Oracle Quality EUVD-2026-106231

Exploitation requires an authenticated low-privileged account on Oracle E-Business Suite with network HTTP access to the Oracle Quality module's Internal Operations component; affected deployments are EBS versions 12.2.3 through 12.2.15. No user interaction is needed and attack complexity is low, but the PR:L requirement means a purely anonymous external attacker cannot exploit it without first obtaining valid (even minimal) EBS credentials - this authentication prerequisite is the primary factor limiting real-world exploitation. Impact is limited to confidentiality and integrity of Oracle Quality-accessible data; there is no availability/denial-of-service effect.

This is a genuinely high-priority vulnerability for organizations running Oracle E-Business Suite, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) scores 8.1 and describes an easily exploitable network-reachable flaw requiring only low privileges and no user interaction, with high confidentiality and integrity impact but no availability impact. The limiting factor is PR:L - an attacker needs an authenticated, low-privileged EBS account, so this is not fully unauthenticated and favors insiders or attackers who have already obtained credentials. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk signal rests almost entirely on the vendor-assigned CVSS. Note a metadata conflict: the input Tags include 'Authentication Bypass,' but the CVSS vector specifies PR:L (authentication required), which directly contradicts a bypass characterization - treat the 'Authentication Bypass' tag as suspect pending vendor confirmation. Overall: a real priority to patch in the next maintenance window given the large EBS install base and sensitivity of manufacturing/quality data, but the authentication requirement and absence of exploitation signals argue against immediate crisis response.

An attacker who holds any low-privileged Oracle E-Business Suite account (or has phished/compromised one) sends crafted HTTP requests to the Oracle Quality Internal Operations component and leverages the flaw to read or tamper with critical quality and manufacturing data beyond their authorization. Because the attack needs no user interaction and has low complexity, a single valid foothold account is sufficient; no public exploit code is identified at time of analysis.