Oracle Bills of Material EUVD-2026-106221

Exploitation targets the Internal Operations component of Oracle Bills of Material within Oracle E-Business Suite versions 12.2.3 through 12.2.15, reachable over the network via HTTP. It is NOT exploitable by anonymous attackers: the CVSS vector's PR:H requires the attacker to already hold a high-privilege authenticated account on the EBS instance. Exploitation is further limited by HIGH attack complexity (AC:H), meaning success depends on conditions the attacker cannot fully control (e.g., specific timing, state, or configuration), making reliable exploitation difficult. The offsetting factor is the scope change (S:C): a successful attack can significantly impact additional Oracle products beyond Bills of Material, so defenders should weight the blast radius higher than the difficulty alone would suggest. No user interaction is required (UI:N).

This is a genuinely high-CVSS score (7.2) but the real-world risk is materially tempered by its exploitation metrics, making it a lower practical priority than the headline number suggests. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C) shows network reach but requires HIGH attack complexity (AC:H) and HIGH privileges (PR:H) - meaning the attacker must already hold a privileged, authenticated account on the EBS instance AND overcome conditions outside their control. The elevated score is driven largely by the scope change (S:C) and the HIGH integrity impact (I:H), not by ease of access. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no POC was supplied, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. Signals are internally consistent: a high-privilege, high-complexity flaw is unlikely to see opportunistic mass exploitation, favoring a targeted-abuse or insider/post-compromise profile over widespread automated attack. The scope change is the one signal warranting elevated attention, as impact can propagate beyond Bills of Material to additional EBS products.

An attacker who has already obtained high-privilege authenticated access to an Oracle E-Business Suite instance (e.g., a compromised privileged application account or a malicious insider) sends crafted HTTP requests to the Bills of Material Internal Operations component. By exploiting the flaw under the required non-trivial conditions (AC:H), they modify or delete critical BoM data and, due to the scope change, affect additional connected Oracle products. No public exploit code is known at the time of analysis.