Oracle One-to-One Fulfillment EUVD-2026-106099

Exploitation requires human interaction (CVSS UI:R) from a user other than the attacker - in practice an authenticated operator of the Oracle One-to-One Fulfillment Admin Console UI who must be induced to open attacker-controlled content; the attacker themselves needs no credentials (PR:N) but cannot trigger the flaw autonomously. Limiting factors: the attack only yields partial read (C:L) and partial write (I:L) within the victim's session context, has no availability impact (A:N), and depends on reaching/socially-engineering an admin-console user, which meaningfully constrains mass exploitation. Affected deployments are Oracle E-Business Suite 12.2.3 through 12.2.15 running the One-to-One Fulfillment module.

This is a moderate, context-dependent risk rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) describes a network-reachable, low-complexity, unauthenticated flaw - but the mandatory UI:R (user interaction required) is the decisive limiter: exploitation depends on luring a legitimate user, almost certainly an administrator given the 'Admin Console UI' component, into performing an action. The scope change (S:C) plus 'attacks may significantly impact additional products' and the C:L/I:L/A:N impact profile are textbook signatures of a cross-site scripting (XSS) / content-injection class issue delivered through the admin console, not a direct server compromise. No EPSS score was supplied, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent (no CVSS-vs-description conflict), but note the input Tag 'Authentication Bypass' contradicts the vector: PR:N means the vuln is pre-authentication, which is not the same as bypassing authentication, and the UI:R/scope-change profile points to XSS - treat that tag as suspect. Overall: a genuine issue warranting patching in the normal Oracle Critical Patch Update cycle, but lower urgency than a weaponized, no-interaction RCE.

An attacker crafts a malicious link or payload targeting the Oracle One-to-One Fulfillment Admin Console UI and tricks an authenticated administrator into opening it (e.g., via phishing). When the admin's browser renders the injected content, the attacker can read a subset of accessible data and perform unauthorized insert/update/delete actions in the admin's session, with effects potentially spilling into other integrated EBS products due to the scope change. No public exploit code is currently identified.