EUVD-2026-106284
GHSA-qpcw-29h9-hcp5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
ExploitSend crafted HTTP request to CLM component
-
ExecutionBypass authorization checks
-
ImpactRead or modify critical contract data
Vulnerability Assessment
| Exploitation Conditions | Requires a valid low-privileged account on the Oracle E-Business Suite instance running the Contract Lifecycle Management for Public Sector product (component Award/PO), reachable over HTTP; affected supported versions are 12.2.3 through 12.2.15. Exploitation is limited by the need for prior authentication (PR:L) - it is not reachable by fully anonymous external attackers - but needs no user interaction, no elevated/admin privileges, and no special non-default configuration per the available data. Realistic risk is therefore highest where many users hold application accounts or where credential theft is plausible. |
| Impact | This is a genuinely high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) describes a network-reachable, low-complexity flaw requiring only low-level privileges and no user interaction, yielding high confidentiality AND integrity impact (no availability impact). Because PR:L, this is an authenticated flaw - any account holder on the application can escalate to full read/modify/delete of all CLM-accessible data, making it attractive for insider abuse or post-credential-compromise lateral movement. No EPSS score, KEV listing, or POC was supplied in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the absence of these signals means the 8.1 reflects potential severity rather than demonstrated in-the-wild use. One conflict to verify: the input Tags include 'Authentication Bypass,' yet the description and CVSS explicitly require a low-privileged (authenticated) attacker (PR:L) - these are contradictory, and the tag appears mislabeled. Treat this as a real priority for any organization running the affected EBS module, prioritized by patch availability in the Oracle October 2026 CPU rather than by confirmed exploitation. |
| Exploit ScenarioDerived | An attacker with a low-privileged Oracle E-Business Suite application account sends crafted HTTP requests to the Contract Lifecycle Management for Public Sector (Award/PO) component, exploiting the flaw to read, create, modify, or delete critical contract and procurement data beyond their authorization. Because attack complexity is low and no user interaction is needed (AV:N/AC:L/UI:N), a single authenticated session is sufficient. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle E-Business Suite 12.2.3 through 12.2.15 ships a Contract Lifecycle Management for Public Sector module whose Award/PO component fails to properly constrain what a logged-in low-privileged user can do, so any account holder with HTTP reach to the application can read and alter contract and purchase-order data they should not touch. The result is a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact and no availability impact; the vector (AV:N/AC:L/PR:L/UI:N/S:U) means exploitation requires prior authentication but no admin rights, no user interaction and no special configuration. Risk is concentrated in EBS deployments with large or loosely governed user populations, or where credentials can be phished or reused; no public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle has published a fix in its October 2026 Critical Patch Update.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor-released fix covering EBS 12.2.3 through 12.2.15; Oracle CPU patches are cumulative, so apply the full October 2026 CPU set for the EBS application tier and any associated database patches, and test in a non-production clone first because EBS patching can invalidate customizations and requires planned downtime. Where the CPU cannot be applied immediately, compensating controls should focus on the authentication precondition: tightly review and prune EBS user accounts and responsibilities that grant access to Contract Lifecycle Management for Public Sector, remove dormant or shared accounts, and enforce strong authentication (MFA/SSO) plus anomaly alerting on Award/PO activity, accepting that this reduces but does not eliminate exposure because the flaw is exploitable by any legitimate low-privileged user. Network-level restriction of the EBS HTTP listener to trusted corporate ranges or VPN, or fronting it with a WAF that inspects authenticated CLM Award/PO requests, further shrinks the attack surface at the cost of blocking legitimate remote and partner access, and monitoring should prioritize unusual contract or purchase-order creation, modification and export events by low-privileged accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is a large multi-tier enterprise application stack in which business modules such as Contract Lifecycle Management for Public Sector (CLM) expose their Award and Purchase Order workflows over HTTP, typically through the EBS web listener and the Oracle Forms/HTML front end. Business authorization in EBS is enforced per-function and per-data-set through responsibility and menu grants plus module-level access logic; when that enforcement is incomplete in the Award/PO code path, a user holding only a basic application responsibility can invoke functionality or reach records outside their intended scope. The provided data assigns no CWE, but the assessed impact profile (network reachable, low privileges required, no user interaction, high confidentiality and integrity impact, no availability impact) is characteristic of a broken access-control / missing authorization-check class of defect rather than memory corruption or injection. Because the flaw sits inside the application layer rather than the database or OS, exploitation traffic is ordinary authenticated HTTP against the EBS instance and does not require elevated database privileges or administrator-level application roles.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network HTTP vector with low complexity and no user interaction, but requires a low-privileged authenticated account (PR:L); high confidentiality and integrity impact, no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Contract Lifecycle Management for Public Sector accessible data as well as unauthorized access to critical data or complete access to all Oracle Contract Lifecycle Management for Public Sector accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle E-Business Suite 12.2.3 through 12.2.15 Contract Lifecycle Management for Public Sector (Award/PO) allows any authenticated low-privileged user with HTTP access to read and alter contract and purchase-order data outside their authorization. That creates procurement integrity, fraud, and compliance exposure for organizations with broad or loosely governed EBS user populations; no public exploit identified at time of analysis.
Apply vendor patch; if unavailable, restrict HTTP reach, enforce least privilege and segregation of duties, and monitor Award/PO changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB