What is the CVSS score of CVE-2026-47014?

CVE-2026-47014 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Product Workbench are affected by CVE-2026-47014?

Oracle E-Business Suite versions 12.2.3-12.2.15 contain a vulnerability in the Workbench security component that allows low-privileged attackers to read, modify, or delete all accessible business…

How to fix or mitigate CVE-2026-47014?

Within 24 hours, inventory all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15, identify which systems access sensitive business data, and document current user access levels. Within 7 days, implement network-based access controls through firewall IP allowlisting to restrict Workbench access, enable comprehensive audit logging for all data modifications, and escalate to Oracle Support to establish a patch release timeline. Within 30 days, deploy monitoring and alerting for unauthorized access attempts, implement multi-factor authentication for Workbench users where technically feasible, establish a rapid deployment plan for patch deployment, and maintain regular communication with Oracle Support regarding security update availability.

Oracle Product Workbench CVE-2026-47014

EUVD-2026-46503 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-q43c-mh55-qwjc

Authentication Bypass Oracle Oracle Product Workbench Oracle Corporation

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP access with a low-privileged account (PR:L) and low complexity yields full confidentiality and integrity loss; no availability impact, so A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:21 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Workbench. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Workbench accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Workbench accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Compromise of Oracle Product Workbench (a Security component of Oracle E-Business Suite) allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the application, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and affects EBS versions 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle rates it 'easily exploitable.'

Technical ContextAI

Oracle Product Workbench is a module within Oracle E-Business Suite (EBS), Oracle's integrated enterprise ERP/supply-chain application stack, and the affected code sits in its Security component. EBS is a web-tier (HTTP) application typically fronted by Oracle HTTP Server/WebLogic and backed by an Oracle Database, so the network attack vector (AV:N) maps to authenticated HTTP session access to the EBS application layer. No CWE was assigned by NVD/Oracle, so the precise weakness class is not published; the Oracle-supplied tag 'Authentication Bypass' hints at an access-control or authorization flaw, but this conflicts with the CVSS PR:L requirement (see risk assessment). The CPE cpe:2.3:a:oracle_corporation:oracle_product_workbench identifies the affected application component, scoped to EBS release line 12.2.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which contains the fix for this vulnerability across the affected 12.2.3-12.2.15 range; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch numbers and prerequisites for your EBS 12.2 codelevel (Patch available per vendor advisory - Oracle CPUs ship as cumulative patch sets rather than a single tagged version). Because exploitation requires network HTTP access with low privileges, interim compensating controls include restricting network reachability of the EBS Product Workbench pages to trusted internal networks or VPN only (trade-off: may disrupt legitimate remote or partner access), placing the EBS web tier behind a WAF/reverse proxy with authorization enforcement, tightening account provisioning and reviewing which low-privilege accounts can reach the Security component, and enabling detailed HTTP and application access logging on the EBS middle tier to detect anomalous data access. These mitigations reduce exposure but do not replace the CPU patch, which is the only durable fix.