EUVD-2026-47243
GHSA-crgj-gp29-fv5q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege EBS account
-
DeliveryReach Customers Online HTTP endpoint
-
ExploitSend crafted request abusing broken authorization
-
ExecutionRead/modify/delete all accessible data
-
ImpactCompromise customer and operations data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to the Oracle Customers Online application plus a valid low-privileged account (CVSS PR:L - authenticated, low privilege), with no user interaction and low attack complexity. The limiting factors are therefore the need for some authenticated low-privilege access and network reachability of the EBS Internal Operations HTTP interface, confined to Oracle E-Business Suite deployments running Oracle Customers Online 12.2.3 through 12.2.15. Nothing in the available data indicates a special non-default configuration is required beyond the affected component being deployed. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes an easily exploitable, network-reachable flaw requiring only low privileges and no user interaction, yielding full read/write compromise of all application-accessible data - a high-priority profile for organizations running EBS 12.2.x. No EPSS score, POC, or KEV status was provided in the input, so exploitation probability cannot be quantified and there is no evidence of active exploitation or public exploit code at this time. The provided signals are internally consistent (network vector, low complexity, PR:L authenticated user), so the main uncertainty is real-world exposure: risk is elevated where low-privilege EBS accounts are widely provisioned or where the application is reachable from untrusted networks. Availability is explicitly unaffected (A:N), making this a data-confidentiality and data-integrity risk rather than a denial-of-service one. |
| Exploit ScenarioDerived | An attacker holding or obtaining any low-privilege Oracle Customers Online account (for example a limited internal user or a compromised low-tier credential) sends crafted HTTP requests to the application over the network. Because attack complexity is low and no user interaction is required, the attacker abuses the authorization weakness to read, alter, or delete critical data across the full set the application can access. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Broad data compromise in Oracle Customers Online (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, allows a low-privileged attacker with network HTTP access to read, create, modify, and delete all data accessible to the application. The CVSS 3.1 base score is 8.1 (C:H/I:H) reflecting high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Oracle CPU July 2026), documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle bundles fixes into CPUs rather than publishing standalone patched version numbers, so the accurate status is 'Patch available per vendor advisory' - apply the CPU patch corresponding to your 12.2.x level (12.2.3-12.2.15). Because this is a data-access/authorization flaw exploitable by low-privileged accounts, prioritize patching over workarounds. As compensating controls until the CPU is applied, restrict network reachability of the Customers Online HTTP endpoints to trusted internal segments or VPN (reduces AV:N exposure but blocks legitimate remote users), tighten and audit provisioning of low-privilege EBS accounts and responsibilities to limit who satisfies the PR:L prerequisite, and increase logging/monitoring of Customers Online data-access and modification activity to detect abuse (added log volume, no functional impact). No vendor-released standalone patch version was independently confirmed beyond the CPU advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Customers Online is a module within Oracle E-Business Suite (EBS), Oracle's integrated enterprise application stack for financials, CRM, HR, and supply chain. The affected component is 'Internal Operations', within the 12.2.x release family (12.2.3-12.2.15). The vendor-supplied tag 'Authentication Bypass' suggests the root cause is a broken authorization/authentication control that lets an already low-privileged user reach and manipulate data outside their intended scope. No CWE was assigned in the source data, but the described behavior is consistent with the improper-access-control / broken-authorization class (e.g., CWE-284/CWE-862/CWE-863). EBS is typically deployed as internet- or intranet-facing HTTP application servers, matching the AV:N vector.
Know when Customers Online gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network HTTP reachable with low-privilege authenticated access and no user interaction; full data read/write gives C:H/I:H, availability unaffected so A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customers Online. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customers Online accessible data as well as unauthorized access to critical data or complete access to all Oracle Customers Online accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle E-Business Suite (versions 12.2.3-12.2.15) contains a critical vulnerability allowing authenticated users to read, create, modify, and delete sensitive business data. No public exploit identified at time of analysis. Organizations running these versions face significant risk from insider threats and compromised user accounts, with no vendor patch currently available to remediate the exposure.
Network segmentation limiting E-Business Suite access to authorized personnel and locations; Web Application Firewall (WAF) rules monitoring for suspicious data access patterns; database-level least-privilege controls restricting low-privileged users to essential data; mandatory multi-factor authentication (MFA) for all application access; continuous audit logging and alerting for all read, write, and delete operations on sensitive financial and customer data tables; regular access privilege reviews and anomaly detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Customers Online
View allFull takeover of Oracle Customers Online (E-Business Suite component) is achievable by any low-privileged authenticated
Broad data compromise in Oracle Customers Online (part of Oracle E-Business Suite, component: Internal Operations) allow
Data compromise in Oracle Customers Online (a module of Oracle E-Business Suite, Internal Operations component) versions
Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Customer Tab). Rated high se
Exploit-DB