EUVD-2026-106285
GHSA-xjxj-h2p6-82vf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged EBS account
-
ExploitSend crafted HTTP request to CLM component
-
ExecutionExploit Award/PO flaw
-
ImpactAchieve full product takeover
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires an existing low-privileged authenticated account on the target (CVSS PR:L), network/HTTP reachability to the Oracle E-Business Suite instance, and that the Oracle Contract Lifecycle Management for Public Sector module (Award/PO component) be deployed and running on a supported-but-unpatched release in the 12.2.3-12.2.15 range. No user interaction is required and attack complexity is low, so any authenticated user able to reach the CLM HTTP endpoints can attempt it. The principal limiting factors are the authentication requirement and the narrow deployment footprint of this public-sector-specific module; instances where CLM for Public Sector is not licensed/enabled are not affected. |
| Impact | This is a credible high-priority issue for organizations actually running the affected module, but the available signals are thin. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is confirmed by Oracle and indicates a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact - Oracle explicitly describes the outcome as 'takeover' of the product. However, no EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation; the real-world urgency currently rests on CVSS severity plus the attractiveness of Oracle EBS as a target, not on observed attacks. A notable conflict exists in the metadata: the sole vulnerability-class tag is 'Information Disclosure,' which directly contradicts the C:H/I:H/A:H vector and Oracle's 'takeover' language - treat the 'Information Disclosure' label as inaccurate and rely on the CVSS vector. Because PR:L is specified, exploitation requires an authenticated (low-privileged) account, which meaningfully narrows the attacker population versus a fully unauthenticated flaw. Net: a real priority to patch for public-sector EBS CLM operators, but not demonstrably under mass exploitation on the available evidence. |
| Exploit ScenarioDerived | An attacker who holds a low-privileged application account on an internet- or intranet-reachable Oracle E-Business Suite instance sends crafted HTTP requests to the Contract Lifecycle Management for Public Sector (Award/PO) component. Because attack complexity is low and no user interaction is needed, the attacker leverages the flaw to escalate from limited access to full compromise of the CLM product, gaining control over its data and functions. No public exploit code is identified at time of analysis, so this scenario is based on the CVSS vector and Oracle's description rather than a demonstrated PoC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
An authenticated low-privileged user who can reach the Oracle Contract Lifecycle Management for Public Sector HTTP endpoints in Oracle E-Business Suite can achieve full takeover of the CLM module's data and functionality - a complete loss of confidentiality, integrity and availability scored at CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only instances running the Award/PO component of CLM for Public Sector on releases 12.2.3 through 12.2.15 are exposed, and the attack requires a valid account (PR:L) with no user interaction and low complexity once that prerequisite is met. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle typically withholds technical detail until customers have patched, so the absence of exploit reporting should not be read as low risk for internet-facing or broadly accessible EBS deployments.
RemediationAI
Patch available per vendor advisory: apply the Oracle October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html) to the EBS application tier - Oracle CPUs are cumulative, so the exact 12.2.x patch level required for CLM for Public Sector should be taken from the CPU's patch availability table for the deployed platform rather than assumed. Until the CPU is applied, reduce the effective attack surface: disable or de-register the CLM for Public Sector module if it is licensed but not actively used (side effect: award/PO workflows become unavailable, so confirm with procurement owners first); restrict network reachability to the EBS HTTP endpoints with a reverse proxy, WAF rule set or VPN so that only known internal user populations can reach the Award/PO servlets (side effect: remote and contractor access must be routed through the VPN); and audit and prune low-privileged or dormant EBS accounts, since PR:L means any valid authenticated user is a viable attack origin, enforcing strong authentication on remaining accounts (side effect: helpdesk load and possible workflow disruption). Add monitoring for anomalous award/PO read and write activity by low-privilege users to catch exploitation attempts during the patch window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is a Java/PL-SQL enterprise application stack in which modules such as Contract Lifecycle Management for Public Sector (CLM) expose HTTP servlet endpoints through the EBS application tier. The Award/PO component handles public-sector award and purchase-order workflows - data that is frequently sensitive procurement, vendor and pricing information. No CWE was assigned by the originating advisory, but the assessed vector (network-reachable, low complexity, low privilege, no user interaction, single-scope, uniform high C/I/A impact) is the signature of a broken access-control or authorization weakness that lets an ordinary authenticated user invoke privileged award/PO operations rather than a memory-safety or injection defect; Oracle's October 2026 Critical Patch Update addresses it in the corresponding EBS security alert. The EUVD record corroborates the same affected range (12.2.3 ≤ 12.2.15) and no CPE identifiers were supplied, so exposure must be determined from the installed EBS release and the licensing/enablement state of the CLM for Public Sector module rather than from version-matching tooling.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
HTTP-reachable with low complexity and no user interaction, but Oracle specifies a low-privileged account is required, so PR:L; 'takeover' justifies C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite's Contract Lifecycle Management for Public Sector (Award/PO component) on releases 12.2.3 through 12.2.15 carries a high-severity flaw that lets an authenticated low-privileged user take over the module's data and functions. Organizations running these instances could see sensitive procurement and contract records exposed, altered, or made unavailable, undermining public-sector contracting oversight and financial controls. No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, but because Oracle typically withholds technical detail until customers patch, internet-facing deployments should not be treated as low risk.
No vendor-released patch identified at time of analysis. Restrict network access to the CLM for Public Sector HTTP endpoints to trusted networks; enforce least privilege and review all accounts with access to the Award/PO component; enable detailed logging and monitoring for anomalous CLM activity; apply any Oracle-provided workarounds or mitigation guidance; and segment affected EBS instances from broader networks until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB