Oracle Engineering EUVD-2026-106213

Exploitation requires a valid low-privileged Oracle E-Business Suite account (PR:L) with network HTTP access to the Oracle Engineering product's Change Management component on an affected instance (versions 12.2.3 through 12.2.15). No user interaction is needed and the vulnerability is described as easily exploitable, so once authenticated the attacker faces low complexity. The primary limiting factor is the authentication requirement - the attacker cannot be fully anonymous - meaning realistic risk is highest where EBS is internet-exposed or where low-privilege accounts are easy to obtain; unpatched versions outside 12.2.3-12.2.15 are not in scope per the advisory.

This is a genuine priority for organizations running Oracle E-Business Suite. The CVSS 3.1 base score of 8.8 is driven by a network attack vector (AV:N over HTTP), low attack complexity (AC:L, described as 'easily exploitable'), no user interaction (UI:N), and full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) resulting in complete takeover of Oracle Engineering. The one meaningful barrier is PR:L - the attacker must hold a low-privileged authenticated EBS account, so this is not fully unauthenticated. Key exploitation-maturity signals are absent: no CISA KEV listing, no public POC, and no EPSS score was provided in the input, so real-world exploitation likelihood cannot be quantified from this data. The input Tags label this 'Information Disclosure,' which conflicts with the description's explicit 'takeover' outcome and the I:H/A:H impact - treat the tag as understated and the impact as full compromise. Net: high intrinsic severity and low complexity make this important to patch promptly, but the authentication requirement and lack of any observed exploitation suggest it is not (yet) a mass-exploitation emergency.

An attacker who has obtained any low-privileged Oracle E-Business Suite user account sends crafted HTTP requests to the Oracle Engineering Change Management component on an exposed EBS instance (versions 12.2.3-12.2.15). Because the flaw is network-reachable and easily exploitable with no user interaction, a single authenticated session can be escalated into full takeover of Oracle Engineering. No public exploit code was identified at the time of analysis.