EUVD-2026-46950
GHSA-g226-9q74-r52h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network HTTPS access requires low-privileged account (PR:L); low complexity matches Oracle's 'easily exploitable' characterization; partial C/I with no availability impact confirmed by description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Work Definition Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Asset Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Asset Management accessible data as well as unauthorized read access to a subset of Oracle Enterprise Asset Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Oracle Enterprise Asset Management (EAM) versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains an authorization control weakness in its Work Definition Issues component that permits low-privileged authenticated network attackers to partially compromise data integrity and confidentiality over HTTPS. Successful exploitation enables unauthorized read access to a subset of EAM-accessible data as well as unauthorized update, insert, or delete operations against EAM records. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the 'Authentication Bypass' intelligence tag suggests the flaw involves insufficient privilege enforcement within the Work Definition Issues component rather than a full pre-authentication bypass.
Technical ContextAI
Oracle Enterprise Asset Management is a module within Oracle E-Business Suite (EBS), a large-scale enterprise resource planning (ERP) platform widely deployed in asset-intensive industries such as utilities, manufacturing, and facilities management. The affected component - Work Definition Issues - manages maintenance work definitions and related records. The vulnerability is tagged 'Authentication Bypass,' which in the context of a PR:L CVSS vector most likely indicates an authorization bypass: a low-privileged authenticated user can circumvent access control checks within the Work Definition Issues subsystem, accessing or modifying records beyond their intended permission scope. No CWE identifier was assigned by NVD, but the pattern is consistent with CWE-285 (Improper Authorization) or CWE-862 (Missing Authorization). The attack surface is the HTTPS interface of the EBS application server, and the vulnerability is characterized as 'easily exploitable' by Oracle's own advisory language, corresponding to AC:L in the CVSS vector.
RemediationAI
The primary remediation is to apply the Oracle Critical Patch Update (CPU) for July 2026, available via Oracle's advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs are cumulative, so applying the July 2026 CPU to affected EBS 12.2.3-12.2.15 instances will address this vulnerability; an exact patched version number was not independently itemized in the available references beyond the CPU designation itself. As a compensating control prior to patching, organizations should audit and restrict EBS user accounts with access to the Work Definition Issues component, applying the principle of least privilege to ensure only operationally required personnel hold EAM roles. Additionally, network-layer controls (such as restricting HTTPS access to the EBS instance to known corporate IP ranges or VPN endpoints) can reduce the exposed attack surface by limiting which low-privileged accounts can reach the vulnerable component. Note that role-based access restriction has a trade-off of potentially disrupting legitimate maintenance workflows if role assignments are not carefully reviewed before tightening.
More in Enterprise Asset Management
View allINFOR EAM V11.0 Build 201410 has SQL injection via search fields, related to the filtervalue parameter. Rated high sever
INFOR EAM V11.0 Build 201410 has XSS via comment fields. Rated medium severity (CVSS 5.4), this vulnerability is remotel
Takeover of Oracle Enterprise Asset Management (the eAM module of Oracle E-Business Suite, Internal Operations component
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Work Definition I
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Setup). Rated hig
Unauthorized data access in Oracle Enterprise Asset Management (E-Business Suite, Linear Asset Management component), ve
High-privileged network exploitation of Oracle Enterprise Asset Management's Internal Operations component allows unauth
Cross-site scripting or authorization bypass in Oracle Enterprise Asset Management (E-Business Suite, Internal Operation
Oracle Enterprise Asset Management (EAM), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, expose
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today