EUVD-2026-106107
GHSA-cxwf-vrhp-qvvh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged EBS account
-
ExploitSend crafted HTTP request to Documents component
-
ImpactRead critical One-to-One Fulfillment data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged authenticated account on an Oracle E-Business Suite deployment running One-to-One Fulfillment versions 12.2.3 through 12.2.15, with network HTTP access to the affected Documents component. No user interaction or administrative privilege is needed. Limiting factors: authentication is mandatory (PR:L), the impact is confined to confidentiality (data disclosure) with no integrity or availability effect, and only the listed 12.2.x version range is in scope. |
| Impact | This is a moderate-severity, confidentiality-only vulnerability (CVSS 3.1 6.5) in Oracle One-to-One Fulfillment within Oracle E-Business Suite. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network-reachable, low-complexity exploitation requiring only a low-privileged authenticated account, yielding full read access to accessible data with no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation or published exploit code - exploitation is plausible but unproven. The requirement for valid low-privileged credentials (PR:L) materially lowers real-world risk versus an unauthenticated flaw, making this a meaningful-but-not-emergency patch priority relative to higher-scoring or KEV-listed EBS issues in the same CPU. Signal conflict: the input Tags include 'Authentication Bypass', which contradicts the CVSS PR:L and the description's 'low privileged attacker' - the vulnerability requires authentication rather than bypassing it, so the tag appears mislabeled and should be verified against Oracle's advisory. |
| Exploit ScenarioDerived | An attacker holding a low-privileged account on an exposed Oracle E-Business Suite instance sends a crafted HTTP request to the One-to-One Fulfillment Documents component and retrieves critical data they are not authorized to view. No user interaction or elevated privileges are required beyond initial authentication, and complexity is low. No public exploit code or active exploitation is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Improper access control in Oracle One-to-One Fulfillment, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged authenticated user with HTTP network access read critical data or all data accessible to the component. The assessed CVSS 3.1 score is 6.5 with confidentiality-only impact; integrity and availability are not affected, and no user interaction is required. No public exploit was identified at time of analysis, and active exploitation is not confirmed by CISA KEV in the provided data.
RemediationAI
Patch available per vendor advisory: apply the Oracle Critical Patch Update fix referenced in Oracle's October 2026 advisory (https://www.oracle.com/security-alerts/cpuoct2026.html); the provided data does not state an exact patched build, so confirm the applicable One-to-One Fulfillment 12.2.x patch level with Oracle support. Until patching is complete, reduce exposure by restricting network access to the One-to-One Fulfillment Documents HTTP endpoints to trusted users and integrations, removing or disabling unnecessary low-privileged E-Business Suite accounts, and monitoring for unusual data access by low-privileged users. These controls can break legitimate integrations or user workflows, so scope allow-lists and account cleanup carefully. No vendor workaround beyond patching is specified in the provided data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is an enterprise resource planning application suite, and One-to-One Fulfillment is a module whose Documents component is exposed over HTTP. The provided data does not assign a CWE, so the precise coding flaw is undisclosed, but the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable access-control weakness that requires a valid low-privileged account and yields high confidentiality impact only. No CPE mapping was provided; ENISA EUVD identifies affected versions as Oracle One-to-One Fulfillment 12.2.3 through 12.2.15. The supplied 'Authentication Bypass' tag should not be read as allowing unauthenticated access, because the assessed vector requires PR:L and the advisory text describes a low-privileged attacker.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP vector with low complexity; a low-privileged authenticated account is required (PR:L); impact is full data disclosure only, so C:H and I/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB