EUVD-2026-47538
GHSA-v942-pvxc-34w4
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Vendor-provided vector is consistent with the description: network HTTP delivery, no auth, high complexity, user interaction required, confidentiality-only impact, no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Production Scheduling. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Production Scheduling accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthorized access to critical data in Oracle Production Scheduling (versions 12.2.3 through 12.2.15) is achievable by unauthenticated remote attackers via a network-based authentication bypass in the Internal Operations component, though exploitation requires high attack complexity and human interaction from a third party. The confidentiality impact is complete - attackers can access all data accessible to Production Scheduling - while integrity and availability remain unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.
Technical ContextAI
Oracle Production Scheduling is a manufacturing execution and planning module within the Oracle E-Business Suite (EBS), a broad enterprise resource planning platform. The affected component is identified as 'Internal Operations,' which governs scheduling logic and associated data retrieval. The tag 'Authentication Bypass' indicates the vulnerability class: an attacker can bypass access controls without presenting valid credentials (consistent with PR:N in the CVSS vector), though high attack complexity (AC:H) and required user interaction (UI:R) suggest the bypass is non-trivial to trigger and may involve a multi-step mechanism such as a crafted HTTP request that manipulates session context or redirect behavior when a legitimate user is active. No CWE identifier was assigned by Oracle, limiting precise root-cause classification, but the authentication bypass category combined with the HTTP delivery vector and confidentiality-only impact is consistent with CWE-287 (Improper Authentication) or CWE-601 (URL Redirection) class weaknesses. Affected CPE corresponds to Oracle E-Business Suite 12.2.3 through 12.2.15.
RemediationAI
Apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publicly disclose exact patched sub-versions in CPU advisories, so the patched version is confirmed available per vendor advisory but an exact build number is not independently verifiable from the available data. As a compensating control, restrict HTTP access to the Oracle E-Business Suite Internal Operations endpoints via network perimeter controls or WAF rules limiting access to known trusted IP ranges, particularly for the Production Scheduling module. Reducing the user population that interacts with Production Scheduling-related URLs limits the opportunity for the required human interaction condition to be satisfied. Note that perimeter controls do not remediate the underlying authentication bypass and should not substitute for patching. Monitoring authentication logs for anomalous unauthenticated access patterns to EBS Internal Operations endpoints is also advisable.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today