EUVD-2026-37269Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
DeliveryReach EBS app tier over HTTP
-
ExploitCraft request to SLA Internal Operations
-
ExecutionSatisfy high-complexity precondition
-
PersistAchieve Subledger Accounting takeover
-
ImpactTamper with journals and rule data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must hold valid low-privileged credentials on a target Oracle E-Business Suite 12.2.3-12.2.15 deployment (PR:L) and must be able to reach the EBS application tier over HTTP (AV:N); no user interaction is required (UI:N). Exploitation is limited by Oracle's own 'difficult to exploit' / AC:H rating, implying a specific configuration, race, or state must be satisfied within the Subledger Accounting Internal Operations component, and by the fact that only EBS 12.2.x branches in the 12.2.3-12.2.15 window are listed as affected - 12.1.x and pre-12.2.3 / post-12.2.15 deployments are out of scope per the description. |
| Impact | The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H produces a 7.5 base score: network-reachable, no user interaction, but high attack complexity and requiring a low-privileged EBS account, with full CIA impact ('takeover' of SLA). There is no EPSS score, KEV listing, or POC reference provided, which is consistent with a vendor-coordinated Oracle Critical Patch Update disclosure rather than an in-the-wild bug; this aligns with 'no public exploit identified at time of analysis.' Practical risk is moderate-to-high for Oracle EBS operators because any valid EBS user could become an SLA-takeover insider threat, but AC:H plus the need for valid EBS credentials and HTTP reachability to the EBS app tier meaningfully constrain mass-exploitation potential. No CWE is published, so the precise exploitation path is not independently verifiable from the input - defenders should treat Oracle's takeover wording as authoritative but expect details only via the CPU advisory. |
| Exploit ScenarioDerived | A contractor or low-privilege business user with a valid Oracle EBS account reaches the application tier over HTTP and issues a crafted request that exercises an Internal Operations code path in Subledger Accounting; after working around the high-complexity conditions (e.g., timing, state, or a specific configuration), the attacker gains full control of the SLA component and can read, alter, or destroy accounting rule data and generated journals. No public exploit identified at time of analysis, so any real-world abuse would currently require independent reverse engineering of the Oracle patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Takeover of Oracle Subledger Accounting (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible by a low-privileged remote attacker leveraging HTTP. The flaw yields full confidentiality, integrity, and availability impact (CVSS 7.5) but is rated high attack complexity, so reliable exploitation is non-trivial. No public exploit identified at time of analysis, and the issue is not listed on CISA KEV.
RemediationAI
Apply the fixes shipped in the Oracle Critical Patch Update of June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html; patch availability is confirmed via the Oracle CPU reference but no exact CPU patch number or post-patch version string is provided in the input data, so the precise fix identifier should be taken from the CPU bulletin itself. Until the CPU is applied, restrict HTTP access to the EBS application tier to trusted networks via firewall or reverse-proxy ACLs (side effect: may break integrations or remote user workflows that traverse the same path), audit and prune EBS responsibilities so that low-privilege accounts cannot reach Subledger Accounting Internal Operations functions, and increase logging on EBS application servers to detect anomalous SLA activity. Avoid disabling Subledger Accounting itself, as it is required for journal generation across most EBS financial modules.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Subledger Accounting (SLA) is the rule-based accounting engine inside Oracle E-Business Suite (EBS) 12.2.x that translates subledger transactions (Payables, Receivables, Assets, Projects, etc.) into General Ledger journal entries. The 'Internal Operations' component handles internal application processing and administrative plumbing rather than externally-facing UI flows, which typically means an attacker must reach an EBS application tier endpoint over HTTP and abuse a function exposed to authenticated EBS users. No CWE is published by Oracle (per their disclosure practice), so the precise root cause class (e.g., authorization flaw, injection, deserialization) is not enumerated in the input; the CPE confirms the affected component is oracle_subledger_accounting with all version-bearing fields wildcarded, with the 12.2.3-12.2.15 range coming from the description.
Know when Oracle Subledger Accounting gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
HTTP-reachable EBS app tier gives AV:N/UI:N; Oracle's 'difficult to exploit' wording supports AC:H; a low-privileged EBS account is required (PR:L); takeover of SLA yields C:H/I:H/A:H within the same scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Subledger Accounting. Successful attacks of this vulnerability can result in takeover of Oracle Subledger Accounting. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain a vulnerability in the Subledger Accounting module that allows users with basic system access to compromise financial data integrity, confidentiality, and availability. Organizations using affected versions risk unauthorized transaction recording, data theft, and audit trail corruption, creating exposure to financial fraud and regulatory violations.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce network segmentation restricting Subledger Accounting access to authorized business roles only; (2) Implement application-layer access controls limiting user permissions within the module; (3) Deploy continuous audit logging and alerting for Subledger module access anomalies; (4) Maintain detailed transaction logs for forensic investigation; (5) Evaluate business impact of temporary module suspension if residual risk is unacceptable pending patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB