EUVD-2026-47450
GHSA-59wc-35rc-gm4q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Consistent with Oracle's published vector: low-privilege network access with no complexity or interaction required, limited data exposure, and no availability impact confirmed.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Scripting Admin). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Scripting accessible data as well as unauthorized read access to a subset of Oracle Scripting accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Oracle Scripting's Scripting Admin component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is exploitable by low-privileged, network-authenticated attackers over HTTP, enabling unauthorized read and write access to accessible Scripting data. Tagged as an Authentication Bypass, this flaw requires only a valid low-privilege account and no user interaction, making the realistic threat surface broader than the medium CVSS score alone suggests for large enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Oracle July 2026 Critical Patch Update addresses this issue.
Technical ContextAI
Oracle Scripting is a workflow and scripting engine embedded within Oracle E-Business Suite (EBS), a widely deployed enterprise application platform for ERP and CRM operations. The Scripting Admin sub-component manages scripting configurations, workflow definitions, and administrative rules within EBS. The 'Authentication Bypass' tag sourced from EUVD-2026-47450 suggests that the flaw allows a low-privileged authenticated user to circumvent role-based or privilege-level authorization checks within the Scripting Admin interface, accessing or modifying data beyond their permitted scope. No CWE was assigned by Oracle or NVD, leaving the precise root cause class unconfirmed, though the CVSS vector (PR:L, S:U, C:L, I:L) is consistent with an improper authorization or access control deficiency (broadly aligned with CWE-285 or CWE-862 classes) rather than a code execution or injection flaw. The affected version range spans 12.2.3 through 12.2.15, covering over a decade of EBS release history.
RemediationAI
Apply the Oracle Critical Patch Update for July 2026, which addresses this vulnerability and is documented at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish individual fixed version numbers in CPU release notes; consult Oracle My Oracle Support (MOS) for the specific patch ID and instructions applicable to your EBS version within the 12.2.x release line. As a compensating control prior to patching, restrict HTTP access to the Scripting Admin component to trusted internal IP ranges using network-layer ACLs or EBS application-tier configuration, reducing exposure to users who should not have Scripting Admin access. Additionally, audit and minimize the set of low-privileged EBS accounts with any access to the Scripting Admin interface. Note that network-layer restrictions do not remediate the underlying authorization flaw and carry the trade-off of potentially disrupting legitimate administrative workflows if applied too broadly.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today