EUVD-2026-24293
GHSA-fjgq-vg76-2mmp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Network HTTP access with low complexity and a required low-privilege account gives AV:N/AC:L/PR:L; access-control bypass yields high integrity, limited confidentiality, no availability, with scope change per vendor.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the Oracle Life Sciences Empirica Signal product of Oracle Life Science Applications (component: Common Core). Supported versions that are affected are 9.2.1-9.2.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Life Sciences Empirica Signal. While the vulnerability is in Oracle Life Sciences Empirica Signal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Life Sciences Empirica Signal accessible data as well as unauthorized read access to a subset of Oracle Life Sciences Empirica Signal accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N).
AnalysisAI
Unauthorized data manipulation in Oracle Life Sciences Empirica Signal 9.2.1 through 9.2.3 (Common Core component) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical data and read a subset of accessible data over HTTP. The scope-changed flaw (rooted in improper access control, CWE-284) can significantly impact additional products beyond Empirica Signal itself, and Oracle rates it CVSS 3.1 8.5. There is no public exploit identified at time of analysis, and EPSS is very low at 0.03% (8th percentile).
Technical ContextAI
Empirica Signal is Oracle's pharmacovigilance and drug-safety signal-detection platform used in life-sciences and clinical safety workflows; the affected 'Common Core' component underpins shared services across the application. The root cause is classified as CWE-284 (Improper Access Control), and the vendor/tag data characterizes it as an authentication/authorization bypass - meaning an already-authenticated low-privilege user can reach functionality or data that access-control checks should restrict. The CPE cpe:2.3:a:oracle_corporation:oracle_life_sciences_empirica_signal identifies the affected application, and the CVSS scope-change flag (S:C) indicates the vulnerable component can grant impact to resources managed by a different security authority (e.g., integrated back-end products or shared data stores).
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of April 2026 (https://www.oracle.com/security-alerts/cpuapr2026.html); this is Patch available per vendor advisory, as Oracle CPU releases bundle the corrective patches for Empirica Signal 9.2.1-9.2.3 (no standalone fixed version string is provided in the input, so confirm the exact patch level from the CPU matrix). Because exploitation requires a low-privilege authenticated account, compensating controls until patching include tightening account provisioning and role assignments, revoking or auditing unnecessary low-privilege user accounts, and enforcing least privilege so fewer users can reach the Common Core functionality; restrict network access to the Empirica Signal HTTP interface to trusted clinical/pharmacovigilance networks or via VPN to reduce the reachable attacker population, accepting that this may inconvenience remote or partner users. Monitor application audit logs for anomalous create/delete/modify activity on critical safety data as a detection control. These are mitigations, not substitutes for the CPU patch.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today