EUVD-2026-47543
GHSA-9xcc-vx5q-8pf6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Network-accessible web interface requires authenticated low-privileged account; no user interaction; partial CIA impacts with no scope change align with the vendor-assigned vector.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Quality Workbench HTML system). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Quality accessible data as well as unauthorized read access to a subset of Oracle Quality accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Quality. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
AnalysisAI
Oracle Quality within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes partial confidentiality, integrity, and availability compromise through its Quality Workbench HTML system component. A low-privileged authenticated attacker with HTTP network access can perform unauthorized read, write, and denial-of-service operations against Quality module data. No public exploit code or active exploitation has been identified at time of analysis; this vulnerability was disclosed by Oracle via the July 2026 Critical Patch Update.
Technical ContextAI
Oracle Quality is a module within Oracle E-Business Suite (EBS), a large-scale enterprise resource planning platform. The affected component is the Quality Workbench HTML system, which is a web-facing interface used for quality management workflows. Affected versions span 12.2.3 to 12.2.15, a broad range of EBS 12.2 releases. No CWE has been assigned by Oracle or NVD, which is consistent with Oracle's typical practice of withholding root-cause classification in CPU advisories. Given the partial CIA triad impact and low-privilege network vector, the underlying flaw is likely an authorization or access control deficiency in the HTML interface - such as improper privilege enforcement on HTTP endpoints - though this is inferred from the CVSS vector, not confirmed by vendor disclosure.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) for July 2026, available via My Oracle Support and referenced at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish standalone patch version identifiers in its CPU advisories; organizations must consult My Oracle Support patch recommendations for their specific EBS 12.2 release level. If immediate patching is not feasible, restrict access to the Quality Workbench HTML system by limiting network-level access to the EBS application tier - for example, by enforcing VPN or internal-network-only access to the EBS web tier, which reduces the attack surface to trusted internal users. Additionally, review and restrict the set of accounts with low-privileged access to the Quality module, applying the principle of least privilege to reduce the potential attacker pool. Note that the partial denial-of-service impact means availability controls (load balancing, monitoring) should be in place for production environments.
Privileged compromise of Oracle Quality, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), allow
Full compromise of the Oracle Quality module within Oracle E-Business Suite (Internal Operations component, versions 12.
Same weakness CWE-200 – Information Exposure
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today