EUVD-2026-106229
GHSA-r879-wmp9-mhcg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
DeliverySend crafted HTTP request to Project Contracts
-
ExploitExploit Internal Operations flaw (scope change)
-
ExecutionRead critical cross-product data
-
ImpactExfiltrate confidential information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged account on Oracle E-Business Suite with HTTP access to the Oracle Project Contracts module (Internal Operations component), on versions 12.2.3 through 12.2.15. Limiting factors: the attacker must already be authenticated (PR:L) - this is not a pre-auth flaw - though no user interaction is needed and attack complexity is low. The scope change (S:C) means successful attacks can reach data in additional Oracle products beyond Project Contracts itself. Impact is confined to confidentiality; integrity and availability are unaffected. |
| Impact | This is a genuine mid-to-high priority issue for organizations running Oracle E-Business Suite, but not a top-tier emergency based on available signals. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) indicates a network-reachable, low-complexity attack requiring only low-level authenticated access (PR:L) and no user interaction, with a scope change that lets confidentiality impact spill into additional Oracle products. Impact is confidentiality-only (C:H, I:N, A:N) - this exposes critical data but does not by itself allow data tampering or denial of service. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept was referenced, so there is no public exploit identified at time of analysis; this is a credentialed-access data-disclosure flaw disclosed via Oracle's October 2026 Critical Patch Update rather than a confirmed in-the-wild threat. One conflict to verify: the input Tags include 'Authentication Bypass', yet the CVSS vector requires PR:L (a low-privileged, authenticated attacker) - an authentication-bypass classification contradicts the need for existing privileges, so the tag appears mislabeled and should not drive prioritization. |
| Exploit ScenarioDerived | A low-privileged user with a valid Oracle E-Business Suite account (or an attacker who has obtained such credentials) sends crafted HTTP requests to the Oracle Project Contracts Internal Operations component over the network. Because of a scope change, the attacker reads critical data belonging not only to Project Contracts but to additional Oracle products as well. No user interaction is needed and attack complexity is low, but valid low-level credentials are required and no public exploit code is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle Project Contracts versions 12.2.3 through 12.2.15 expose critical data to any user holding a valid low-privileged E-Business Suite account, because the Internal Operations component fails to adequately restrict what that account can read over HTTP. Successful exploitation gives high-confidentiality read access to Project Contracts data and, due to a scope change in the assessed vector, can extend to data in other Oracle products reachable from the same suite; integrity and availability are unaffected. Exploitation requires authentication (CVSS PR:L) and no user interaction, making it low-complexity for an insider or anyone who has obtained a mundane EBS credential - no public exploit code and no confirmed active exploitation were identified at time of analysis, and Oracle addresses the flaw through its October 2026 Critical Patch Update.
RemediationAI
Apply the fix from Oracle's October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html); patch availability is confirmed per vendor advisory, though exact patch or build numbers were not included in the input data, so confirm the specific Project Contracts patch level against the advisory's patch availability table and apply the EBS prerequisite patches it lists first - note that CPU application typically requires a downtime window and can invalidate customizations in the Contracts module. If patching must be deferred, reduce exposure by restricting network access to the E-Business Suite HTTP tier (VPN or allow-listed source ranges), which cuts the AV:N path but does not stop a malicious insider; audit and trim Project Contracts responsibilities and menu access so that only genuinely required users retain the Internal Operations functions, accepting that this is a partial control because the flaw is exploitable by any PR:L account; and enable application-level monitoring or WAF rules flagging anomalous read patterns against Project Contracts endpoints, with the trade-off of tuning effort and possible false positives during period-end processing. Because the assessed scope change allows impact beyond Project Contracts, review whether the affected EBS instance shares data links or credentials with other Oracle products and segment accordingly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue sits in Oracle E-Business Suite's Project Contracts module, specifically the Internal Operations component, which services HTTP requests from authenticated EBS sessions. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) describes a missing or insufficient authorization check on an operation that should be limited beyond basic authentication: a low-privileged user (PR:L) can drive the vulnerable request path over the network with no special conditions (AC:L) and no victim interaction (UI:N). The S:C scope change is the notable characteristic - Oracle's scope definition means the compromised component can affect resources managed by other security authorities, so a foothold in Project Contracts may yield read access to data governed by other EBS modules or integrated Oracle products rather than being contained to Contracts alone. Impact is purely confidentiality (C:H with I:N/A:N), consistent with an information-disclosure/authorization defect rather than code execution or data tampering. No CWE was assigned in the source data, but the behavior maps to the classic missing-authorization-check class in an enterprise ERP web tier.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
HTTP-reachable (AV:N), low-complexity (AC:L), requires an authenticated low-privileged account (PR:L), no interaction; scope change (S:C) exposes other products' data with confidentiality-only impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Contracts. While the vulnerability is in Oracle Project Contracts, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Project Contracts accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Executive ViewAI
Oracle Project Contracts versions 12.2.3 through 12.2.15 can expose sensitive contract data to any holder of a low-privileged E-Business Suite account, with scope change allowing reach into other Oracle products; integrity and availability remain unaffected. Leadership should treat this as an insider and credential-hygiene risk because a mundane EBS login could read project-contract information. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; Oracle plans to address the flaw in its October 2026 Critical Patch Update.
No vendor-released patch identified at time of analysis; Oracle plans to address the flaw in its October 2026 Critical Patch Update. Interim controls: restrict HTTP access to Internal Operations endpoints, enforce least privilege and account hygiene for EBS users, monitor and alert on Project Contracts data reads, and deploy WAF/proxy rules to block anomalous access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB