EUVD-2026-105957
GHSA-mfmv-jwhf-m27j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege EBS account
-
ExploitSend crafted HTTP request to MRP
-
ExecutionExploit Internal Operations flaw (high complexity)
-
ImpactAchieve full takeover of MRP product
Vulnerability Assessment
| Exploitation Conditions | Requires a valid low-privileged Oracle E-Business Suite account (PR:L) with network/HTTP reach to the Materials Requirement Planning Internal Operations component on affected versions 12.2.3-12.2.15. Exploitation is explicitly rated 'Difficult' by Oracle (AC:H), implying additional non-trivial conditions such as specific timing, state, or environmental factors must be met; no end-user interaction is needed (UI:N). The authentication requirement and high complexity are the primary limiting factors, meaningfully reducing the pool of capable attackers to those with existing (even minimal) EBS access. |
| Impact | Moderate-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) is internally consistent with the description: network/HTTP vector, but Oracle explicitly rates it 'Difficult to exploit' (AC:H), and it requires an existing low-privileged account (PR:L), not an anonymous attacker. The payoff if exploited is severe - full 'takeover' of the Materials Requirement Planning product with high confidentiality, integrity, and availability impact. However, no EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no evidence of active or imminent exploitation; the combination of high attack complexity plus required authentication realistically suppresses mass exploitation. Note a signal conflict: the input Tag labels this 'Information Disclosure,' but the CVSS vector and description indicate full C/I/A compromise (takeover), not mere disclosure - treat the tag as inaccurate and the impact as full takeover. This is a patch-in-normal-cycle item for Oracle EBS operators (prioritize if internet-facing or with many low-trust internal users), not a drop-everything zero-day. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege Oracle E-Business Suite account sends specially crafted HTTP requests to the Materials Requirement Planning (Internal Operations) component and, after overcoming the high-complexity conditions, escalates to full control of the MRP product. No public exploit code was identified, and the high attack complexity means exploitation is non-trivial and may require specific timing or environmental conditions. Success yields complete compromise of the targeted MRP data and functionality. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Takeover of Oracle Materials Requirement Planning (MRP) in Oracle E-Business Suite 12.2.3-12.2.15 is possible for a low-privileged attacker with network access via HTTP to the Internal Operations component, though the high attack complexity makes exploitation difficult. Successful attacks provide high confidentiality, integrity, and availability impact; authentication requirements and environmental timing/state conditions limit the attack surface. No public exploit identified at time of analysis, and the primary vendor reference is Oracle's October 2026 Critical Patch Update advisory.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 referenced at https://www.oracle.com/security-alerts/cpuoct2026.html; the provided data does not specify an exact patched 12.2.x version, so confirm the fixed build in Oracle's CPU advisory before upgrading. Until patching is complete, restrict network/HTTP access to the MRP Internal Operations component to trusted users and networks, enforce least privilege so only necessary accounts can reach EBS MRP functions, and monitor for unusual low-privileged activity in the MRP module. These compensating controls reduce exposure but do not remove the underlying flaw; restricting access may disrupt legitimate planning workflows, and least-privilege changes require validation against business roles.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is an enterprise resource planning platform, and Oracle Materials Requirement Planning is its planning and scheduling module. The flaw sits in the Internal Operations component that is reachable over HTTP. No CWE was assigned in the provided data, so the precise root-cause class is not disclosed, but the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) describes an authenticated, network-reachable issue requiring non-trivial preconditions to trigger. The AC:H rating is consistent with a state-dependent or timing-sensitive logic flaw in the MRP internal operations workflow rather than a simple injection or missing authentication check. Affected deployments are E-Business Suite 12.2.3 through 12.2.15; no CPE strings were provided in the intelligence feed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP vector (AV:N), vendor-stated difficult exploitation (AC:H), requires a low-privilege account (PR:L), no user interaction, and full takeover yields C:H/I:H/A:H.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in the Oracle Materials Requirement Planning product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Materials Requirement Planning. Successful attacks of this vulnerability can result in takeover of Oracle Materials Requirement Planning. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite 12.2.3-12.2.15 Materials Requirement Planning could be taken over through its Internal Operations HTTP component, exposing planning data and disrupting supply-chain and financial planning. The issue is high severity but difficult to exploit, and no public exploit identified at time of analysis; leadership should prioritize exposure reduction because MRP supports critical business planning and a compromise could affect confidentiality, integrity, and availability.
No vendor-released patch identified at time of analysis; restrict network access to Oracle E-Business Suite 12.2.3-12.2.15 MRP/Internal Operations HTTP endpoints via segmentation and allowlisting, enforce least privilege, monitor for anomalous activity, and track Oracle's October 2026 Critical Patch Update advisory for remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB