Oracle Compensation Workbench EUVD-2026-106220

Exploitation requires an authenticated low-privileged account (PR:L) with network/HTTP access to the Oracle Compensation Workbench 'Total Compensation Statement' component in Oracle E-Business Suite versions 12.2.3 through 12.2.15, AND requires human interaction from a different victim user (UI:R) - i.e., a second person must view or interact with the attacker-supplied content for the payload to trigger. These two factors (required prior authentication and mandatory victim interaction) are the primary limits on real-world exploitation; the scope change (S:C) means successful attacks may impact resources beyond the vulnerable component itself.

This is a moderate-severity issue (CVSS 3.1 base 5.4) that should be patched in the normal Oracle Critical Patch Update cycle rather than treated as an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) describes a network-reachable but low-privileged, user-interaction-dependent flaw with only partial confidentiality and integrity impact and no availability impact - the scope change (S:C) and the UI:R + C:L/I:L + A:N pattern are the classic signature of a stored/reflected cross-site scripting (XSS) vulnerability rather than a direct server compromise. No EPSS score was supplied in the input, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so all three exploitation-likelihood signals are either absent or negative; there is no indication of active exploitation. The one conflicting signal is the input 'Authentication Bypass' tag, which contradicts the vector's PR:L (an authenticated low-privileged user is required) and the UI:R/scope-change XSS pattern - treat that tag as suspect and verify against the Oracle advisory. Net: a real but routine-priority vulnerability, not a high-urgency item, with risk further limited by the requirement for both low-privilege authentication and victim interaction.

A low-privileged authenticated user of Oracle Compensation Workbench injects a malicious payload (consistent with cross-site scripting given UI:R, scope change, and C:L/I:L impacts) into a Total Compensation Statement field. When another user - such as an HR administrator or manager - views the crafted content, the payload executes in their session, allowing limited unauthorized read of some data and unauthorized insert/update/delete of a subset of accessible data. No public exploit code is identified at time of analysis.