EUVD-2026-106214
GHSA-wgjw-h2rc-2g2j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach EBS HTTP endpoint
-
ExploitSend crafted request to Change Management
-
ExecutionBypass data access control
-
ImpactRead subset of Engineering data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network HTTP access to a deployed Oracle E-Business Suite instance running Oracle Engineering (Change Management component) at version 12.2.3 through 12.2.15; no authentication, credentials, or user interaction are required per PR:N/UI:N. The primary limiting factor is reachability of the EBS web tier - exposure is far higher for internet-facing deployments than for instances restricted to internal networks - and impact is bounded to read-only disclosure of a subset of Oracle Engineering data (no modification or disruption). Instances already patched via Oracle CPU October 2026 or outside the 12.2.3-12.2.15 range are not affected. |
| Impact | This is a moderate-severity information-disclosure flaw (CVSS 3.1 base 5.3) in the Change Management component of Oracle Engineering within Oracle E-Business Suite. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, which makes initial access trivial where the EBS web tier is exposed. However, impact is strictly limited: C:L with I:N/A:N and scope unchanged (S:U) means only a subset of Oracle Engineering data is readable, with no write or availability effect. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public exploit was referenced, so there is no public exploit identified at time of analysis. The practical signals therefore conflict with the 'easily exploitable unauthenticated' framing: the entry barrier is genuinely low, but the payoff (partial read-only disclosure) is modest, so this is a patch-in-normal-cycle issue rather than an emergency unless the EBS instance is internet-facing or handles sensitive engineering/change data. Note the input Tag 'Authentication Bypass' appears inconsistent with the description, which characterizes the issue as unauthorized read access by an unauthenticated attacker rather than a bypass of an authentication control - treat that tag with caution. |
| Exploit ScenarioDerived | An unauthenticated attacker with HTTP access to an internet-facing or internally reachable Oracle E-Business Suite instance sends crafted requests to the Oracle Engineering Change Management endpoints to retrieve a subset of engineering data they should not be able to read. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, no victim interaction, and no special timing are needed. No public proof-of-concept was referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated information disclosure in the Oracle Engineering module (Change Management component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a remote attacker with HTTP reachability to read a limited subset of application data. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning no credentials or user interaction are required, but confidentiality impact is partial and there is no modification or availability effect. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; realistic exposure depends almost entirely on whether the EBS web tier is internet-facing or confined to an internal network. Oracle addresses it in the October 2026 Critical Patch Update.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which contains the fix for Oracle Engineering Change Management across 12.2.3-12.2.15; Oracle CPUs are cumulative system patches applied per product family, so follow the advisory's EBS-specific instructions rather than upgrading the version number alone. No exact fix version is published in the available data, so treat the CPU advisory as the definitive source and verify patch application through the EBS patch history before closing the finding. Where patching must be scheduled, compensating controls are practical here because the flaw is a network-reachable, read-only disclosure path: restrict access to the EBS application tier so that only trusted internal networks or VPN ranges can reach the HTTP endpoints (typically enforced at the reverse proxy/firewall in front of the application tier, at the cost of blocking legitimate remote users unless VPN/ZTNA is provided); front the instance with an authenticating reverse proxy or WebGate/SSO layer that forces authentication before requests reach the Engineering pages, which is effective but will not help if the vulnerable path is reachable directly on an unfiltered port; and disable or un-publish the Oracle Engineering / Change Management responsibility and its menu entries for users who do not need them, accepting the functional loss for those users as the trade-off. Monitoring for anomalous unauthenticated GET/POST traffic to Engineering Change Management URLs on the application tier provides detection but is not a substitute for the CPU.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is a large multi-tier enterprise application platform, and Oracle Engineering is the module handling engineering change management workflows (engineering change orders, revisions, item and bill-of-material change data). The affected surface is the HTTP-facing application tier serving the Change Management pages and their underlying request handlers. No CWE was assigned by the source feed, but the practical root cause class is a missing or improperly enforced authorization/access-control check on a data-retrieval path: the CVSS vector (PR:N/UI:N) indicates the endpoint does not require an authenticated session or any user action, which is why Oracle's own bulletin labels it 'easily exploitable' via network HTTP. The scope is unchanged (S:U) and impact is limited to low confidentiality (C:L), so the practical primitive is enumeration and disclosure of a bounded subset of Engineering/Change Management records rather than a broader compromise of the EBS database or application tier. Because EBS deployments frequently sit behind reverse proxies, SSO gateways, or VPNs, the effective attack surface is usually defined by network placement rather than by the vulnerability itself.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network HTTP access with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is partial read-only disclosure within one component, so C:L, I:N, A:N, S:U.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Engineering. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Engineering accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB