EUVD-2026-106247
GHSA-gpq3-99gj-6x3x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious EBS Installed Base link
-
DeliveryDeliver via phishing to EBS user
-
ExploitVictim clicks, triggers reflected injection
-
ExecutionScript executes in victim browser session
-
ImpactPerform unauthorized read/update across EBS scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to send a crafted HTTP request/link to the Installed Base HTML UI and requires human interaction from a person other than the attacker (UI:R) - typically a victim following a malicious link - which is the primary limiting factor. The flaw affects EBS versions 12.2.3 through 12.2.15; no special non-default configuration is called out, but the dependence on social-engineering a user to interact substantially limits reliable, at-scale exploitation. The scope change (S:C) means successful attacks may impact additional EBS products beyond Installed Base. |
| Impact | This is a moderate-severity (CVSS 6.1) flaw in Oracle E-Business Suite's Installed Base module (HTML UI component) whose vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is textbook reflected cross-site scripting: network-reachable, unauthenticated to launch, but requiring a victim to interact (click a crafted link), with a scope change and low confidentiality/integrity impact and no availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the source data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a credible but not urgent priority. The real-world risk is tempered by the mandatory human interaction (UI:R) and the limited C:L/I:L impact, but elevated by the unauthenticated network vector, the scope change (S:C) that lets attacks pivot to other EBS products, and the broad affected range (12.2.3-12.2.15) in a widely deployed ERP. Note a data conflict: the input Tags label this 'Authentication Bypass,' but the CVSS vector and description describe a user-interaction-driven injection/XSS pattern, not an authentication bypass - the tag appears mislabeled and should not drive prioritization. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL or form targeting the Installed Base HTML UI and lures an authenticated EBS user (e.g., via phishing) into clicking it. The injected script executes in the victim's browser session, allowing limited unauthorized read of Installed Base data and unauthorized update/insert/delete actions performed as the victim, with the scope change enabling impact on other EBS products. No public POC is referenced, and the attack depends on tricking a human rather than fully automated exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Reflected cross-site scripting in the HTML UI component of Oracle E-Business Suite's Installed Base module (versions 12.2.3 through 12.2.15) lets an unauthenticated remote attacker deliver a crafted HTTP request or link that executes in a victim's session once that user interacts with it. Because the vector carries scope change (S:C) with low confidentiality and integrity impact, a successful attack can read and modify a subset of Installed Base data and potentially affect other EBS products sharing the session context; there is no availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation depends on social-engineering a user into following the crafted link.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which contains the fix for Installed Base in EBS 12.2.3-12.2.15; no specific patched build number is stated in the available data, so confirm the exact minimum patch level in the advisory's patch availability table for your platform before rollout. Because the vector requires a victim to follow a crafted link, interim risk reduction centers on reducing that interaction surface: restrict network access to the Installed Base HTML UI endpoints to trusted networks or VPN (trade-off: limits legitimate remote users), and enforce phishing-resistant awareness plus link filtering at mail and web gateways (trade-off: imperfect, since payloads can arrive through any channel). Deploying a web application firewall or reverse proxy rule set that inspects query strings and POST bodies for script content aimed at Installed Base pages can catch common payloads but may cause false positives on legitimate data entry and must be tuned. Keep EBS sessions short-lived and require re-authentication for sensitive Installed Base transactions to limit what a script executed in a hijacked session can reach, at the cost of user convenience. Post-patch, verify the CPU level on all application tiers, since scope change means other EBS modules should be considered exposed through the same session.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N is classic reflected cross-site scripting: the Installed Base HTML UI reflects attacker-controlled input from an HTTP request back into a response without adequate output encoding, so script executes in the context of the victim's browser session against the EBS application. Unauthenticated reachability (PR:N) reflects that the attacker needs no credentials to construct and deliver the payload - the victim's own authenticated session is what the script abuses, which is why user interaction (UI:R) is required and is the main practical barrier. Scope change (S:C) indicates the executed script can act beyond the originating component, affecting other EBS modules and data reachable from the victim's session; confidentiality and integrity impacts are rated low, and availability is unaffected. No CWE was supplied in the source data, though the impact profile is consistent with improper neutralization of input during web page generation. The flaw is tracked by ENISA EUVD as EUVD-2026-106247 and was reported by Oracle's own security alert contact, with the October 2026 Critical Patch Update advisory as the sole reference.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable unauthenticated reflected XSS requires victim interaction (UI:R) and crosses scope (S:C) with low confidentiality and integrity impact and no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: HTML UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Installed Base. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Installed Base accessible data as well as unauthorized read access to a subset of Installed Base accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB