EUVD-2026-106445
GHSA-mvg2-q4cj-cr3r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege EBS user
-
ExploitSend crafted HTTP request to Pasta Printing Engine
-
ExecutionSatisfy high-complexity trigger condition
-
ImpactAchieve full takeover of Pasta
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged Oracle E-Business Suite account (PR:L) with network HTTP access to the Pasta Printing Engine component in affected versions 12.2.3 through 12.2.15; it is NOT remote-unauthenticated. The vector's AC:H plus Oracle's 'Difficult to exploit' statement indicate a further limiting precondition the attacker does not fully control - such as specific timing, a race window, or a particular configuration/state of the printing component - which Oracle does not specify. Limiting factors for defenders: authentication is mandatory, no single-shot deterministic exploit is implied, and only EBS 12.2.x deployments running the Pasta component are in scope; no end-user interaction is required (UI:N). |
| Impact | This is a serious but not top-tier priority flaw. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes network-reachable exploitation over HTTP that nonetheless requires an authenticated low-privileged account (PR:L) AND has high attack complexity (AC:H), meaning the attacker must win a non-trivial condition such as a race, specific timing, or a particular configuration state rather than firing a single deterministic request. The 'High' attack complexity is the key risk-dampener and is consistent with Oracle's own 'Difficult to exploit' language in the description - the two signals agree. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent mass exploitation; this is a vendor-reported (secalert_us@oracle.com) issue disclosed via the October 2026 Critical Patch Update. The full C:H/I:H/A:H impact ('takeover of Pasta') is significant, but the combination of required authentication plus high complexity places this below drive-by, unauthenticated critical bugs. Note the input 'Information Disclosure' tag conflicts with the actual CVSS impact profile, which shows integrity and availability compromise (full takeover), not confidentiality loss alone - the tag understates the impact. Treat as an important patch-in-normal-cycle item for Oracle EBS 12.2 shops, elevated only where untrusted or numerous low-privilege EBS accounts exist. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege Oracle E-Business Suite account sends crafted HTTP requests to the Pasta Printing Engine component and, after satisfying a difficult-to-meet precondition (consistent with AC:H), triggers the flaw to gain full control of Pasta. No public exploit code was identified at the time of analysis, and the high attack complexity means reliable exploitation likely requires specialized knowledge of the component. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Takeover of the Pasta Printing Engine component within Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a low-privileged authenticated user who can reach the component over HTTP, with full impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.5). Oracle characterizes the flaw as difficult to exploit, and the AC:H metric indicates an additional precondition the attacker does not fully control - such as a specific timing window, race condition, or particular printing-component state - so reliable, single-shot exploitation is not implied; no public exploit code and no active exploitation (CISA KEV) were identified at time of analysis. This is a serious but not top-tier priority issue: exploitation is gated behind valid EBS credentials and applies only to 12.2.x deployments running the Pasta component, and no user interaction is required (UI:N).
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which contains the fix for the Pasta Printing Engine in EBS 12.2.x - patch status is 'Patch available per vendor advisory'; no standalone fix version number was disclosed in the available data, so confirm the post-CPU application version against Oracle's advisory before closing. Because the flaw requires only low-privileged credentials, the highest-value compensating control is privilege minimization: audit and revoke unnecessary EBS accounts and roles that can reach the Printing Engine, since each such account is a potential exploitation foothold (trade-off: reduced self-service printing and report-submission capability for affected users). Network-level restriction of HTTP access to the printing/spooler endpoints to trusted application tiers or administrator subnets materially shrinks the attack surface (trade-off: legitimate remote printing and integrated third-party print flows must be re-routed or allowed by exception). Where the printing component is not actively used, disable or undeploy the Pasta printing service entirely. Finally, log and alert on anomalous print/job-submission activity from low-privileged accounts, and treat any such account performing unexpected administrative or configuration actions through the printing interface as a probable compromise indicator.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is a large integrated ERP platform whose Printing Engine (internally referred to here as 'Pasta') handles document rendering, spooling, and print/fax output generation for EBS workflows. The vulnerability lives in that printing subsystem and is reachable over HTTP by any principal holding a valid low-privileged EBS account, meaning the printing service's request-handling path does not adequately constrain what such a user can make it do - consistent with the C:H/I:H/A:H outcome, which points to an authorization or input-handling weakness enabling full compromise rather than mere information leakage. No CWE was assigned by the reporting source, so the root-cause class cannot be pinned to a single standard weakness; the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U) is the authoritative characterization: network-reachable, high attack complexity, authenticated at low privilege, no user interaction, and scoped to the Pasta component rather than the whole platform. The high complexity factor is the key differentiator from a straightforward authenticated RCE - defenders should treat it as a narrow, state-dependent exploitation path rather than a deterministic one.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reachability gives AV:N; a low-privilege account is required (PR:L) and a hard-to-meet precondition gives AC:H; full takeover yields C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pasta. Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite 12.2.3 through 12.2.15 deployments running the Pasta Printing Engine face a high-severity takeover risk in which a low-privileged user with valid EBS credentials could compromise confidentiality, integrity, and availability of the printing component. Leadership should care because affected business printing workflows may be disrupted or manipulated and no vendor-released patch is currently identified, while exploitation is difficult and no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis; restrict HTTP access to the Pasta Printing Engine to trusted networks and accounts, enforce least privilege, disable or isolate the component where business processes allow, and monitor printing-component logs for anomalous activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB