EUVD-2026-106075
GHSA-3rxc-8pvv-x3m4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious payload for Message Component
-
DeliveryDeliver link/message to Email Center user
-
ExploitVictim interacts with crafted content
-
ExecutionInjected script executes in victim session
-
ImpactUnauthorized read/update across EBS scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim user - someone other than the attacker - to interact with attacker-supplied content delivered to the Oracle Email Center Message Component over HTTP (UI:R in the vector); it cannot fire autonomously or server-side. The attacker needs no authentication or privileges (PR:N) and only network reachability to the Email Center HTTP interface. Limiting factors: the mandatory human interaction, the low confidentiality/integrity impact (partial read and partial update/insert/delete only, no availability impact), and that only Oracle Email Center 12.2.3 through 12.2.15 deployments with the Message Component in use are affected. The scope change means injected content may reach additional Oracle EBS products beyond Email Center. |
| Impact | This is a moderate-severity (CVSS 3.1 6.1) issue whose vector - AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - is the canonical signature of a cross-site scripting / content-injection flaw rather than a direct server compromise: no privileges are required but successful attack depends on human interaction (UI:R) from a victim other than the attacker, limiting it to low confidentiality and integrity impact with no availability impact. The scope change (S:C) is the one escalating factor, indicating injected content can affect other Oracle EBS products beyond Email Center, which is why Oracle rates it above a bare XSS. No EPSS score, CISA KEV listing, POC, or SSVC data was provided, so exploitation likelihood cannot be quantified from the input; absence of these is not evidence of safety but means prioritization must rest on the vector alone. The UI:R requirement and low technical impact make this a real-but-not-urgent patch item - prioritize behind any unauthenticated, no-interaction RCE in the same Oracle October 2026 CPU. Note the input 'Authentication Bypass' tag conflicts with the vulnerability's actual XSS-style behavior; treat that tag as unreliable. |
| Exploit ScenarioDerived | An unauthenticated attacker crafts a malicious link or message payload targeting the Oracle Email Center Message Component and lures an authenticated Email Center user into opening it over HTTP. When the victim interacts with the crafted content, injected script executes in their session context and, due to the scope change, can affect data or UI in additional connected Oracle E-Business Suite products. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Content injection in Oracle Email Center's Message Component (Oracle E-Business Suite 12.2.3 through 12.2.15) allows unauthenticated, network-based attackers to trick a victim into interacting with attacker-supplied content over HTTP, yielding partial read and update/insert/delete access to Email Center data (CVSS 3.1 6.1). The scope change (S:C) means injected content may affect additional Oracle EBS products, but confidentiality and integrity impacts are low and availability is unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) October 2026 fixes for Oracle E-Business Suite Email Center; the advisory at https://www.oracle.com/security-alerts/cpuoct2026.html lists the supported 12.2.3-12.2.15 patches (patch status: available per vendor advisory). If patching must be delayed, restrict network access to the Email Center HTTP interface to trusted networks and users, deploy web application firewall rules to block script or active content in message submissions, and consider disabling the Message Component if it is not business-critical-accepting the trade-off of lost messaging functionality. Because exploitation requires victim interaction (UI:R), user awareness and email/message caution reduce risk but do not replace the vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite's Email Center is an integrated email and message-handling module; the Message Component renders and processes message content over HTTP. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates a remotely reachable, low-complexity flaw that requires no authentication but mandates victim interaction (UI:R), with a scope change (S:C) because the vulnerable Email Center component and the impacted resource may belong to different security authorities-classic for cross-site scripting/content injection where attacker-controlled markup escapes into a page consumed by another user. The CWE is not provided, but the root-cause class is likely improper neutralization of user-controllable input in message rendering, enabling script execution or content spoofing in the victim's browser context. Only the Message Component within the stated 12.2.3-12.2.15 range is affected.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated network HTTP delivery (AV:N/PR:N) but victim interaction is required (UI:R); injected content crosses into other EBS products (S:C) with only partial confidentiality and integrity impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Component). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Email Center. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Email Center, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Email Center accessible data as well as unauthorized read access to a subset of Oracle Email Center accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB