Oracle E-Business Suite CVE-2026-22011

Exploitation requires an attacker who already holds high privileges (PR:H) on the Oracle E-Business Suite environment, HTTP network access to the Oracle Applications DBA / ADPatch component, and - critically - human interaction from a different privileged person (UI:R) to complete the attack, all against supported versions 12.2.3-12.2.15. Exploitation is explicitly rated difficult (AC:H), meaning success depends on conditions outside the attacker's direct control. These limiting factors - pre-existing high privileges, a required second human actor, and high attack complexity - sharply narrow realistic exploitation to insider or post-compromise scenarios rather than opportunistic remote attacks, which aligns with the SSVC 'Exploitation: none / Automatable: no' assessment.

The signals are consistent and point to a real-but-not-urgent issue. The CVSS 3.1 base score is 7.6 (High), but the vector itself moderates the raw number: AC:H (difficult to exploit), PR:H (attacker must already hold high privileges), and UI:R (a second person must be induced to act) all substantially raise the bar. Corroborating this, EPSS is only 0.03% (10th percentile) and CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no' - even though Technical Impact is 'total'. There is no KEV listing and no known POC. The one notable conflict is the tag 'Authentication Bypass', which contradicts the PR:H requirement in the CVSS vector (a true auth bypass would imply PR:N); the authoritative Oracle-supplied vector requiring high privileges should be trusted over the tag. Net: this is a legitimate high-impact flaw for defense-in-depth patching, but the combination of high privilege requirement, high complexity, and required user interaction makes it a lower priority than its 7.6 score suggests in isolation.

A malicious or compromised administrator who already holds high privileges on an Oracle E-Business Suite 12.2 instance crafts a request to the ADPatch component over HTTP and then induces another privileged operator to perform an action that triggers the improper access-control flaw. This results in full takeover of the Applications DBA and, because of the scope change, damaging impact to other E-Business Suite products. No public exploit code is known, so an attacker would need to develop the technique independently.