EUVD-2026-79804
GHSA-vjpr-mrgp-2338
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Network-reachable HTTP endpoint with no user interaction, but a valid low-privilege account is required, so PR:L; High confidentiality and Low integrity impact drive the 7.1 base.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Contract Lifecycle Management for Public Sector accessible data as well as unauthorized update, insert or delete access to some of Oracle Contract Lifecycle Management for Public Sector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
AnalysisAI
Improper access control in the Award/PO component of Oracle Contract Lifecycle Management for Public Sector (part of Oracle E-Business Suite, versions 12.2.8 through 12.2.15) lets a low-privileged, authenticated attacker with HTTP network access read critical application data and modify or delete records they should not be able to touch. Oracle rates this 7.1 with a CVSS vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, meaning exploitation is trivial for anyone holding a valid low-privilege account and requires no user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated Oracle E-Business Suite session holding only low privileges (CVSS PR:L) and network reachability to the EBS HTTP interface that serves the Contract Lifecycle Management for Public Sector product - specifically the Award/PO component. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector is the strongest signal here: AV:N with AC:L and UI:N means a single crafted HTTP request, no timing or race conditions, and no victim interaction; PR:L restricts the attacker to an already-issued low-privilege account, which substantially narrows the realistic threat population to insiders, contractor accounts, or anyone who has obtained valid credentials (e.g., via phishing or credential reuse). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Patch Update associated with the referenced advisory (https://www.oracle.com/security-alerts/cspusep2026.html), which covers Oracle E-Business Suite 12.2.8-12.2.15; there is no individual fix version stated in the provided data, so treat the CPU as the primary remediation and verify the Award/PO component patch has been applied and the application tier restarted. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today