EUVD-2026-106248
GHSA-jgff-hwcf-4qcp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege EBS account
-
ExploitSend crafted HTTP request to Data Provider UI
-
ExecutionBypass authorization in Installed Base
-
ImpactRead critical data and tamper with records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged Oracle E-Business Suite account (PR:L) with HTTP network reach to the Installed Base Data Provider UI component; affected deployments are EBS versions 12.2.3 through 12.2.15. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factors are the need for authentication to the EBS application and network/HTTP access to the Installed Base module - instances where only trusted internal users hold accounts and the UI is not externally exposed face materially lower real-world risk. |
| Impact | This is a legitimately prioritizable but not top-tier issue. The Oracle-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, score 7.1) describes a network-reachable, low-complexity flaw requiring only a low-privileged authenticated session - i.e. any valid EBS application user. The high confidentiality impact (C:H) means an authenticated user can read all data accessible to the Installed Base module, while integrity impact is limited (I:L, some insert/update/delete) and there is no availability impact (A:N). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent widespread exploitation; absence of these signals is not proof of safety but does argue against emergency escalation. One conflict must be flagged: the input Tags include 'Authentication Bypass', yet the CVSS vector specifies PR:L (valid credentials required) - these are contradictory, and the authoritative vector indicates this is NOT an auth bypass. Overall: patch in the normal Oracle Critical Patch Update cycle with priority proportional to how many low-trust users can reach the EBS instance and how sensitive the Installed Base data is. |
| Exploit ScenarioDerived | A low-privileged but authenticated Oracle E-Business Suite user sends a crafted HTTP request to the Installed Base Data Provider UI component and abuses missing authorization checks to read critical Installed Base data beyond their entitlement, and to insert, update, or delete a subset of records. No user interaction or elevated privileges are needed, but a valid EBS account is required; no public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle E-Business Suite releases 12.2.3 through 12.2.15 expose Installed Base records to any low-privileged application user who can reach the Data Provider UI component over HTTP, allowing broad reads of critical data plus limited unauthorized inserts, updates, and deletes (CVSS 3.1 base score 7.1, C:H/I:L/A:N). Exploitation requires only a valid EBS account (PR:L) and network reach to the module - no user interaction and no special conditions - so the practical exposure is highest where self-registered, partner, or contractor accounts exist or where the Installed Base UI is internet-facing. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Oracle CPU patches should be scheduled on a normal priority rather than deferred indefinitely, since the weakness is trivially triggerable once credentials are held.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), selecting the patch published for your specific EBS release within the 12.2.3-12.2.15 range; Oracle CPU patches are cumulative but may carry prerequisite patch or technology-stack (e.g., database/Forms/OC4J) requirements, so plan a maintenance window and a full regression test of Installed Base, depot repair, and service workflows. If patching cannot be immediate, reduce exploitability by removing or narrowing the attack path: restrict network access to the Installed Base Data Provider UI through a reverse proxy, WAF, or VPN so only trusted internal users reach it (trade-off: breaks external partner or field-service access if any exists); audit and prune EBS accounts and responsibilities that grant Installed Base access, removing dormant, contractor, and self-registered users and enforcing least privilege (trade-off: administrative effort and possible workflow disruption for legitimate users); and if the Data Provider UI is not actively used, deactivate the corresponding menu/responsibility or block its URL paths at the perimeter (trade-off: may break integrations, bulk import/export, or reporting that rely on that UI). As a detection control, enable and monitor EBS audit trails and database-level auditing on Installed Base tables, alerting on unusual bulk reads, exports, or record changes by low-privileged accounts (trade-off: added audit storage and some performance overhead on audited tables).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is Oracle's ERP application stack, and Installed Base (IB) is the module of record for customer-installed assets, service history, and configuration data - the data set that service, depot repair, and tele-service workflows depend on. The affected surface is the Data Provider UI layer, the presentation/servlet-side access path through which IB records are rendered and manipulated; the vulnerability is an access-control failure in that layer, permitting a user whose responsibilities should scope them to a narrow slice of IB data to reach records and operations outside that scope. No CWE identifier was assigned by the reporter, but the CVSS profile (confidentiality High, integrity Low, availability None, scope Unchanged, PR:L) is characteristic of broken or missing authorization checks rather than memory corruption or injection: the attacker is already inside the application and abuses an under-enforced privilege boundary. Notably, some intelligence feeds tag this record as an 'Authentication Bypass', which should not be read as allowing unauthenticated access - the assessed vector requires PR:L, so the tag appears to reflect the low-privileged-access nature of the flaw or a generic classifier rather than a true pre-auth bypass. Because IB data is a shared, cross-module store, the confidentiality impact extends to customer identities, asset inventories, and service contract details that other EBS modules reference.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Network HTTP vector with a required low-privilege EBS account gives AV:N/AC:L/PR:L/UI:N; high data read (C:H), limited write (I:L), no availability impact (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Installed Base accessible data as well as unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Executive ViewAI
Oracle E-Business Suite releases 12.2.3 through 12.2.15 contain a high-severity access-control weakness in the Installed Base Data Provider UI that allows any authenticated low-privileged user to read critical installed-base records and make limited unauthorized changes. Leadership should care because the affected data likely includes customer entitlements, asset inventories, and service history, and exposure is greatest where partner, contractor, or self-registered accounts exist or the module is internet-facing; no public exploit has been identified at time of analysis, but no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the Installed Base/Data Provider UI, enforcing least privilege and recertifying low-privileged, self-registered, partner, and contractor accounts, disabling unused accounts, placing internet-facing instances behind VPN or zero-trust access, and monitoring application and database logs for anomalous reads, inserts, updates, and deletes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB