EUVD-2026-61732
GHSA-66m2-ppg8-86jr
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable over HTTP but requires high-privileged credentials; no scope change; full CIA impact consistent with described module takeover.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Proposals. Successful attacks of this vulnerability can result in takeover of Oracle Proposals. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of Oracle Proposals (Oracle E-Business Suite component) is achievable by a high-privileged, network-adjacent attacker over HTTP, resulting in complete compromise of confidentiality, integrity, and availability. Affected deployments span versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, a widely deployed enterprise ERP platform. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a high-privileged account (PR:H) with network access to the Oracle EBS HTTP interface - the attacker must be authenticated to the system with elevated privileges such as an Oracle EBS system administrator role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.2 reflects full CIA impact (C:H/I:H/A:H) but is tempered by the PR:H requirement - exploitation requires an attacker who already holds high-privileged credentials within the Oracle EBS environment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patches released in Oracle's August 2026 Critical Patch Update (CPU), available via My Oracle Support and described at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Oracle E-Business Suite instances running versions 12.2.3-12.2.15 and audit administrative access logs for unauthorized or suspicious activities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today