EUVD-2026-106074
GHSA-3fxp-fmww-x4pf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege EBS credentials
-
ExploitReach Email Center over HTTP
-
ExecutionSend crafted request to Message Component
-
ImpactRead unauthorized confidential data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold low-privilege authenticated access to Oracle Email Center (CVSS PR:L) and HTTP network reachability to the Message Component. No user interaction is required (UI:N) and attack complexity is low (AC:L). Impact is limited to confidentiality (C:H) - unauthorized read access to Email Center data - with no integrity or availability effect. Limiting factors: only Oracle E-Business Suite deployments running Email Center versions 12.2.3 through 12.2.15 are affected, and the attacker must possess valid credentials, so fully unauthenticated exploitation is not supported by the provided vector. |
| Impact | This is a moderate-severity, confidentiality-only flaw in the Oracle Email Center component of Oracle E-Business Suite. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity attack requiring low-level authentication and no user interaction, impacting only confidentiality (C:H) with no integrity or availability effect. No EPSS score, CISA KEV listing, POC availability, or SSVC decision data was provided, so exploitation-likelihood signals are absent rather than low - this is missing data, not confirmation of low risk. The vulnerability is NOT in CISA KEV and no public exploit was identified, so there is no evidence of active exploitation; however, Oracle EBS components are a recurring target and Oracle Critical Patch Update flaws are frequently reverse-engineered after release. The 'Authentication Bypass' input tag conflicts with the CVSS PR:L metric: PR:L means the attacker must already hold low-privilege credentials, which is inconsistent with a true authentication bypass - verify the true nature of the flaw with Oracle. Realistic priority is medium: a genuine data-exposure risk for internet- or intranet-exposed EBS instances with any authenticated user base, but gated by the need for valid (even low-privilege) access. |
| Exploit ScenarioDerived | A low-privileged authenticated user with HTTP access to the Oracle Email Center interface sends crafted requests to the Message Component to read data they should not be authorized to see. Because no user interaction is needed and attack complexity is low, a user with any valid foothold could retrieve confidential Email Center data. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Low-privileged authenticated users of Oracle Email Center, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can read critical Email Center data they should not be able to reach, giving them complete read access to all data the component exposes (CVSS 3.1 base score 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw is remotely reachable over HTTP with low attack complexity and no user interaction, but the attacker must already hold valid low-privilege credentials in the application, so it is an authorization/access-control weakness rather than pre-authentication compromise. Impact is strictly confidentiality - no integrity or availability effect - and no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Patch status: patch available per vendor advisory - Oracle addresses this in its October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the authoritative source for the exact EBS patch/ADOP cycle level covering Email Center 12.2.3 through 12.2.15; no standalone fix version number is stated in the available data, so validate the minimum patch level against the CPU advisory before closing the finding. Where the October 2026 CPU cannot be applied immediately, reduce exposure with compensating controls: front the Email Center Message Component endpoints with a reverse proxy or WAF rule that restricts access to known corporate networks or service accounts, accepting that this breaks legitimate remote/mobile email workflows for those users; if Email Center is deployed but unused, disable or undeploy the module entirely, which removes the attack surface but may affect integrated inbound-email processing; and audit and trim low-privilege EBS responsibilities that grant access to Email Center so that only staff who genuinely need the module retain a session that can reach the vulnerable component, noting that this requires ongoing periodic access recertification. Because exploitation is authenticated and read-only, also enable and monitor application-tier audit logging for anomalous bulk reads or unusual query patterns against Email Center message data, since such activity is the most reliable detection signal given the absence of integrity or availability artifacts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Email Center is an Oracle E-Business Suite (EBS) application module that handles inbound and outbound email interactions, routing messages through its Message Component. The vulnerability lies in insufficient authorization enforcement within that Message Component: the application accepts HTTP requests from a session holding only low-privilege privileges and returns data beyond the caller's intended entitlement. No CWE identifier was supplied by the vendor, but the behavior maps to the missing authorization / improper access control class (CWE-862/863-like), which is consistent with the 'Authentication Bypass' tag applied by the reporting source even though the assessed CVSS vector (PR:L) makes clear that some authentication is still required - the bypass is of per-object authorization, not of login. The CVSS scope is unchanged (S:U), meaning the exposure is contained to Email Center's own data rather than permitting lateral movement into the broader EBS database or other modules. Because the vector is AV:N/AC:L/UI:N, exploitation is a matter of crafting HTTP requests to the Message Component endpoints once a session exists; no special conditions, race windows, or victim interaction are needed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
HTTP-reachable (AV:N), low-complexity (AC:L); PR:L because a valid low-privilege account is required; confidentiality-only impact per description, so I:N/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Component). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Email Center. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Email Center accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB