Bills of Material CVE-2026-101847

Requires a valid low-privilege Oracle E-Business Suite account (PR:L) with network HTTP access to the Bills of Material 'Internal Operations' component; exploitation targets affected versions 12.2.3 through 12.2.15. The AC:H rating signals a meaningful limiting factor: success depends on conditions beyond the attacker's control (e.g., specific application state, timing, or configuration) rather than a single reliable request, which - combined with the authentication prerequisite - substantially narrows realistic exploitation compared to an unauthenticated, low-complexity flaw.

This is a genuine but second-tier priority. The CVSS 3.1 base score of 7.5 is driven entirely by full technical impact (C:H/I:H/A:H, described as 'takeover of Oracle Bills of Material'), while the exploitability metrics temper real-world risk: AV:N gives remote HTTP reach, but AC:H ('Difficult to exploit' per Oracle) means success depends on conditions outside the attacker's direct control, and PR:L requires a valid low-privilege Oracle E-Business Suite account rather than anonymous access. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so there is no positive signal of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' The signals are therefore internally consistent (high impact, constrained exploitability) rather than conflicting: this is a high-impact flaw that is hard to exploit and needs authentication, not a wormable mass-exploitation candidate. Note the input Tag 'Information Disclosure' understates the issue - the vector shows full Integrity and Availability compromise, not just confidentiality loss. A patch is available via the referenced Oracle Critical Patch Update (October 2026), so prioritize patching for internet-exposed or multi-tenant EBS environments while treating the absence of exploitation evidence as reason it need not jump ahead of actively-exploited CVEs.

An attacker who already holds a low-privilege Oracle E-Business Suite account sends crafted HTTP requests to the Bills of Material 'Internal Operations' component and, after satisfying the difficult-to-exploit preconditions, escalates to full compromise of the Bills of Material product. Because AC:H applies, the attack likely depends on specific timing, state, or configuration rather than a single deterministic request. No public exploit code or proof-of-concept is identified in the provided data.