Oracle Sales Foundation EUVD-2026-105946

Exploitation requires an authenticated low-privileged account on Oracle E-Business Suite (PR:L) with network HTTP access to the Oracle Sales Foundation Security API component, against affected versions 12.2.3 through 12.2.15. The primary limiting factor is high attack complexity (AC:H): Oracle explicitly characterizes this as 'difficult to exploit,' meaning success depends on conditions outside the attacker's direct control - plausibly specific configuration state, timing/race conditions, or reconnaissance of the target - though the advisory does not name the exact feature or setting. No user interaction is required (UI:N), but the authentication requirement and complexity meaningfully reduce the realistic attacker population beyond what the 7.5 score alone suggests.

This is a genuine but second-tier priority rather than an emergency. The CVSS 3.1 base score of 7.5 reflects a serious outcome - full takeover of Oracle Sales Foundation with High confidentiality, integrity and availability impact - but two metrics temper the real-world risk: AC:H (high attack complexity, explicitly described by Oracle as 'difficult to exploit') and PR:L (the attacker must already hold a low-privileged, authenticated account). The vector is network-reachable over HTTP (AV:N) with no user interaction (UI:N) and no scope change (S:U). No EPSS score, CISA KEV listing, SSVC decision data, or POC availability was provided in the input, so there is no signal of active or probable exploitation to elevate urgency - per the precision rules this is treated as 'no public exploit identified at time of analysis.' The signals are therefore internally consistent: a high-impact but hard-to-exploit, authentication-gated flaw. Note one data-quality tension: the input Tags label this 'Information Disclosure,' yet the CVSS vector and description indicate full C/I/A takeover, not mere disclosure - treat the tag as understating the impact, not the vector.

A low-privileged user with a valid Oracle E-Business Suite account (for example a legitimate but minimally-privileged business user or a compromised standard account) sends crafted HTTP requests to the Sales Foundation Security API component and, after meeting the difficult-to-satisfy preconditions implied by AC:H, escalates to full control of the Sales Foundation module. No public exploit code was identified in the provided data, and the high attack complexity means successful exploitation likely requires specific timing, configuration, or reconnaissance rather than a simple one-shot request.