What is the CVSS score of CVE-2026-47031?

CVE-2026-47031 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-47031?

A vulnerability in Oracle Bills of Material (CVE-2026-47031) allows users with basic system access to fully compromise supply chain planning data across Oracle E-Business Suite 12.2.3-12.2.15.

How to fix or mitigate CVE-2026-47031?

Within 24 hours, identify all Oracle EBS instances running versions 12.2.3-12.2.15 and disable or severely restrict non-administrative access to the Bill Issues component; audit recent modification logs for suspicious activity. Within 7 days, contact Oracle Support to confirm patch timeline and request an ETA; implement network-layer controls to limit HTTP access to Bill Issues endpoints to trusted administrative IPs only. Within 30 days, apply the vendor-released patch immediately upon availability and conduct a forensic review of Bills of Material changes during the vulnerability exposure window.

Oracle E-Business Suite CVE-2026-47031

EUVD-2026-46517 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-jmh8-m6f5-74v7

Authentication Bypass Oracle Oracle Bills Of Material Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachable with low complexity and no interaction, but a low-privileged EBS account is required (PR:L); full module takeover gives C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:26 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Bill Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Product takeover in Oracle Bills of Material (Bill Issues component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access fully compromise the module, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 8.8 with high impact across confidentiality, integrity, and availability, meaning an authenticated user can read, alter, and destroy Bills of Material data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle EBS is a recurring high-value target for post-authentication attacks.

Technical ContextAI

Oracle Bills of Material is a manufacturing module within Oracle E-Business Suite, Oracle's flagship on-premises ERP platform, and the flaw sits in its 'Bill Issues' component reached over HTTP through the EBS web tier (typically Oracle Application Server / WebLogic fronting the Forms and self-service application stack). The CPE cpe:2.3:a:oracle_corporation:oracle_bills_of_material identifies the affected application. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class is unstated, but the low attack complexity, low privilege requirement, and full 'takeover' outcome are consistent with an authorization/access-control or injection-style defect in an authenticated servlet or JSP endpoint rather than a memory-safety bug. The unchanged scope (S:U) indicates the impact is confined to the Bills of Material module itself.

RemediationAI

Apply the patch supplied in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to your EBS 12.2 environment; Oracle ships this as a cumulative CPU/RUP patch for the 12.2 release line rather than a single tagged product version, so deploy the specific patch numbers Oracle lists for Bills of Material for your applied 12.2.x level (Patch available per vendor advisory; no standalone fix version was provided in this data). Until the CPU can be applied, reduce exposure by restricting network access to the EBS web tier so the Bill Issues endpoints are not reachable from untrusted networks (place EBS behind VPN/allowlist), tightening application-level authorization so only accounts that genuinely need Bills of Material functions retain them (this flaw needs only a low-privileged account, so pruning unnecessary responsibilities and disabling dormant users directly shrinks the attack surface), and increasing monitoring of Bill Issues transactions - note these are containment measures that do not remove the vulnerability and may disrupt legitimate manufacturing users who rely on remote or broad access.