EUVD-2026-46725
GHSA-rmpv-95xm-22h3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible with low complexity; low-privileged account required; partial confidentiality and integrity impact only, no availability loss, no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Performance Management product of Oracle E-Business Suite (component: Appraisals). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Performance Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Performance Management accessible data as well as unauthorized read access to a subset of Oracle Performance Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Unauthorized data access and modification in Oracle Performance Management (E-Business Suite Appraisals component, versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated user with HTTP network access. The flaw enables partial reads of restricted appraisal data and unauthorized insert, update, or delete operations within the accessible data scope - an insider threat or compromised low-privilege account scenario. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing real-world urgency at moderate levels for enterprises running Oracle E-Business Suite with the Performance Management module active.
Technical ContextAI
Oracle Performance Management is an HR module within Oracle E-Business Suite (EBS), responsible for employee appraisal workflows, goal setting, and performance reviews. The affected component is Appraisals, which processes HTTP requests for performance evaluation data. The CPE string cpe:2.3:a:oracle_corporation:oracle_performance_management:*:*:*:*:*:*:*:* confirms all subversions within the 12.2.3-12.2.15 range are affected. Oracle has not assigned a CWE to this vulnerability; however, the vendor-applied tag 'Authentication Bypass' together with the CVSS PR:L metric suggests the root cause is an improper authorization or access control check - likely a failure to enforce data-level permissions within the Appraisals API, allowing a low-privileged EBS user to operate on records belonging to other users or roles. The CVSS S:U (Scope Unchanged) indicator confirms the impact is contained to the Performance Management component itself rather than propagating to the broader EBS database.
RemediationAI
Apply Oracle's Critical Patch Update for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability across all affected versions of Oracle Performance Management (12.2.3-12.2.15). Oracle CPUs are cumulative, so applying the July 2026 CPU is the primary and recommended fix; no exact standalone patch version number was identified in available data beyond the CPU designation. If patching cannot be performed immediately, consider restricting network access to the Oracle E-Business Suite Appraisals component to only authorized HR personnel via network segmentation or application-layer ACLs - this raises the effective bar beyond the current PR:L requirement. Note that restricting access at the network layer may impact legitimate employee self-service workflows; coordinate with HR and application teams before applying access restrictions. Monitor EBS access logs for unusual cross-user appraisal data access patterns as a compensating detection control.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today