EUVD-2026-105814
GHSA-8m7h-2274-prrw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged EBS account
-
DeliverySend crafted HTTP request to Capacity component
-
ExploitExploit Internal Operations flaw
-
ExecutionRead all Capacity-accessible data and alter some records
-
ImpactTrigger partial denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged Oracle E-Business Suite account with network/HTTP access to the Oracle Capacity component (Internal Operations); per CVSS PR:L this is authenticated exploitation, not unauthenticated. Affected deployments are EBS versions 12.2.3 through 12.2.15. No user interaction and low attack complexity mean any authenticated internal or externally-exposed user can attempt it, but the authentication requirement and the module-specific scope (Scope:Unchanged, impact limited to Capacity-accessible data) are the primary limiting factors; the flaw does not grant unauthenticated or cross-component access. |
| Impact | CVSS 3.1 base score is 7.6 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - network-exploitable over HTTP, low attack complexity, no user interaction, but requiring low-level privileges (PR:L), so this is an authenticated flaw, not an unauthenticated one. Confidentiality impact is High (full read of all Capacity-accessible data) while Integrity and Availability are Low (partial write and partial DoS), which is why the score lands at 7.6 rather than higher. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active or imminent exploitation; exploitation probability signals are simply absent rather than low. The 'Authentication Bypass' tag conflicts with the CVSS vector (PR:L requires valid low-privileged credentials, which contradicts a bypass) and with the description, which never mentions bypassing authentication - treat that tag as suspect. Net: a genuine High-severity authenticated issue in an enterprise ERP module that warrants prompt patching during the next maintenance window, but without KEV/POC/EPSS signals it is not an emergency drop-everything item. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged Oracle E-Business Suite account sends a crafted HTTP request to the Oracle Capacity (Internal Operations) component, abusing the flaw to read all data accessible to that module and make limited unauthorized modifications. No user interaction is needed and attack complexity is low, so a single valid credential (e.g., a compromised or over-provisioned internal user) is sufficient. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Authenticated users of Oracle E-Business Suite's Capacity module (component: Internal Operations) in versions 12.2.3 through 12.2.15 can exploit this flaw over HTTP with low attack complexity and no user interaction to read critical Capacity data, perform limited unauthorized inserts/updates/deletes, and cause a partial denial of service within that module. The CVSS 3.1 score is 7.6 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, meaning the attacker must already hold a valid low-privileged EBS account, but no further privilege escalation or victim interaction is required. Oracle addresses it through its Critical Patch Update program; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and scope is unchanged so the compromise does not extend beyond Capacity-accessible data.
RemediationAI
Apply the Oracle Critical Patch Update referenced in the advisory (https://www.oracle.com/security-alerts/cpuoct2026.html) to bring E-Business Suite 12.2.3-12.2.15 up to the patched code level for the Capacity/Internal Operations component; Oracle CPU patches are cumulative, so apply the full October 2026 CPU set for the EBS application tier (including the corresponding AD/TXK delta) rather than attempting to cherry-pick this fix. Until the patch is applied, restrict exposure by removing or narrowing the low-privileged EBS responsibilities and menus that grant access to Capacity functions - this reduces the pool of PR:L accounts that can reach the vulnerable endpoints, at the cost of temporarily blocking legitimate planning users - and by placing the EBS application tier behind network controls so that only trusted internal ranges or VPN clients can reach the Capacity servlets and Forms endpoints, which limits remote AV:N reachability but may break remote or partner access. Additional compensating controls include reviewing Capacity-related database grants for least privilege, enabling Oracle EBS audit/ FND logging on Capacity data access to detect anomalous bulk reads, and monitoring for unusual session patterns or resource exhaustion indicative of the partial-DoS condition; these detection measures add overhead and storage but do not prevent exploitation on their own.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Capacity is a planning and scheduling module inside Oracle E-Business Suite, a broad, Forms/HTML-based enterprise application stack that exposes business functions over HTTP through the application tier (Oracle HTTP Server / Oracle Forms services / Application Object Library security). This issue lives in the Internal Operations subcomponent, where insufficient authorization or input validation checks on Capacity-serving endpoints allow a user with only baseline EBS responsibilities to reach data and operations beyond their intended privilege set. Because the CVSS scope is Unchanged and the vector is PR:L with no user interaction, the weakness is a privilege/authorization boundary problem inside one module rather than a pre-authentication flaw or a full application-tier takeover: the effective blast radius is the set of records and functions the Capacity schema exposes to the compromised session. No CWE was supplied by the reporting source, so the precise root-cause class (authorization bypass versus injection versus business-logic validation) cannot be confirmed from the available data; the high confidentiality impact combined with low integrity and availability impacts is consistent with a read-oriented data exposure that also permits some record manipulation and resource exhaustion.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
HTTP-reachable (AV:N), easily exploitable (AC:L), needs a low-privileged account (PR:L), no interaction (UI:N); full data read (C:H) but only partial write and partial DoS (I:L/A:L).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Capacity accessible data as well as unauthorized update, insert or delete access to some of Oracle Capacity accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Capacity. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).
Executive ViewAI
Oracle E-Business Suite's Capacity module (versions 12.2.3 through 12.2.15) allows any authenticated low-privileged user to read critical capacity data, make limited unauthorized changes, and cause partial disruption within that module; no public exploit identified at time of analysis. Leadership should care because a valid EBS account-common among internal staff and contractors-is the only barrier, and no vendor patch is currently available, leaving a window of exposure for planning and supply-chain data.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to the Capacity module, enforcing least privilege and removing unnecessary Capacity responsibilities, enabling and monitoring audit logs for anomalous transactions, and applying database activity monitoring until an Oracle Critical Patch Update is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB