Oracle One-to-One Fulfillment EUVD-2026-106097

Exploitation requires an authenticated low-privileged account on the target Oracle E-Business Suite instance (PR:L) with HTTP network access to the One-to-One Fulfillment Documents component, and the CVSS AC:H rating signals that additional non-default or hard-to-control conditions (such as specific timing/state or configuration of the Fulfillment module) must be met for success. The affected deployment must run One-to-One Fulfillment on EBS releases 12.2.3 through 12.2.15. Limiting factors that reduce real-world risk: the required authenticated foothold, the explicit 'difficult to exploit' high complexity, and the restriction to a specific CRM module rather than the entire EBS stack. No user interaction is required (UI:N).

This is a moderate-severity, moderate-priority issue rather than an urgent one. The Oracle-assigned CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H, base 6.8) is internally consistent with the description: network-reachable over HTTP, but explicitly 'difficult to exploit' (AC:H) and requiring an authenticated low-privileged account (PR:L). Impact is limited to integrity (unauthorized create/delete/modify of critical data) and availability (complete DOS of the One-to-One Fulfillment module); there is no confidentiality impact (C:N). No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so exploitation-probability signals cannot be evaluated - their absence is not evidence of safety but does mean there is no indication of mass or automated exploitation at this time. The combination of high attack complexity plus a required authenticated foothold meaningfully lowers real-world exploitability compared to the network attack vector alone, so this should be patched on a normal Oracle Critical Patch Update cadence rather than treated as an emergency. No signals conflict with the CVSS vector.

An attacker who already holds a low-privileged authenticated account on the Oracle E-Business Suite instance sends specially crafted HTTP requests to the One-to-One Fulfillment (Documents) component, exploiting a flaw that under specific, hard-to-meet conditions allows them to tamper with or destroy critical fulfillment data or crash the module entirely. The high attack complexity means the attacker must satisfy non-trivial preconditions or win a race/timing-dependent condition, so exploitation is not reliable or one-shot. No public exploit code was identified in the provided intelligence.