Oracle General Ledger EUVD-2026-106218

Requires an authenticated low-privilege Oracle E-Business Suite account with HTTP network access to the General Ledger application (Internal Operations component) on affected versions 12.2.3 through 12.2.15; no user interaction or elevated privileges are needed. Exploitation is limited by the authentication prerequisite (PR:L - the attacker must already possess valid credentials) and by scope: impact is confidentiality-only (unauthorized read of General Ledger data), with no integrity or availability effect. The flaw is confined to the EBS 12.2.x branch within the stated version range.

This is a moderate-risk, not top-priority, vulnerability despite affecting a sensitive ERP component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity attack requiring low privileges (PR:L) and no user interaction, with a pure confidentiality impact (C:H, I:N, A:N) - an authenticated information-disclosure flaw rather than a code-execution or integrity/availability issue. No EPSS score, KEV listing, or public POC was supplied, so there is no signal of active or imminent exploitation; status is 'no public exploit identified at time of analysis.' There is a notable conflict in the input: the 'Authentication Bypass' tag contradicts the CVSS PR:L requirement, which explicitly assumes the attacker already holds valid low-privilege credentials - treat the tag as suspect and rely on the vendor vector, which does NOT describe an unauthenticated bypass. Net assessment: a genuine confidentiality concern for organizations running affected EBS versions with many internal/portal users, but the authentication requirement and confidentiality-only impact keep it below critical priority absent exploitation evidence.

An attacker with a low-privilege Oracle E-Business Suite account (or a compromised self-service/portal user) sends crafted HTTP requests to the General Ledger Internal Operations component. Because the attack is network-based with low complexity and no user interaction, the attacker reads financial data they are not authorized to see, resulting in disclosure of critical General Ledger data. No public exploit code is known at this time.