EUVD-2026-106057
GHSA-6rv6-92q4-mqh6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged EBS account
-
DeliverySend crafted HTTPS request to Internal Operations
-
ExploitExploit Partner Management authorization flaw
-
ExecutionModify or delete critical partner data
-
ImpactCause partial denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged Oracle Partner Management account (PR:L) with network access to the application over HTTPS; exploitation targets the Internal Operations component on Oracle E-Business Suite versions 12.2.3 through 12.2.15. The description names no special feature flag or non-default configuration, so default deployments of these versions are affected. The primary limiting factor is authentication - an attacker must already possess credentials - while no user interaction, no elevated privileges, and no local access are needed, and low attack complexity means exploitation is reliable once a session is held. |
| Impact | This is a credible mid-tier priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, 7.1 HIGH) describes an easily exploitable, network-reachable flaw requiring only a low-privileged authenticated account and no user interaction, with high integrity impact (unauthorized create/delete/modify of critical data) plus a partial availability (DoS) impact and no confidentiality exposure. Offsetting signals: no EPSS score is provided, the vulnerability is NOT in CISA KEV, and no public exploit is identified - so there is no public-exploit identified at time of analysis and no evidence of active exploitation. The PR:L requirement is the key limiter: an attacker must already hold a valid Oracle Partner Management/EBS login, which narrows realistic exposure to insiders, partners, or attackers who have obtained credentials, making this far less dangerous than an unauthenticated RCE despite the HIGH rating. No conflicting signals were found between the CVSS vector and the description - both agree on network access and low privilege. Missing data (EPSS, CWE, independent POC confirmation) means exploitation likelihood cannot be precisely quantified; prioritize patching for internet-exposed EBS instances during the normal Oracle CPU cycle. |
| Exploit ScenarioDerived | An attacker holding a low-privileged Oracle Partner Management account (a malicious insider, a compromised partner login, or an attacker reusing stolen credentials) sends a crafted HTTPS request to the Internal Operations component. Because AC:L and no user interaction are required, the request reliably manipulates or deletes critical Partner Management data and can induce a partial denial of service. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle Partner Management, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes an integrity and partial availability flaw in its Internal Operations component that a low-privileged authenticated user can reach over HTTPS. Successful exploitation lets that account create, delete, or modify critical Partner Management data and trigger a partial denial of service, with no user interaction and low attack complexity once a valid session is held. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a credible mid-tier priority for EBS deployments rather than an emergency - the main gate is possession of valid low-privileged credentials.
RemediationAI
Apply the Oracle Critical Patch Update referenced at https://www.oracle.com/security-alerts/cpuoct2026.html; Oracle CPU advisories for E-Business Suite list the specific recommended patches and minimum prerequisite patch levels per 12.2.x release, so match the patch to your exact 12.2.3-12.2.15 build rather than assuming a single universal patch identifier, and note that EBS patching typically requires the application tier to be taken down or placed in managed/adop mode during the cycle. Because exploitation requires only a valid low-privileged account, the highest-value compensating control is to audit and aggressively prune Partner Management user accounts, revoke unused responsibilities, and enforce strong authentication or MFA at the EBS access layer - trade-off: revoked accounts must be re-provisioned for legitimate partners, so stage the cleanup with business owners. Restrict network reachability to the EBS HTTPS endpoints to known partner and internal ranges via firewall or reverse-proxy allow-lists, which reduces exposure but complicates onboarding of roaming or new partners. If the Internal Operations functionality is not actively used, disable or restrict the associated responsibilities and menus as an interim measure; this removes the attack surface but may break legitimate partner operations workflows. Monitor EBS audit and application logs for unexpected create/delete/modify activity in Partner Management performed by low-privileged sessions, since the confidentiality impact is None and the primary detectable signal will be unauthorized data change rather than data exfiltration. At time of analysis no public exploit code or confirmed active exploitation was identified, so prioritization can follow standard CPU cadence - but treat internet-facing EBS instances as higher priority given the low attack complexity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the Internal Operations component of Oracle Partner Management, a partner/channel relationship management module delivered inside Oracle E-Business Suite 12.2.x. The affected technology stack is the EBS application tier exposed through Oracle HTTP/HTTPS services, so exploitation occurs at the web application layer rather than via a memory-safety bug in a native library - the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) points to a missing authorization or input-validation weakness in an application endpoint reachable by any valid low-privileged user, since integrity is rated High and availability Low while confidentiality is None. No CWE was assigned in the source data, but the integrity-dominant, confidentiality-neutral profile is consistent with an access-control or business-logic enforcement gap in the Internal Operations handler rather than with information disclosure. The unmodified scope (S:U) means the impact stays inside the Partner Management security authority; the engine itself is not expected to be compromised, which limits blast radius to partner and internal-operations data plus a partial service disruption.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Network-reachable over HTTPS with low complexity and no UI; a valid low-privileged account is required so PR:L; high integrity, partial availability, and no confidentiality impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Partner Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).
Executive ViewAI
Oracle E-Business Suite 12.2.3 through 12.2.15 deployments that use Partner Management face a high-severity integrity and partial availability exposure in the Internal Operations component. Leadership should care because critical partner records could be created, deleted, or modified and a partial service disruption could follow, with no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, so this warrants prioritized controls rather than emergency response.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Partner Management Internal Operations access to essential users, enforce least privilege and session monitoring, limit HTTPS/network exposure where feasible, enable audit logging and alerts for create/delete/modify activity, and maintain tested backups for Oracle E-Business Suite 12.2.3 through 12.2.15.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB