EUVD-2026-79741
GHSA-fxm9-8q2q-7r86
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable EBS web component with no user interaction, but a low-privileged authenticated session is required; confidentiality-only impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Assets product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Assets. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Assets accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Oracle Assets, a module within Oracle E-Business Suite, exposes sensitive asset and financial data to any authenticated user with low privileges who can reach the module over HTTP. Versions 12.2.3 through 12.2.15 are affected; a successful attack yields high confidentiality impact (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N) with no integrity or availability effect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated Oracle E-Business Suite session with low privileges (CVSS PR:L) and HTTP network access to the EBS application tier where the Oracle Assets module is deployed and the Internal Operations component is reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Mixed signals. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update covering Oracle Assets; the advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source for the exact patched release, and no specific fix version was provided in the input data, so confirm the target build there before scheduling. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today