Oracle CMRO EUVD-2026-106212

Exploitation targets the LOV (List-of-Values) component of Oracle Complex Maintenance, Repair and Overhaul within Oracle E-Business Suite versions 12.2.3 through 12.2.15, reachable over HTTP. Required prerequisites: the attacker must hold valid low-privileged EBS credentials (PR:L - not anonymous), and must satisfy high-complexity, attacker-independent conditions (AC:H), meaning the attack is explicitly described by Oracle as 'difficult to exploit' and is not reliably repeatable on demand. Limiting factors that reduce realistic risk: valid authentication is mandatory, no availability impact occurs (A:N), scope is unchanged (data limited to what CMRO can access), and exploitation is confined to deployments actually running the CMRO module (a specialized, not universally installed, EBS component). No user interaction is required (UI:N).

This is a moderate-severity issue (CVSS 3.1 base 6.8) whose signals point toward a real-but-not-urgent priority. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N indicates network-reachable exploitation over HTTP, but with HIGH attack complexity (AC:H) and a requirement for existing LOW privileges (PR:L) - i.e. an authenticated user, not an anonymous remote attacker. Impact is significant on the targeted module: high confidentiality and integrity loss (C:H/I:H) with no availability impact (A:N), and no scope change (S:U), so the blast radius is confined to Complex Maintenance, Repair and Overhaul-accessible data. There is NO CISA KEV listing and NO public exploit identified at time of analysis, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so exploitation probability cannot be quantified - this is a data gap, not evidence of low risk. The combination of AC:H and PR:L materially lowers real-world risk versus a headline 'network' CVE: an attacker needs valid EBS credentials AND must satisfy difficult, non-deterministic preconditions. The provided tag 'Authentication Bypass' CONFLICTS with the CVSS vector and description, which describe a low-privileged (already authenticated) attacker rather than an authentication bypass - treat that tag as suspect and verify against the Oracle CPU advisory. Net: a legitimate patch-in-normal-cycle item for EBS CMRO operators, not a drop-everything emergency.

An attacker who already holds a low-privileged Oracle E-Business Suite account sends crafted HTTP requests to the Complex Maintenance, Repair and Overhaul List-of-Values (LOV) component, abusing it to read or alter critical CMRO data beyond their authorization. Because the flaw is rated difficult to exploit (AC:H), the attacker must satisfy specific non-deterministic conditions and likely multiple attempts to succeed. No public exploit code is known at time of analysis, so this would require original exploit development.