Oracle Marketing CVE-2026-101639

Requires a valid low-privileged Oracle Marketing account (PR:L) on Oracle E-Business Suite versions 12.2.3 through 12.2.15, reachable over HTTP (AV:N). Exploitation is NOT self-contained: it requires human interaction from a different user (UI:R) - typically a victim who views or processes the attacker-supplied content in the Audience component - which strongly indicates a stored/reflected injection flaw. Limiting factors that reduce realistic risk: the attacker must already be authenticated, a separate privileged victim must interact with the malicious content, and only the specified 12.2.x release range is affected; impact is partial (limited read plus limited insert/update/delete, no availability impact). The compensating aggravator is the scope change, meaning successful exploitation can affect Oracle products beyond Marketing itself.

This is a moderate-severity, context-dependent issue rather than a drop-everything priority. The CVSS 3.1 base score of 5.4 is driven by a network attack vector (AV:N) with low complexity (AC:L) but is meaningfully constrained by two factors: the attacker needs an existing low-privileged account (PR:L) and successful attacks require human interaction from a victim other than the attacker (UI:R). The impact is limited (C:L/I:L, A:N), but the scope change (S:C) is the notable signal - a flaw in the Oracle Marketing 'Audience' component can spill over to affect additional Oracle E-Business Suite products, which is why even limited confidentiality/integrity impacts yield a medium score. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so exploitation likelihood signals are absent rather than reassuring. SSVC-style reading: exploitation status is 'none' (no public exploit identified), the attack is NOT automatable (requires authentication plus social-engineering a victim), and technical impact is 'partial'. CONFLICT TO NOTE: the input Tags include 'Authentication Bypass', but the CVSS vector explicitly requires privileges (PR:L) and the description describes authorized-but-limited read/write access and victim interaction - this is consistent with a web injection flaw (e.g., stored/reflected XSS), not an authentication bypass. Treat the 'Authentication Bypass' tag as suspect and verify against the Oracle October 2026 CPU advisory.

An attacker with a low-privileged Oracle Marketing account submits crafted content (for example into an Audience-related field) that is later rendered to a higher-privileged user. When that victim views the content in their session, the injected payload executes in their context, allowing limited unauthorized read of some Marketing data and insert/update/delete of a subset of data, with effects reaching additional E-Business Suite products due to the scope change. No public exploit code was identified in the provided data, and the required victim interaction plus valid credentials raise the practical bar.