically in the Bill Issues functionality that manages manufacturing bill structures and material requirements. The affected versions span from 12.2.3 through 12.2.15, indicating a substantial release range where this security gap has persisted. The vulnerability classification as easily exploitable suggests that attackers require minimal prerequisites to leverage this flaw effectively, making it particularly dangerous for organizations operating these legacy systems. The attack vector requires only network access via HTTP, meaning that an attacker could potentially exploit this weakness from remote locations without requiring physical system access or specialized tools beyond standard web browsing capabilities.
The technical nature of this vulnerability allows a low privileged attacker to gain complete control over the Bills of Material functionality, representing a severe compromise of the system's integrity and availability. This type of privilege escalation vulnerability typically stems from inadequate input validation, insufficient access controls, or flawed authentication mechanisms within the web application layer. The CVSS 3.1 score of 8.8 reflects the high severity impact across all three core security properties - confidentiality, integrity, and availability - indicating that successful exploitation could lead to complete system compromise. The attack complexity is rated as low (AC:L), meaning that the exploit does not require specialized skills or circumstances to execute effectively.
The operational impact of this vulnerability extends beyond simple data theft or modification to encompass complete system takeover capabilities. An attacker who successfully exploits this weakness could manipulate manufacturing bills, alter material requirements, disrupt production planning processes, and potentially cause significant operational disruptions. This represents a critical threat to manufacturing operations where accurate bill of materials is essential for production scheduling, inventory management, and quality control processes. Organizations relying on these systems may face production delays, material waste, safety issues, and financial losses if this vulnerability is exploited.
Mitigation strategies should prioritize immediate patch application from Oracle's security advisories, as this represents a critical vulnerability requiring urgent attention. Network segmentation and access controls should be strengthened to limit exposure of the affected components, while implementing web application firewalls to monitor and filter HTTP traffic. Regular security assessments and penetration testing should be conducted to identify similar vulnerabilities within other Oracle E-Business Suite components. The vulnerability aligns with CWE-284 (Improper Access Control) and may exhibit characteristics consistent with ATT&CK techniques involving privilege escalation and persistence within enterprise applications, making comprehensive defensive measures essential for protecting manufacturing and operational technology environments.