Oracle E-Business Suite CVE-2026-47028

Exploitation requires an authenticated low-privileged Oracle E-Business Suite account (CVSS PR:L) with network HTTP access to the Document Management and Collaboration / Attachments functionality on EBS 12.2.3-12.2.15; no user interaction and no elevated privileges are needed (UI:N, AC:L). The specific enabling condition is that the Oracle Document Management and Collaboration product with the Attachments component is deployed and reachable over HTTP. Limiting factors: the attacker must first obtain valid low-privilege credentials, the instance must be running an affected 12.2.x version without the July 2026 CPU, and network reachability to the EBS application tier is required - instances behind VPN or IP allow-lists with the CPU applied are not exposed.

The signals are mostly aligned toward genuine priority: CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N describes remote, low-complexity, no-user-interaction exploitation requiring only low privileges, and Oracle explicitly calls it 'easily exploitable.' High confidentiality and integrity impact (full read/write to all module-accessible data) makes this materially dangerous for ERP data. However, some signals are missing or in mild tension: there is no EPSS score, no CWE, and no SSVC decision provided in the input, so automatability and technical-impact framing must be inferred from CVSS alone. The 'Authentication Bypass' tag conflicts slightly with PR:L (which requires an authenticated low-privileged account) - Oracle's own vector governs, so treat this as a privilege-escalation/authorization bypass reachable by any low-privileged user, not a fully unauthenticated bypass. No KEV listing and no known POC lower the immediacy relative to raw score, but internet-exposed EBS instances make patch prioritization warranted.

An attacker who holds or phishes any low-privileged Oracle EBS user account authenticates to the internet- or intranet-facing HTTP tier and sends crafted requests to the Attachments/Document Management endpoints. Exploiting the authorization flaw, they read confidential business documents and then create, alter, or delete attachment data belonging to other users or business contexts, all without user interaction. No public exploit code is identified at time of analysis, but the low complexity means a working exploit could be developed quickly once details circulate.