EUVD-2026-79751
GHSA-q63g-p4g8-5x4j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed EBS Document Management HTTP endpoint
-
ExploitSend crafted request bypassing authentication
-
ExecutionGain unauthenticated control of component
-
ImpactRead/modify/delete all documents and disrupt service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Document Management and Collaboration (Internal Operations component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The only prerequisite is network access to the exposed HTTP service; no credentials, no user interaction, and no non-default configuration are required per the CVSS vector (PR:N/UI:N/AC:L). Limiting factors are minimal: exploitation is bounded only by whether the EBS Document Management HTTP endpoint is network-reachable to the attacker, so internet-facing or broadly accessible deployments carry the highest realistic risk. |
| Impact | This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes remote, unauthenticated, low-complexity exploitation with no user interaction yielding full compromise (takeover) of the affected component - well-calibrated and consistent with the CWE-287 authentication-bypass classification and the description's 'unauthenticated attacker with network access via HTTP' and 'Easily exploitable' language. The SSVC framework corroborates the severity on impact (Technical Impact: total, Automatable: yes) but tempers immediacy: Exploitation is rated 'none', meaning no observed active exploitation. This aligns with the absence of a CISA KEV listing, no public POC, and no EPSS score in the provided data - so while the theoretical/base severity is critical, there is no evidence of in-the-wild activity yet. The main signal to weigh is that Oracle EBS pre-auth flaws are historically attractive targets once details/POCs emerge (automatable + total impact), so this should be patched promptly even though current exploitation evidence is absent. No conflicting signals in the vector versus description - both agree on network, unauthenticated access. |
| Exploit ScenarioDerived | A remote attacker with only network reachability to the Oracle Document Management and Collaboration HTTP endpoint sends a crafted request that bypasses authentication (CWE-287), requiring no credentials or user interaction. Because the flaw is 'easily exploitable' and automatable per SSVC, the attacker gains full takeover of the component - reading, altering, and destroying documents and disrupting service. No public exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated attackers with network access to the HTTP service can fully compromise Oracle Document Management and Collaboration (the Internal Operations component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15, achieving complete loss of confidentiality, integrity and availability - CVSS 3.1 base score 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The root cause is an authentication bypass (CWE-287), meaning no credentials, user interaction or non-default configuration are required; the only prerequisite is that the affected HTTP endpoint be reachable by the attacker, so internet-facing or broadly exposed EBS deployments carry the highest realistic risk. At time of analysis there is no confirmed active exploitation (CISA SSVC exploitation value: none) and no public exploit identified at time of analysis; CISA's SSVC assessment rates the vulnerability as automatable with total technical impact.
RemediationAI
Apply the Oracle fix referenced in the vendor security alert at https://www.oracle.com/security-alerts/cspusep2026.html (cspusep2026), which covers the affected 12.2.3-12.2.15 range - patch status is "patch available per vendor advisory"; an exact patch/CPU identifier could not be independently confirmed from the supplied data, so validate the precise one-off patch or Critical Patch Update level for your EBS 12.2.x release against My Oracle Support before or during deployment, and note that the patch's exact version is not specified in this dataset. Until patching is completed, treat the exposure as a network-reachability problem, since the bypass requires no credentials or user interaction: place the EBS Document Management and Collaboration HTTP endpoints behind a VPN or zero-trust access proxy, remove direct internet exposure of the EBS web tier, and restrict inbound access by firewall rules to trusted source ranges - the trade-off is reduced availability for legitimate remote document users, and application-layer filtering may break document upload/download workflows if not tuned. If the module is not in active use, disable or decommission the Document Management and Collaboration feature and its exposed internal-operations endpoints - the trade-off is that document collaboration functionality is lost for all users until the feature is re-enabled. A WAF or reverse proxy can be used as a stopgap to virtualize detection and blocking of anomalous unauthenticated requests to these endpoints, but it is not a substitute for the vendor patch and may produce false positives on legitimate internal traffic. Enable verbose HTTP access and EBS audit logging on the affected endpoints, and hunt for unauthenticated or anomalous requests to the Internal Operations paths as a compensating detection control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-83452 is an improper authentication flaw (CWE-287) in the Internal Operations component of Oracle Document Management and Collaboration, a module within Oracle E-Business Suite 12.2.x. Oracle E-Business Suite's web tier is built on the Oracle HTTP Server / Oracle Application Framework (OAF) JSP-servlet stack, and the Document Management and Collaboration module exposes HTTP-accessible endpoints for document repository management, collaboration and internal operational workflows. Because the defect falls into the authentication-bypass class, an attacker can reach protected internal functionality without presenting valid credentials, which is consistent with the assessed vector AV:N/AC:L/PR:N/UI:N - network-reachable, low complexity, unauthenticated and requiring no victim interaction. The scope is unchanged (S:U), but the impact ratings are uniformly High across confidentiality, integrity and availability, matching Oracle's description of a takeover of the affected component. The ENISA EUVD record (EUVD-2026-79751) confirms the same affected version range, 12.2.3 through 12.2.15, and the vulnerability is tagged as an Authentication Bypass in Oracle products.
Know when Document Management And Collaboration gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description confirms unauthenticated (PR:N) remote HTTP (AV:N) easy (AC:L) exploitation with full component takeover across all three impacts; no scope change stated (S:U).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Document Management and Collaboration. Successful attacks of this vulnerability can result in takeover of Oracle Document Management and Collaboration. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite versions 12.2.3 through 12.2.15 are affected by a critical authentication bypass in the Document Management and Collaboration component, allowing unauthenticated attackers with network access to fully compromise confidentiality, integrity, and availability. This vulnerability poses a severe risk to organizations with internet-facing or broadly accessible EBS deployments, as it requires no credentials or user interaction and could lead to complete system takeover. No public exploit identified at time of analysis, but leadership should prioritize immediate mitigation because no vendor-released patch identified at time of analysis and the flaw is rated critical with automatable exploitation potential.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to the affected HTTP endpoint, disabling the Document Management and Collaboration component if not required, deploying WAF virtual patching, and monitoring for anomalous authentication bypass attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Application takeover of the Document Management and Collaboration module in Oracle E-Business Suite 12.2.3 through 12.2.
Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Attachm
Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Documen
Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Attachm
Unauthorized data access and partial denial of service in Oracle E-Business Suite's Document Management and Collaboratio
Oracle Document Management and Collaboration, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be ful
Exploit-DB