EUVD-2026-106051
GHSA-h977-53fh-rj8c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
DeliveryReach Sales Online over HTTP
-
ExploitSend crafted request to Internal Operations
-
ExecutionAbuse flaw to tamper data
-
ImpactCreate/delete/modify critical records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged Oracle E-Business Suite account with network access to the Oracle Sales Online application over HTTP, targeting the Internal Operations component on affected versions 12.2.3 through 12.2.15. No end-user interaction is needed (UI:N) and attack complexity is low (AC:L), but the PR:L requirement means a purely anonymous external attacker cannot exploit it - credentials or an existing authenticated session are the key limiting factor. Internet-facing EBS deployments with self-service or broadly provisioned low-tier accounts materially widen the realistic attack surface. |
| Impact | This is a moderate-priority vulnerability, not a top-tier emergency. The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) indicates network-reachable, low-complexity exploitation over HTTP, but it explicitly requires an already-authenticated low-privileged account (PR:L) - it is NOT unauthenticated. The high integrity impact (I:H) is the main driver: an attacker can create, delete, or modify critical Oracle Sales Online data, with only limited confidentiality exposure (C:L) and no availability impact (A:N). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. CONFLICT TO VERIFY: the input Tag 'Authentication Bypass' directly contradicts both the CVSS PR:L metric and the description's 'low privileged attacker' wording - this is almost certainly a mislabeled tag, and defenders should treat this as a post-authentication privilege/data-tampering issue, not an auth bypass. Overall, given a valid low-privilege account is required and no exploitation signals exist, this is a 'patch in normal cycle' item rather than an immediate-fire-drill, but the high integrity impact on a business-critical ERP module warrants prompt remediation for internet-exposed EBS instances. |
| Exploit ScenarioDerived | A user holding a low-privileged Oracle E-Business Suite account (or an attacker who has phished/obtained such credentials) sends crafted HTTP requests to the Oracle Sales Online 'Internal Operations' component. Because the attack requires only network access and low complexity, the attacker tampers with or deletes critical sales data and reads a subset of accessible records. No public exploit code was identified at time of analysis, so this would require original exploit development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Authenticated low-privileged users can create, delete, or modify critical Oracle Sales Online data and read a subset of that data in Oracle E-Business Suite 12.2.3 through 12.2.15 via the Internal Operations component over HTTP. Rated CVSS 7.1 with high integrity and low confidentiality impact, this is a moderate-priority access-control weakness rather than a top-tier emergency; no public exploit was identified at time of analysis and it is not in CISA KEV. Exploitation requires a valid low-tier EBS account, so internet-facing deployments with broadly provisioned self-service users carry the widest realistic exposure.
RemediationAI
Apply the Oracle October 2026 Critical Patch Update for E-Business Suite 12.2.3 through 12.2.15; the vendor advisory at https://www.oracle.com/security-alerts/cpuoct2026.html is the authoritative patch source, and no separate exact fix build is identified in the supplied data (patch available per vendor advisory). Until patching is complete, restrict HTTP access to Sales Online and Internal Operations endpoints to trusted networks or VPN, which reduces exposure but blocks legitimate remote users outside that boundary. Review and prune low-privileged and self-service EBS accounts, enforcing least privilege so only users who genuinely need Sales Online Internal Operations can reach it; this limits the PR:L precondition but can disrupt legitimate workflows if over-restricted. Add monitoring and alerting for unusual create, delete, or modify activity in Sales Online, and consider WAF rules scoped to Internal Operations requests, accepting possible false positives and tuning effort.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is an integrated set of business applications; Oracle Sales Online is the sales application, and its Internal Operations component handles internal operational workflows exposed over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) describes a network-reachable flaw that does not require user interaction but does require a low-privileged authenticated session. No CWE or CPE was supplied, and EUVD lists Sales Online 12.2.3 through 12.2.15 as affected. The source tagging describes an authentication bypass, which in this context points to an authorization/access-control gap that lets a low-tier account invoke Internal Operations functions it should not be permitted to use, resulting in unauthorized create, delete, or modify operations plus limited read access.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network HTTP vector with low complexity and no user interaction; PR:L because a low-privileged authenticated account is required; high integrity (data create/delete/modify), low confidentiality, no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Online. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Sales Online accessible data as well as unauthorized read access to a subset of Oracle Sales Online accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Executive ViewAI
Oracle E-Business Suite 12.2.3 through 12.2.15 contains an access-control weakness in Sales Online that lets low-privileged EBS account holders create, delete, or modify critical sales data, creating a significant data-integrity risk for affected business operations. Organizations with internet-facing deployments and broadly provisioned self-service users face the widest exposure, and leadership should care because tampering with sales records can undermine revenue reporting, customer commitments, and operational trust. No public exploit was identified at time of analysis, and no vendor-released patch was identified, so risk must be managed through account governance and network restrictions.
No vendor-released patch identified at time of analysis; interim mitigations include restricting HTTP access to the Internal Operations component, enforcing least privilege and minimizing low-privileged EBS accounts, auditing and alerting on Sales Online data changes, and segmenting internet-facing deployments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB