Oracle OPatchAuto EUVD-2026-105915

Exploitation requires the attacker to already have high-privileged logon access to the infrastructure/host where Oracle Global Lifecycle Management OPatchAuto executes (local vector, PR:H), and additionally requires interaction from a second person other than the attacker (UI:R) - in practice an administrator initiating an OPatchAuto patch operation. Only versions 12.2.0.1.16 through 12.2.0.1.52 are affected. These factors - pre-existing privileged local access plus mandatory third-party human action - sharply limit realistic exploitation to insider or already-compromised-operator scenarios; there is no remote or unauthenticated path.

Despite the HIGH-looking 6.5 Medium CVSS score, real-world risk is low. The CVSS vector itself is the strongest signal and it is heavily constraining: AV:L requires the attacker to already have logon access to the infrastructure where OPatchAuto runs; PR:H means the attacker must already hold high privileges on that host; and UI:R requires a separate human (not the attacker) to perform an action. No EPSS score, SSVC decision data, or CWE was provided in the input. The CVE is not listed in CISA KEV and no public POC is referenced, so there is no evidence of exploitation. The combination of pre-existing high privilege plus required victim interaction makes mass or automatable exploitation implausible - this reads as a privilege/trust-boundary issue reachable only by an already-trusted operator, not an internet-facing threat. Note a tag/impact conflict: the input Tag 'Information Disclosure' understates the vulnerability, which the description and vector (C:H/I:H/A:H, 'takeover') show to be a full compromise, not mere disclosure - treat the tag as unreliable.

An attacker who already has high-privileged logon access to the host running Oracle OPatchAuto plants or manipulates patching content/configuration, then waits for a legitimate administrator (the required second human) to run a patch operation, which triggers the malicious content and results in full takeover of OPatchAuto. No public exploit code is referenced, so this would require custom development against the affected 12.2.0.1.16-12.2.0.1.52 versions.