What is the CVSS score of CVE-2026-47028?

CVE-2026-47028 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-47028?

Oracle E-Business Suite versions 12.2.3-12.2.15 contain a critical data compromise vulnerability in the Attachments module that allows authenticated users to read, modify, and delete sensitive…

How to fix or mitigate CVE-2026-47028?

Within 24 hours: Identify all Oracle EBS instances running versions 12.2.3 through 12.2.15 and assess the sensitivity of data stored in the Attachments module; cross-reference with active user lists to understand exposure scope. Within 7 days: Implement compensating controls by restricting Attachments module access through role-based access controls to critical users only, enable detailed audit logging for attachment reads and modifications, and if operationally feasible, consider temporarily disabling the module; communicate findings to business stakeholders and legal/compliance teams regarding data exposure risk. Within 30 days: Plan an upgrade to EBS versions outside the 12.2.3-12.2.15 range and monitor for vendor-released patches; if a patch becomes available, schedule and execute deployment within two business days.

Oracle E-Business Suite CVE-2026-47028

EUVD-2026-46515 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-5x3q-77fh-r2p9

Authentication Bypass Oracle Oracle Document Management And Collaboration Oracle Corporation

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Remote HTTP exploitation by any authenticated low-privilege user with no interaction (AV:N/AC:L/PR:L/UI:N); full read and write to module data but no availability impact, so C:H/I:H/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:24 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Document Management and Collaboration. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Document Management and Collaboration accessible data as well as unauthorized access to critical data or complete access to all Oracle Document Management and Collaboration accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle E-Business Suite's Document Management and Collaboration module (Attachments component) lets a low-privileged, network-adjacent attacker read, create, modify, or delete all data accessible to the module across supported releases 12.2.3 through 12.2.15. Oracle rates it CVSS 8.1 with high confidentiality and integrity impact but no availability effect, and flags it as 'easily exploitable' - meaning any authenticated EBS user can weaponize it over HTTP. There is no public exploit identified at time of analysis and it is not on CISA KEV, but Oracle EBS Attachments flaws have historically been high-value targets.

Technical ContextAI

Oracle E-Business Suite is a large integrated ERP/CRM web application suite; the affected Document Management and Collaboration product handles document storage and the 'Attachments' framework that lets users attach files and content to business records. The vulnerability lives in this Attachments component, exposed via the HTTP tier (typically the Oracle Application/HTTP Server front end). The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_document_management_and_collaboration. No CWE was assigned by Oracle, but the supplied tag 'Authentication Bypass' combined with the CVSS scope (unchanged, C:H/I:H) points to a broken access-control or authorization flaw in the Attachments handling that allows a low-privileged session to reach data belonging to other users or contexts, rather than a memory-safety bug.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which contains the fix for this issue, per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html - Patch available per vendor advisory; Oracle does not publish an independent single fix-version string outside the CPU bundle, so apply the CPU patch corresponding to your exact 12.2.x level. Oracle EBS CPUs are cumulative, so installing the latest available patch remediates this and concurrent issues. Until patched, reduce exposure by restricting network access to the EBS HTTP tier so only trusted networks/VPN can reach it (trade-off: may block legitimate remote users), tightening application-level responsibilities and roles for the Document Management/Attachments functionality to limit which low-privileged accounts can invoke it, and monitoring web-tier logs for anomalous attachment access or manipulation. These are compensating controls only and do not fully close the authorization flaw.