Oracle One-to-One Fulfillment EUVD-2026-106100

Exploitation requires a valid low-privileged authenticated account on the Oracle One-to-One Fulfillment application (PR:L) with network HTTP access to its Java server component, and affects supported versions 12.2.3 through 12.2.15. The CVSS AC:H metric indicates exploitation is gated by conditions the attacker does not control - Oracle labels it 'difficult to exploit' - meaning the attacker must satisfy specific application state, timing, or preparatory steps beyond simply sending a request. These two factors (prior authentication plus high complexity) are the primary limiters that reduce realistic risk below what the 7.5 base score alone suggests; no user interaction is required (UI:N).

Oracle's own CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes a network-reachable but hard-to-exploit flaw: the AC:H metric signals that exploitation depends on conditions outside the attacker's control (e.g. timing, specific state, or non-trivial preparation), and PR:L means the attacker must already hold a low-privileged, authenticated account on the Oracle One-to-One Fulfillment application. Against that, the impact side is maximal - C:H/I:H/A:H and the description's explicit 'takeover' language - so a successful attack is severe, but the preconditions materially lower real-world likelihood. No EPSS score, SSVC decision, or CISA KEV entry was provided in the input, and no proof-of-concept is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this reads as a high-severity-but-gated issue rather than a mass-exploitation emergency. The only reference is the Oracle October 2026 Critical Patch Update, consistent with coordinated vendor disclosure. Note one tension to verify: the input tags this as 'Information Disclosure', yet the CVSS and description indicate full confidentiality, integrity, and availability takeover - the tag understates the actual impact.

An attacker who has obtained a low-privileged authenticated account on an internet- or intranet-facing Oracle One-to-One Fulfillment instance sends crafted HTTP requests to the vulnerable Java server component. By satisfying the specific conditions implied by the high attack complexity, the attacker escalates to full compromise of the One-to-One Fulfillment application, gaining read/write control and the ability to disrupt availability. No public proof-of-concept is referenced in the provided data.