EUVD-2026-106048
GHSA-4477-hr46-446m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach EBS Oracle Marketing endpoint over HTTP
-
ExploitSend crafted request to Audience component
-
ImpactExfiltrate critical data and perform limited writes
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network HTTP access to an Oracle E-Business Suite deployment running the Oracle Marketing product (Audience component) at versions 12.2.3 through 12.2.15; no authentication, no privileges, and no user interaction are needed (AV:N/AC:L/PR:N/UI:N), so default-exposed instances are reachable. The primary limiting factors are deployment-specific: the target must actually run the Oracle Marketing module (not all EBS installs enable it), the HTTP endpoint must be network-reachable to the attacker (external exposure vs. segmented internal-only), and the environment must be at an affected 12.2.x patch level. Impact is bounded to confidentiality of all Oracle Marketing data plus limited write access to some of it; there is no availability impact. |
| Impact | This is a genuine high-priority issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, base 8.2) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, which is the easiest-to-reach exploitability profile and consistent with Oracle's own 'easily exploitable, unauthenticated' description. The impact is confidentiality-dominant (C:H) with limited integrity (I:L) and no availability impact (A:N), so the realistic worst case is mass disclosure of Oracle Marketing data plus some unauthorized insert/update/delete - not a full server takeover. Signals are partly missing: no EPSS score, no CISA KEV entry, and no POC are present in the input, so there is currently no evidence of active exploitation or weaponization despite the high CVSS. One conflict to verify: the input Tags include 'Authentication Bypass', but neither the description nor the CVSS vector characterizes this as an auth-bypass primitive (PR:N simply means no pre-auth is required), so treat that tag as unconfirmed. Net: prioritize patching as a high-severity unauthenticated data-exposure bug, but note that real-world exploitation probability is currently unquantified due to missing EPSS/KEV/POC data. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker reaches an internet- or intranet-exposed Oracle E-Business Suite instance and sends crafted HTTP requests to the Oracle Marketing Audience component. Because no authentication or user interaction is required, the attacker reads critical Oracle Marketing data and performs limited unauthorized inserts, updates, or deletes. No public exploit identified at time of analysis, so this would require original exploit development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated HTTP access to the Audience component of Oracle Marketing in Oracle E-Business Suite 12.2.3 through 12.2.15 can let a remote attacker read all Oracle Marketing-accessible data and modify some of it, with no privileges or user interaction required. Oracle rates the issue 8.2 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N); exposure depends on the Marketing module being installed and its HTTP endpoints being reachable. Exploitation status at time of analysis: no public exploit identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory provides the vendor remediation.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor-released remediation for CVE-2026-101640; follow Oracle's CPU installation guidance for E-Business Suite 12.2.3 through 12.2.15 and confirm the Marketing/Audience patches are included. Patch status is 'Patch available per vendor advisory' because no standalone exact fix version was supplied in the input, so do not assume an arbitrary 12.2.x level is fixed. If patching must be delayed, reduce exposure by restricting network access to Oracle Marketing HTTP endpoints through segmentation, reverse-proxy or WAF allowlists, and by disabling the Oracle Marketing module entirely on instances that do not use it; the trade-off is loss of marketing functionality or disruption to legitimate integrations that depend on those endpoints. Monitor web logs for unauthenticated requests to Audience-related paths as a compensating detection control. No public exploit identified at time of analysis, so prioritization should be driven by internet exposure and whether Oracle Marketing is installed rather than by observed attacks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue resides in the Audience component of Oracle Marketing, a module within Oracle E-Business Suite, and is tagged as an Authentication Bypass in the available intelligence rather than being mapped to a specific CWE (none was supplied). The CVSS vector describes a network-reachable HTTP interface (AV:N) with low attack complexity (AC:L), no required privileges (PR:N), and no user interaction (UI:N), which indicates that the authorization or access-control check protecting Audience functionality can be bypassed by an unauthenticated request. Successful exploitation yields high confidentiality impact against all Oracle Marketing-accessible data and low integrity impact allowing some unauthorized insert, update, or delete operations; availability is not affected. No CPE identifiers were provided, so affected-product scoping rests on the vendor and ENISA EUVD version range: Oracle E-Business Suite 12.2.3 through 12.2.15 with Oracle Marketing deployed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Oracle describes easily exploitable unauthenticated HTTP access (AV:N/AC:L/PR:N/UI:N); impact is broad data read (C:H) with partial writes (I:L) and no availability effect (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as unauthorized update, insert or delete access to some of Oracle Marketing accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Executive ViewAI
Oracle E-Business Suite 12.2.3 through 12.2.15 customers running Oracle Marketing are exposed through the Audience component, where an unauthenticated remote attacker can read all Marketing-accessible data and modify some of it without user interaction. Leadership should care because a reachable Marketing deployment could create a direct confidentiality and data-integrity risk for marketing, customer, or campaign data, though exposure is limited to environments with the module installed and HTTP endpoints reachable; no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis; Oracle's October 2026 Critical Patch Update advisory is referenced as the vendor remediation. Interim mitigations: restrict network access to Oracle Marketing Audience HTTP endpoints, segment Oracle E-Business Suite 12.2.3 through 12.2.15 from untrusted networks, deploy WAF or virtual-patching rules, monitor and alert on anomalous reads or modifications of Marketing-accessible data, minimize data exposed to the Marketing module, and apply the Oracle CPU when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB