EUVD-2026-24323
GHSA-chmq-27rf-6923
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
High privileges required for network HTTP access; limited read/write impact scoped to User Management data; no availability or scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Workflow and Business Events). Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle User Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle User Management accessible data as well as unauthorized read access to a subset of Oracle User Management accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Improper access control in Oracle User Management (E-Business Suite component: Workflow and Business Events) exposes versions 12.2.7 through 12.2.15 to unauthorized data access and manipulation by highly privileged, authenticated network attackers over HTTP. Successful exploitation yields limited confidentiality and integrity impact - read access to a subset of data and the ability to insert, update, or delete some records - with no availability impact. No active exploitation is confirmed (absent from CISA KEV), EPSS stands at 0.03% (7th percentile), and SSVC rates exploitation status as none, making this a low operational priority despite the network-reachable attack vector.
Technical ContextAI
Oracle E-Business Suite is a large-scale enterprise application platform; the User Management module handles identity provisioning, role assignments, and workflow orchestration. The vulnerable sub-component - Workflow and Business Events - is responsible for routing approval flows and event-driven processes within EBS. CWE-284 (Improper Access Control) identifies the root cause: insufficient enforcement of authorization boundaries, allowing a privileged principal to operate beyond its intended scope. The 'Authentication Bypass' tag in the intelligence feed may indicate a secondary authorization check - such as a role-gated workflow action or business event subscription - can be bypassed, not the primary login mechanism (which remains required, consistent with PR:H in the CVSS vector). Affected CPE is cpe:2.3:a:oracle_corporation:oracle_user_management:*:*:*:*:*:*:*:*, spanning the entire 12.2.x minor release train from 12.2.7 to 12.2.15.
RemediationAI
Apply Oracle's Critical Patch Update released in April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html. The CPU provides patches for all supported affected versions (12.2.7-12.2.15); the exact patched version should be confirmed from the advisory's patch matrix for your specific EBS release. No patch-independent workaround is described in available data; however, because exploitation requires PR:H network access over HTTP, organizations can reduce exposure by restricting administrative access to the Workflow and Business Events component to known internal IP ranges via network ACLs or WAF rules, and by auditing high-privilege EBS accounts to minimize the administrative user population. Note that network-layer restrictions do not eliminate the underlying authorization flaw and should not substitute for applying the CPU patch.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today