EUVD-2026-47211
GHSA-qwjh-6r3x-rh3r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege EBS account
-
DeliveryReach Billing Integrator HTTP endpoint
-
ExploitExploit Internal Operations access-control flaw
-
ExecutionRead or modify billing/critical data
-
ImpactUnauthorized data disclosure and tampering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to a deployed Oracle Telecommunications Billing Integrator instance (Internal Operations component) running Oracle E-Business Suite 12.2.3-12.2.15, plus a valid low-privileged authenticated account (CVSS PR:L) - no user interaction is needed and attack complexity is low. Limiting factors: the organization must actually license and deploy the Telecommunications Billing Integrator module within EBS, the attacker must already possess or obtain low-privilege credentials, and exposure is greatly reduced when the EBS application tier is not reachable from untrusted networks. Note the vendor 'Authentication Bypass' tag appears to conflict with PR:L - confirm with Oracle whether a valid account is truly required. |
| Impact | Signals are moderately strong but not top-tier. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes an easily exploitable, network-reachable flaw needing only low privileges and no user interaction, yielding high confidentiality and integrity impact but no availability loss - consistent with Oracle's 8.1 score. However, PR:L directly conflicts with the free-text 'Authentication Bypass' tag: a true auth bypass would normally be PR:N, so the tag likely refers to horizontal/vertical privilege escalation from an existing low-privilege account rather than unauthenticated access - verify with Oracle before treating it as pre-auth. No EPSS score, POC, or KEV data was provided, so real-world exploitation probability is currently unquantified; absence of these is not evidence of low risk. Oracle EBS is a recurring, high-value target for attackers, so patching should be prioritized on internet-exposed instances even though no active exploitation is confirmed. |
| Exploit ScenarioDerived | An attacker who holds a low-privileged Oracle EBS account (for example a limited internal or contractor login) sends crafted HTTP requests to the Telecommunications Billing Integrator Internal Operations component and, exploiting the access-control flaw, reads and alters billing and customer data outside their authorization. Because the flaw is easily exploitable with no user interaction, a single foothold account is sufficient; no public POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Data compromise in Oracle Telecommunications Billing Integrator (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read and modify all data accessible to the application. Rated CVSS 3.1 8.1 for high confidentiality and integrity impact with no availability effect, and disclosed in Oracle's July 2026 Critical Patch Update. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); no standalone fix version string is published in the available data, so administrators must map their EBS 12.2.x patch level to the corresponding CPU patch for CVE-2026-60953 via My Oracle Support. As a compensating control until patching, restrict network reachability of the Telecommunications Billing Integrator / Internal Operations endpoints by placing EBS behind a VPN or IP allowlist and blocking direct internet exposure of the HTTP application tier, which limits the AV:N attack surface but does not stop an authorized internal low-privilege user; additionally tighten EBS responsibility/role assignments to reduce the pool of low-privilege accounts (PR:L) that could reach the vulnerable function, at the cost of possible workflow disruption for legitimate billing operators. Monitor application logs for anomalous data access or modification pending patch deployment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Internal Operations module of Oracle Telecommunications Billing Integrator, a billing/mediation application shipped within the Oracle E-Business Suite (EBS) 12.2 family - a large Java/PL-SQL enterprise ERP stack fronted by Oracle Application Server / WebLogic over HTTP. Oracle does not assign a CWE for this issue (CWE: N/A) and its terse advisory does not disclose the root-cause class; the vendor tag 'Authentication Bypass' suggests broken access control or authorization logic, but the CVSS vector's PR:L indicates the attacker still needs some valid low-level authenticated foothold rather than a full pre-auth bypass. Because it is delivered inside EBS 12.2, exposure depends on which EBS modules an organization has licensed and deployed.
Know when Telecommunications Billing Integrator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network HTTP reachable and easy to exploit, but requires an existing low-privilege EBS account (PR:L); high confidentiality/integrity data impact with no availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Telecommunications Billing Integrator product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Telecommunications Billing Integrator. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Telecommunications Billing Integrator accessible data as well as unauthorized access to critical data or complete access to all Oracle Telecommunications Billing Integrator accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Telecommunications Billing Integrator within E-Business Suite versions 12.2.3 through 12.2.15 contains a critical data compromise vulnerability allowing low-privileged attackers to read and modify all accessible application data. Organizations running affected versions face immediate risk to billing records, financial transactions, and sensitive customer information. With no vendor patch currently available, rapid detection and containment measures are essential to prevent unauthorized financial transaction manipulation.
No vendor-released patch identified at time of analysis. Implement network segmentation to restrict access to the Telecommunications Billing Integrator to authorized internal networks only; deploy database activity monitoring to detect unauthorized data access or modification attempts; enforce principle of least privilege to minimize low-privileged account access to billing systems; conduct regular audits of user access and data modifications; configure real-time alerts for suspicious queries, bulk exports, or administrative actions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB