EUVD-2026-79449
GHSA-3wh4-4g2x-6j38
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable HTTP attack needing only a valid low-privilege account (PR:L), no user interaction, and full CIA impact within the Marketing application.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in takeover of Oracle Marketing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Oracle Marketing, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), contains an easily exploitable flaw in its Audience component that lets a low-privileged attacker with HTTP network access fully compromise the application, resulting in complete loss of confidentiality, integrity, and availability. Oracle's own advisory classifies the issue as takeover-level, and because the attack requires only an authenticated low-privilege account with no user interaction, any tenant with self-service or limited marketing roles should treat it as a priority. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) network reachability to the Oracle Marketing HTTP interface (AV:N), (2) a valid, authenticated Oracle E-Business Suite account with low privileges - the CVSS vector explicitly states PR:L, so an unauthenticated attacker cannot exploit this directly - and (3) the target to run Oracle Marketing within Oracle E-Business Suite 12.2.3-12.2.15 with the Audience component deployed and reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 base score of 8.8 with AC:L, PR:L, UI:N and C/I/A:H describes a low-complexity, network-reachable, authenticated attack with complete impact on the Marketing application - a realistic and attractive target for an attacker who already holds any low-privilege EBS account, which is common in large enterprises with self-service or marketing-ops users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update referenced in Oracle's advisory (https://www.oracle.com/security-alerts/cspusep2026.html), which covers Oracle Marketing in E-Business Suite 12.2.3-12.2.15; Oracle does not publish individual fix version numbers per CVE, so the applicable patch must be pulled from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today