EUVD-2026-47131
GHSA-9mgp-h54j-rh68
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Reachable over HTTP (AV:N) with low complexity and no interaction, but requires pre-existing high EBS privilege (PR:H); vendor describes full component takeover, so C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Interaction Blending product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Interaction Blending. Successful attacks of this vulnerability can result in takeover of Oracle Interaction Blending. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full compromise of Oracle Interaction Blending, a telephony/campaign-routing module within Oracle E-Business Suite (Internal Operations component), is possible by a high-privileged attacker sending crafted HTTP requests over the network. Oracle rates successful exploitation as a complete takeover of the component with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the fix ships in Oracle's July 2026 Critical Patch Update.
Technical ContextAI
Oracle Interaction Blending is part of the Oracle E-Business Suite (EBS) contact-center stack, coordinating inbound and outbound (predictive dialing) telephony interactions; the flaw sits in its Internal Operations component and is reached over HTTP through the EBS web/middle tier. No CWE is assigned in the source data, so the precise root-cause class is unstated, though the Oracle 'Information Disclosure' tag combined with the CVSS full-CIA impact points to an authenticated web-facing flaw that escalates from a legitimately held privilege to control of the module. Affected code exists across the EBS 12.2 release train from 12.2.3 through 12.2.15, indicating a long-standing issue in the module rather than a regression in a single release.
RemediationAI
Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to all Oracle E-Business Suite 12.2.3-12.2.15 instances running Interaction Blending; no standalone fixed version number is published in the input beyond the CPU itself. As compensating controls until the CPU is applied, restrict network reachability of the EBS middle tier and the Interaction Blending endpoints to trusted administrative networks (this reduces the AV:N exposure but does not stop an authenticated insider), and tighten and audit EBS responsibilities/roles so that the high-privilege access the exploit requires (PR:H) is granted to as few accounts as possible with monitoring on those accounts (this shrinks the eligible attacker pool at the cost of administrative overhead). If the Interaction Blending module is not in active use, consider disabling it to remove the attack surface entirely, accepting the loss of blended-telephony functionality.
More in Interaction Blending
View allVulnerability in the Oracle Interaction Blending component of Oracle E-Business Suite (subcomponent: User Interface). Ra
Data compromise in Oracle Interaction Blending (Oracle E-Business Suite, Internal Operations component) versions 12.2.3
Unspecified vulnerability in the Oracle Interaction Blending component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.
Oracle Interaction Blending within E-Business Suite exposes a network-accessible RMI interface flaw that allows a high-p
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today