Executive brief
Oracle Partner Management is a component of Oracle E-Business Suite used to manage partner relationships and operations. A flaw in the Internal Operations module allows a low-privileged network attacker to gain unauthorized access to sensitive partner data and make unauthorized changes. Successful exploitation could expose confidential business information or allow attackers to manipulate critical partner records.
Technical details
This is a privilege escalation vulnerability in Oracle Partner Management (Internal Operations component) affecting versions 12.2.3 through 12.2.15. The vulnerability is difficult to exploit and requires network access via HTTP and a low-privileged user account, but results in scope change where attacks may impact additional Oracle E-Business Suite products. A successful attack grants unauthorized read access to critical data and limited write access (update, insert, delete) to Oracle Partner Management accessible data. The vulnerability is present in the Internal Operations component and allows an authenticated attacker to escalate privileges. No patch information is publicly available at the time of disclosure.
Affected products
- Oracle Partner Management 12.2.3-12.2.15
Timeline
- 2026-09-15: disclosed