CVE-2026-70801 in Flow Manufacturing
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Flow Manufacturing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Flow Manufacturing accessible data as well as unauthorized update, insert or delete access to some of Oracle Flow Manufacturing accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Internal Operations component of Oracle Flow Manufacturing, a critical module within the broader Oracle E-Business Suite ecosystem designed to manage complex manufacturing processes and supply chain operations. This security flaw affects supported software versions ranging from 12.2.3 through 12.2.15, indicating that a significant portion of active enterprise deployments remain susceptible if not properly patched or mitigated. The nature of this vulnerability allows for exploitation by an attacker who possesses only low-level privileges and has network access via the HTTP protocol. This accessibility profile suggests that the flaw is likely exposed through web-facing interfaces or internal API endpoints that do not enforce strict authentication or authorization checks before processing user input, thereby enabling a compromised or unauthenticated account to interact with sensitive backend systems in ways intended for higher-privileged roles.
From a technical perspective, the vulnerability facilitates unauthorized access to critical data and permits complete access to all Oracle Flow Manufacturing accessible data. Furthermore, it allows attackers to perform unauthorized update, insert, or delete operations on this data. This combination of read and write capabilities indicates that the flaw likely involves an Insecure Direct Object Reference (IDOR) mechanism or a Broken Access Control issue where role-based permissions are not correctly validated against user identity during request processing. The ability to modify database records directly through HTTP requests implies that input validation is insufficient, allowing malicious payloads to alter operational parameters, financial records, inventory levels, or production schedules without triggering appropriate audit logs or security exceptions. This aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, as the system fails to verify whether a low-privileged user has the necessary rights to execute these high-impact actions on sensitive resources.
The operational impact of this vulnerability is severe due to its direct effect on both confidentiality and integrity, resulting in a CVSS 3.1 Base Score of 7.1 which classifies it as High severity. The Confidentiality Impact is rated as High because attackers can exfiltrate proprietary manufacturing data, customer information, or financial details that are central to business operations. Simultaneously, the Integrity Impact is rated as Low but significant in practice, as unauthorized modifications to production orders, inventory counts, or supplier contracts can disrupt supply chain continuity and cause substantial financial loss. In a real-world attack scenario, this could be leveraged for data theft or sabotage of manufacturing workflows. From an offensive security standpoint, such vulnerabilities are often exploited using techniques categorized under the MITRE ATT&CK framework, specifically within the Persistence or Impact tactics where attackers manipulate system state to maintain access or disrupt operations. The vector AV:N/AC:L/UI:N/S:U/C:H/I:L/A:N highlights that no user interaction is required and network accessibility makes it a prime target for automated scanning tools used by threat actors seeking quick wins against enterprise environments.
To mitigate this risk, organizations must prioritize the application of official security patches provided by Oracle for versions 12.2.3 through 12.2.15 immediately upon availability or as per the latest Critical Patch Update recommendations. In addition to patching, implementing strict network segmentation is essential to limit HTTP access to the Internal Operations component only from trusted management networks rather than exposing it broadly across corporate DMZs. Access control lists should be reviewed to ensure that low-privileged accounts do not have unnecessary permissions over manufacturing data endpoints. Furthermore, deploying Web Application Firewalls with rulesets tuned for detecting IDOR patterns and SQL injection attempts can provide an additional layer of defense against exploitation attempts while patching is being applied. Continuous monitoring of audit logs for anomalous write operations on critical tables will aid in early detection of any successful compromise attempts leveraging this vulnerability.